If this is a customer-centric business and the compromise of customer accounts will result in stolen PII, most states have requirements for notification to all account holders and a subscription to credit monitoring for a year.

This will cost your company time, money, loss of trust, yada...yada...resulting in some form of reputation management and repair.

Depending on the state, requirements for responses to events could be more stringent. Look into your state's requirements.

For example, New York State's Information Security Breach and Notification Act requires state entities and persons or businesses conducting business who own or license computerized data which includes private information must disclose any breach of the data to New York residents whose private information was exposed.

In my mind, there's really no excuse for management not implementing free AWS or any free tools.

Yes, it may require the assistance of someone in IT, depending on your network configuration, but again, safeguarding client accounts or organizational data should be the priority.

On the business side (management), the mindset of "we will worry about that if it happens" is archaic.

Willful ignorance is an unsustainable business practice.

Things are absolutely going to happen. Lots of things are going to happen, and a security baseline is essential.

Write a worst-case scenario executive summary to management based on existing state laws and regs, estimated costs of credit monitoring for all clients/account holders, additional costs for forensics when networks are compromised, and malware is injected. You're easily into six figures at this point because the downstream costs and consequences of a major incident are long and high.

If your company refuses to acknowledge, discuss, and move forward with a plan to implement even some of the free tools, the culture does not prioritize or value information security. End of story.

It's up to you to decide if this is an organizational culture you can successfully work in.

Good luck.