Need an argument to sell a secure development lifecycle to upper management ?
Present them this (probably) hand drawn scientific chart:

I expect this chart to be somehow close to reality when refering to large and mature software projects, although it's soooo interestingly non-scientific ;)