A manufacturing company has identified a critical vulnerability in a legacy industrial control system that manages production line operations. The system cannot be patched due to vendor end-of-life, and replacing it would cost $2 million with 18 months downtime. A security analysis estimates the annual loss expectancy at $150,000. The company purchases a cyber insurance policy covering up to $5 million in losses related to this specific system. Which risk management strategy is the company primarily implementing?