As others have said, being head of security is meaningless if the people in charge of actually making changes refuse to make the changes you prescribe. I've be

As others have said, being head of security is meaningless if the people in charge of actually making changes refuse to make the changes you prescribe. I've been in that situation at a previous job. The infrastructure for our service was set up so that EC2 instances would start up and pull their code from a central repo. But this repo was open to the world and did not require authentication. It was only a matter of time before some malicious user discovered this and our proprietary server code got leaked. It took weeks of hounding and escalating until something changed, and at first all they did was change the security groups to limit where you could connect from, and even the first patch merely limited it to a few /8 and /16 CIDRs that covered massive swaths of AWS-owned IPs. They still didn't require authentication.