Risk analysis of legacy systems