Forgotten risks hide in legacy systems