Company with poor practices, compliance?

I work at an international company and in our department which is quite siloed security practices are poor. Lots of development tools haven't been updated in years. They do have a compliance department but it doesn't seem really connected. Does it make sense to report so I don't put myself into legal trouble should anything bad happen? Does it make a difference in which country I am? I have raised the issues repeatedly internally and things are being remediated but …

compliance connected cybersecurity department development don international legal poor practices report security siloed security tools work