The idea is to make the problem a strategy. Your boss and your boss' boss can't act until you've developed a strategy and, more than likely, tied that strategy to existing business objectives. From the strategy, build tactical methods to accomplish it.

Standardization
Standardization needs to be part of everyone's authentication strategy. It's the wide variety of authentication methods employed that got the company into this trouble in the first place. Identify all the current methods, and include a few that seem viable for the next 5 to 10 years. Then pick the ones that the company will officially support as standard(s). If you can't standardize, you'll never get out of the hole you're in. Of course, I guess your standard could be that you'll support anything that anyone wants. In that case, better you than me.

Policies
Come up with the tactical components and write policies to support them. It might be something like, "All future custom programming will use Web services, SOA, and role-based access control. All incoming access will end at a proxy firewall where authentication, traffic normalization, and scanning will take place, then the request will be reverse-proxied to the intended end point." Or maybe you, like several companies I know, will decide to do away with the DMZ concept altogether. Use a group to create the policies to support the overall strategy, and get it approved by management.

Remediation
Next, fix the highest-risk assets first, followed by applications with lower use and exposure. This means fixing existing systems, implementing the new policies in new custom projects, and enforcing the new policies when buying new software.

Retirement
If a legacy application cannot be brought in line with the new policies, consider getting rid of it. Give end-users a reasonable period of time to select and implement a new system. If the system will not be replaced and you can't adequately protect it using the new policies, communicate as much to management so that they can make the final risk decision.

Even if you can't help your company work through all of these steps, you've improved security and lowered risk just by getting your colleagues, employees, and management to think about AAA in a strategic way. At least it will be on the radar as a consideration, versus the growing deck of cards that keeps you up at night.