Security is almost always sold using "fear of loss" as main motivator. I don't know how many people I run into who are completely addicted to the FUD. Rational argument has no effect, because they really seem to want the danger to be more intense. As a security researcher, I have found the threats to be over-stated and the most common exploits, like insider attacks, to be discounted. They are not discounted because they are not real, but because the solutions are training and policy-based, not magic-bullet technology solutions.