OK, this is simple.
How many computers does your organisation have?
What OS does each run?
What computers are connected to the internet?
Find the answers to those simple 3 questions or, better, have an automatic tool thats tracking all of the above, and youll be in a position to start managing and securing your infrastructure.
If you cannot answer those then sack your C suite and pull the internet connection.