The mayor of a mid-sized city has hired you as a junior cybersecurity advisor. The city runs its water treatment, traffic lights, power distribution, and 911 emergency services on aging computer systems — many running Windows 7, which no longer receives security updates. The IT manager says: 'We've never been hacked, so we're probably fine.' Last month, a neighboring city's water treatment system was briefly compromised. The city has a limited budget. What are the most urgent risks you would identify, and what would you recommend as immediate priorities given the budget constraint?