It has to start somewhere, even if imperfect.

I have been in meetings were the Data Security Officer refused to sign off on specific projects, without having a proper pentesting report in place, for example.

Because legally it would be their responsibility, if something would happen.