It's an art form to get people to give a shit about security. Sometimes puff pieces work, sometimes they don't. Dull numbers are usually more effective: A vulnerability needs to have a specific risk, is easy/hard to execute and could cost the company x dollars if exploited and would only cost x dollars to fix in x amount of time.

You have to summarize the risk and cost to the organization instead of trying to explain the problem in all its detail.

You probably knew that, but just passing along how I have had to cope over the years.