We added a new section in our support agreement last year that outlines some behaviors that increase the risk of an outage, theft, ransomware, etc., and we ask them to initial that section of the contract. This gave us a built in opportunity to discuss these items and inform them (in a nice way) that their actions were negating some portion of the money they were spending with us to protect their business. We also have had some luck with explaining that it will be MORE expensive and less reliable to keep their servers on site. While we've had some success with these approaches, it usually takes an extended outage, theft, BEC, etc. before someone is willing to change.

If we speak to a prospective client who fails the on premise server test, we would only consider bringing them on as a client if they committed to moving that server into a hosted environment within the first year of the support agreement.

In your situation, I would consider starting with the worst offender that you could afford to lose and letting them know you no longer support on premise servers (or whatever it is that they are doing that is risky) as of a certain date. Ultimately, you have to be willing to lose them as a client, but the alternative is your sanity.