TAGs: Security risk analysis