Perhaps, just start emphasizing your superior security (and PCI compliance) in your marketing, in a very pointed way. ("Some competitors don't..." or "If considering a competitive offering, ask if they..." – but without specifically naming the competitor.)
Note that this doesn't always impress customers – and sometimes mentioning security concerns activates customer paranoia such that they convert at lower rates! So you may need to test this.
But, if your customers are security conscious, they'll notice the differences when comparing offerings. When they ask your competitor for details, the competitor will either offer false reassurances, or become increasingly aware of their deficiencies, and fix them. (And them fixing their issues may be in your best interest: a famous failure by your competitor could stain your whole category as too-risky for wider adoption by your target customers.)
If and when there is a damaging breach at any competitor, your practices (and marketing) going back to before the breach can help immunize you somewhat from the fallout, even without you ever directly naming the competitor or its failings. (To directly mention a competitor, or its specific troubles after an incident, could be seen as classless and easily backfire. Not only may you have a lapse yourself someday, but any 'gloating' may draw retaliation from competitors or extra attention from criminal hackers who get more glory when compromising systems that brag about their security.)
Note that this doesn't always impress customers – and sometimes mentioning security concerns activates customer paranoia such that they convert at lower rates! So you may need to test this.
But, if your customers are security conscious, they'll notice the differences when comparing offerings. When they ask your competitor for details, the competitor will either offer false reassurances, or become increasingly aware of their deficiencies, and fix them. (And them fixing their issues may be in your best interest: a famous failure by your competitor could stain your whole category as too-risky for wider adoption by your target customers.)
If and when there is a damaging breach at any competitor, your practices (and marketing) going back to before the breach can help immunize you somewhat from the fallout, even without you ever directly naming the competitor or its failings. (To directly mention a competitor, or its specific troubles after an incident, could be seen as classless and easily backfire. Not only may you have a lapse yourself someday, but any 'gloating' may draw retaliation from competitors or extra attention from criminal hackers who get more glory when compromising systems that brag about their security.)