Find your version of Java, then find all the security release notes since to date, print them out and show them to your "rents".. If you/they have applets enabled in your browser, it's very naive and insecure to use a JVE with known attack vectors whether your timer runs under it or not.
Protip: Steer the conversation *away* from simply disabling Java in the browser because, though it's orders of magnitude safer, it *is* counter productive to your goal. ;-)