I'm fortunate in that I am the biggest fish in this small pond, in that I am in charge of my department; it's just a matter of migrating the stuff we run for other departments somewhere else, and I shall make similar points as you just did and expect not to have too hard of a time persuading them to let me come up with safer approaches to hosting our own stuff preferably on our own servers.