Risk management in hybrid environments