Comment by slitaz

Then it is even more damning to the head of security if they knew about the vulnerability. The ultimate person to decide whether a vulnerability is not to be patched, is the head of security.