Analyzing Risk while Modernizing Legacy Systems