There is both good news and bad news for IT security professionals appealing to their higher-ups for more resources.