Approaching Lost Clients About Security?

mgkimsal2 asks: "As a development shop, we win some bids and we lose some bids for various reasons. What we've found when following up with some prospects which we didn't win is that the development shop they went with has them on ASP/NT servers, with security holes up the wazoo (visible source code, passwords, etc) exposing these clients to massive risk. Example: I just saw a company with 500+ employee records accessible to anyone who feels like connecting to them with SQL Server Enterprise manager. Hire dates, fire dates, SSNs, the works. Should we show these companies how easy it is to get in, and try to win them over as a client? Or just walk away? I've read some heated debates about this - if you break in, even as a demonstration, you're a criminal. But how do you show people they're in danger? Alert the current webmasters? In this particular case it did no good - we were accused of being sore losers! We can't be the only people going through this sort of dilemma." The key here is approaching the company in a way that lets them know you are serious and not trying to spread lies about your competitors. If anyone here has been in this position, your thoughts would be appreciated.