Stakeholders have an interest in the continued profitability and functionality of your enterprise. Simply reeling off the stats about how common attacks are and how expensive they can be is enough for most people. If you're still not all the way there, try to come up with a few relatively affordable upgrades, such as installing MFA on your Wi-Fi networks, then reporting on how successful they've been.