Leg acy vulnerabilities may be biggest enterprise cyber risk