IT told to fix security without 'bothering' business