Relating risk to information security initiatives can help IT security managers persuade their bosses to fund these projects, sponsors of a new survey contend.