I work for a small consulting company with no formal IT personnel. One other employee and I are the only ones who actually care about information security and network management. We both get a ton of resistance when we try to spend time on improving security because it is not directly billable.

I just discovered that the security policies that the directors advertise to clients and use to acquire all of our business don't even come close to reflecting how we actually operate. **Is there anything I can do other than jump ship?**

I am rather inexperienced in this side of things as I am primarily a developer still trying to make my break into the security industry. **Being one of two primarily 'responsible' for the network now, am I at any personal risk?**