NAT vs. Firewall

Many clients are strictly using NAT in place of a firewall. What is the easiest way to explain to them that they should have a firewall in addition to NAT?