IT departments don't bother themselves with website security. Your web security team should coordinate with your IT security. But you probably don't have a web security team, do you?