When software reaches end of life, the vendor stops fixing it. For a small IT team, missing an end-of-life date can mean months of running unpatched systems without realising. This checklist covers what end of life means, how to find end-of-life software in your estate, and how to deal with it before it becomes a problem.
What does end of life mean for software?
End of life (EOL) is the date after which a vendor stops releasing updates for a product. Vendors use different names for the stages, so check which one a date refers to:
- End of sale: you can no longer buy new licences, but the product is still supported.
- End of mainstream support: new features and general bug fixes stop. Security fixes usually continue.
- End of extended or security support: security patches stop. This is the date that matters most, and the one most people mean by end of life.
- Paid extended support: some vendors sell a few more years of security fixes after that, such as Microsoft’s Extended Security Updates (ESU) or Ubuntu Pro’s Expanded Security Maintenance.
Once security support ends, any new vulnerability stays open unless you pay for extended security updates where they are offered.
Why end-of-life software is a risk
- Unpatched vulnerabilities: attackers actively look for systems running software that no longer receives fixes, and internet-facing systems such as mail servers and VPNs are found quickly.
- Compliance problems: Cyber Essentials requires software to be supported and high or critical security updates to be applied within 14 days. Unsupported software must be removed or kept out of the assessed scope, and assessors will ask about it.
- Harder support: when something breaks, the vendor won’t help, and compatible versions of other software become harder to find.
A practical end-of-life checklist
- List what you run. Build an inventory of operating systems, hypervisors, backup software, databases and key applications, with their versions. Include the things that are easy to forget: firewall and switch firmware, storage appliances, runtimes such as .NET and Java, container base images and end-user devices.
- Record the support dates. For each item, note the end of mainstream support and the end of security support, taken from the vendor’s own lifecycle page.
- Rank by risk. Deal first with anything internet-facing, holding sensitive data, or close to its end-of-life date.
- Plan the work. Decide whether to upgrade, replace or retire each item, and give each task an owner and a deadline. Where you cannot move in time, buy extended security updates or isolate the system as a stopgap, and record the decision.
- Start early. Upgrades of operating systems, hypervisors and mail servers often involve hardware, budget and licensing, so start at least 12 months before the date. Smaller applications may need three to six months.
- Keep the list current. New versions and new end-of-life announcements arrive all the time, so review your list at least monthly.
Upcoming and recent end-of-life dates
These are some of the dates small IT teams are working through now. Each page has the key dates, the vendor’s own source and what to do next:
- Windows Server 2016: extended support ends on 12 January 2027.
- .NET 8 and .NET 9: both end on 10 November 2026.
- SQL Server 2016: extended support ended on 14 July 2026; paid ESU continues.
- Exchange Server 2016 and 2019: extended security update coverage ends on 31 October 2026.
- VMware vSphere 7: general support ended on 2 October 2025.
- Windows 10: support ended on 14 October 2025; paid ESU continues for organisations.
See every page in our free software end-of-life dates library.
Make it automatic
Checking vendor lifecycle pages by hand works for a handful of products, but it doesn’t scale. Pitlamp tracks end-of-life dates, security advisories and vendor outages for the software you choose, ranks them by urgency and turns the ones that need work into tasks your team can track to the end.
Start a 30-day free trial of Pitlamp. No payment details needed.
Frequently asked questions
What is the difference between end of life and end of support?
Vendors use the terms differently. End of support usually means the end of a particular level of support, such as mainstream support, while end of life usually means security updates have stopped. Always check which date a vendor’s lifecycle page is giving you.
Can I keep using software after its end-of-life date?
It will keep working, but new vulnerabilities won’t be fixed. If you can’t move in time, buy extended security updates where the vendor offers them, isolate the system from the internet and the rest of the network, and plan the replacement.
How far ahead should we plan an upgrade?
For operating systems, hypervisors and mail servers, at least 12 months, because hardware, budget and licensing often need approval. For smaller applications, three to six months is usually enough.
Does end-of-life software fail Cyber Essentials?
Unsupported software in the assessed scope fails the requirement for software to be supported. It needs to be removed, upgraded, or separated into a part of the network that is outside the scope.