A record label's web application allows aspiring artists to schedule appointments with the producer. Although the application runs on outdated software and represents a security risk, the software is critical for the label to discover new talent.

The record label company requests that the software vendor address the security risks while instructing internal IT personnel to limit the software's access to its internal network.

What kind of risk response does this represent?