Have to document and plain English what some of it means to them especially the security shit. CC everyone and their grandmother. You might catch some shit from your immediate boss but his boss might be impressed at you and worried at the same time that his company is that vulnerable. How big of a corp is this and what kind of money are we talking about?
if the shit's as bad as he says, the only thing documenting it will do it provide a little CYA when there's a breech or when they fail an audit.
and until that time it's going to be really hard to get anything changed. if it means money and downtime no one wants to touch it if it *looks* like it's working right.