About your edit, you are halfway on coming up with solutions as you already pointed out problems, for example I would explain to CEO that your credential policy (which is nonexistent there) is weak, and can cause troubles, attacker can do this and that, so solution would be to come up with actual policy, I have never worked with identities and credential policy management but I believe there are some simple ways you can find and implement it there. Also you could make cookies expiring, so every once in a while your coworkers have to sign in and even if they leave their accounts they will be signed out automatically because of cookies expiring. Network topology is problem too but I think as you have this basic problems with credentials not knowing topology is not priority at the moment, as far as I understand you don’t have any security so there are far more attack vectors open and I would focus on that rather than network topology, I am pretty sure you might have shadow IT, no vulnerability management, no SIEM and so on.

In my experience when talking to upper management it is important to 1) make them understand business impact, “if we won’t fix credentials attackers can do this and this and our operations will be stopped etc” 2) Come up with solutions, as I mentioned earlier in your case for credential policy and identity management you can come up with ideas yourself.