When I read this, I'm left with an overriding sense of panic, of concern, and of course, a willingness to do their best to save what sounds like an abysmal but unfortunately all-too-common situation.
I assume that almost nothing is documented, and any documentation is not up-to-date. I also assume that there are pockets of knowledge hidden within individuals or small teams, and that this knowledge is unlikely to be made known at any time when it could be useful. I have to also assume that, based on some similar-sounding experiences, management and finance feel they have already spent the associated budgets on dealing with developer delays and they aren't proactively engaged on the realities of security, despite daily news alerting everyone to the significant problems that exist, for developers, for companies and for end-users.
Don't do this alone. You can't, especially with your lack of experience. Offer to form a small, tight task-force to review at the broadest level, the areas of concern. Don't have a scale of priorities; it's either a problem, or it isn't currently a problem. This team isn't a place for beliefs and faith of approach; focus on reality and data. If you don't have data, you have a problem.
Make some simple statements on how to approach the problems. And you could consider some trivial steps like using Cloudflare to gain some control over basic website security issues.
And write down everything, ensuring clarity of organisation and structure. Make sure the task-force team do the same.
Identify sources of support and help. Reach out and don't delay.
Most importantly, your new role is to discover and manage the bad news. Good news has no place here...
And I would also take some personal time to review exit strategies, and an awareness of when you should need to make such a move...