This issue is more political than technical.
The organization has a lot of computers that connect via web browser to a central database. Customers are regularly left unattended with physical access to the terminals for over 15 minutes at a time. I reported that they are vulnerable to hardware keyloggers. The official IT response was, "We are aware of that possibility, and have a solution. Getting passwords would not do an attacker any good." But the higher-ups wouldn't let him say anything more -- security through obscurity.
The point is: I think they are bluffing. I don't know what their solution is, but there are hundreds of attack vectors open when you have physical access. Are they really just not worried about it because the risk (probability of attack) is low enough to trump the cost of improving physical security? How do I get them to listen? Is it even worth the effort?