A financial services firm utilizes a legacy software for data processing. A risk assessment reveals a 20% likelihood that the software will crash, leading to a productivity loss of $100,000. Alternatively, there is a 1% chance of a security breach through this software costing $2,000,000. An upgrade costs $35,000 and eliminates both risks. Based on the total business impact, what is the BEST risk response?