Decide whether you're willing to leave the company or lose your job over this. It's not popular to say, but there are enough companies that will manage out indi

Decide whether you're willing to leave the company or lose your job over this. It's not popular to say, but there are enough companies that will manage out individuals that bring up issues like this because there's no management backing and then it just becomes disruptive. It sucks. Think about it and based on that decide on how hard you want to push security issues and awareness. In terms of best steps to actually get security flagged and addressed. Find out whether your company has a compliance or security department. If you're doing B2B, someone may be conducting a SOC2 review annually or the equivalent. These people are typically the ones empowered to do something about security and are the ones to talk to. There's also the possibility that the risks are being mitigated through another method such as a WAF. If there are no security or compliance programs you may want to chat with the sysadmins. It's possible that the company may have decided that security was too expensive and just bought insurance as their mitigation strategy(I worked at one company who unbeknownst to me took payments but wasn't actually PCI compliant who did this). If that's the case, you're better off looking for a new job