A new project for Thycotic requires major enhancements to a legacy application. There are no existing tests. Where do we begin?

This is the first post in a new blog series on the issues as they are tackled in this project. The usual advice you receive in this situation is: Don't write all the missing tests.
Why not? Several reasons ...
- You probably don't understand the system well enough to write good tests
- Each test should just pass as it verifies an existing feature - this breaks the "fail, pass, refactor, pass" process of TDD
- You will probably have large areas of missing coverage as it is difficult to test thoroughly after the fact
- There will be no new features added while you spend all your time writing tests - this can be cost and time prohibitive depending on the size of the existing system
This same advice says to rather add a test when you find a bug or need to work on an enhancement. Over time the number of tests for your application will grow and all will be good. Sounds great but how does it really work and where do you start?
Stay posted for the next in the series: The first test
Read: Legacy TDD: Don't write all the missing tests