4. Improve the education of your organisation's staff
Consider doing an internal IT security bulletin for all staff with handy hints on password management, how to spot dangerous emails, etc. Ensure that management and the board know you are behind this.
Do a series of lunchtime seminars to educate the staff on IT security. These can be done on staying secure online and similar topics that could be useful to employees at home, as well as at work. If staff find your seminars useful at home they are more likely to value you.
Share your knowledge about IT security with the staff when problems arise — you could set up an intranet page which draws attention to current phishing e-mails, or the problems of shared privileged account passwords and the remedies.
Finally there is no substitute for real integrity in any profession. Those who get to the top are those who a) have drive and enthusiasm and b) do everything with integrity and in the interests of the organisation and its staff without compromising or taking shortcuts.