How do you convince an engineering team to prioritize a security patch when they are already behind on a deadline?