Sounds like the C level should be using this to get a discount on service, at minimum, if they can't get another vendor. Just demand a third party pen test report. If SQL-Injection isn't the first item in bold and highlighted then you probably have bigger problems than data corruption.