End-of-Life Software Is an Unpriced Liability

The Decision in Front of You

Windows 10 left support on October 14, 2025. After that date Microsoft stopped shipping security fixes to any business that had not paid for Extended Security Updates ¹. SQL Server 2016 followed on July 14, 2026 ². Red Hat Enterprise Linux 7 left standard maintenance on June 30, 2024 ³. Each date was published years ahead.

The decision is whether those dates are managed as a financial obligation with a schedule, or discovered as a security finding after they pass. Every piece of software in the company will reach one. The cost of reaching it unprepared is set by the vendor's price list, the regulator's expectations, and whoever finds the next unpatched flaw.

This paper concerns lifecycle planning and budgeting. A separate paper in this series covers the operational work of patching software that is still supported.

What's Happening

Vendors publish the dates, and the extensions cost more each year

Software vendors follow fixed lifecycle policies. Microsoft's Windows 10 page states that after October 14, 2025 it no longer provides technical support, feature updates, or quality updates, including security fixes ¹. Businesses can buy Extended Security Updates at $61 per device for the first year, and the price doubles each year for a maximum of three years ¹. The program is cumulative: an organization that joins in year two pays for year one as well ¹. It covers critical and important security fixes only, with no new features and no general technical support ¹.

Databases and operating systems work the same way. Microsoft's lifecycle page shows SQL Server 2016 extended support ending July 15, 2026, with three paid security-update years running to July 2029 ². Red Hat offers Extended Life Cycle Support for RHEL 7.9, limited to Important and Critical security fixes, through May 31, 2029 ³. Runtimes move faster. The PHP project lists security support for PHP 8.2 ending December 31, 2026, and for 8.3 a year later ⁴.

Product	End of standard support	Paid extension available	Extension ends
Windows 10 (22H2)	October 14, 2025 1	Yes, $61 per device in year one, doubling yearly 1	Three years after end of support 1
SQL Server 2016	July 14, 2026 2	Yes, Extended Security Updates 2	July 2029 2
Red Hat Enterprise Linux 7.9	June 30, 2024 3	Yes, Extended Life Cycle Support 3	May 31, 2029 3
PHP 8.2	December 31, 2026 (security fixes) 4	No vendor extension from the project 4	Not applicable
Pulse Connect Secure 9.1x VPN	December 31, 2024 11	None; vendor advises migration 11	Not applicable

Source: vendor lifecycle documentation as cited.

A meaningful share of every estate is already past its date

runZero studied about 8 million assets across a few hundred US enterprises in 2025 and found 8.56% running an end-of-life operating system, with about 5% beyond even extended support ¹⁵. It estimated that Windows 10's retirement would make roughly one third of enterprise Windows assets unsupported at once, tripling the share beyond support from about 5% to about 16% ¹⁵.

Open-source platforms show the same pattern. Perforce's 2025 State of Open Source report, produced with the Eclipse Foundation and the Open Source Initiative, found 40% of large enterprises still running CentOS Linux after its end of life ¹⁶. Organizations running end-of-life platforms such as CentOS or AngularJS were nearly three times as likely to report a failed compliance audit as the 14% of all respondents who did ¹⁶.

Regulators and standards now name unsupported software directly

CISA lists "use of unsupported (or end-of-life) software" first in its catalog of Bad Practices, and says the risk is especially serious for technology reachable from the internet ⁵.

In February 2026 CISA went further. Binding Operational Directive 26-02 orders federal civilian agencies to inventory every end-of-support edge device within three months, remove those already past support within 12 months, remove all of them within 18 months, and within 24 months run a continuous process that retires such devices by their end dates ⁶. CISA cited "widespread exploitation campaigns by advanced threat actors targeting EOS edge devices" and noted that lifecycle management is already required by OMB Circular A-130 ⁶. CISA called the risk "disproportionate and unacceptable" and encouraged every network defender to follow the accompanying guidance ⁷. The directive binds only federal agencies, but it sets the standard an auditor or insurer will reach for.

Payment card rules already require the register this paper recommends. PCI DSS v4.0 requirement 12.3.4, mandatory since March 31, 2025, requires a review at least every 12 months of the hardware and software in use ⁸. The review must confirm vendors still ship security fixes promptly, document any announced "end of life" plans, and record a plan approved by senior management to remediate outdated technology ⁸.

Attackers go after what cannot be fixed

Volt Typhoon's router botnet, 2024. In January 2024 the Justice Department announced it had disrupted a botnet that a Chinese state-sponsored group used to hide its intrusions into US critical infrastructure. Most of the hijacked devices were small-office Cisco and NetGear routers that had reached end of life and no longer received security updates ¹⁰. The routers' owners had done nothing beyond leaving retired equipment plugged in.

Criminal proxy networks, 2025. In May 2025 the FBI warned that criminals were infecting end-of-life routers with a variant of TheMoon malware and renting them out as proxies to hide fraud and cryptocurrency theft ⁹. The malware needed no password; it scanned for open ports and sent commands to a vulnerable script ⁹. The FBI's first recommendation was to replace the routers ⁹.

Pulse Connect Secure, 2025. Ivanti disclosed a critical remote code execution flaw, CVE-2025-22457, on April 3, 2025, after exploitation that began in mid-March ¹¹. Supported appliances had a fix from February. The older Pulse Connect Secure 9.1x line had reached end of support on December 31, 2024 and would never receive one ¹¹. Some of the compromised customers were running it, and Ivanti's advice to them was to migrate ¹¹. A Shadowserver scan days later found 5,113 vulnerable instances and said a large share were the unpatchable 9.x appliances ¹².

SonicWall SMA 100, 2024 to 2025. Google's Threat Intelligence Group reported in July 2025 that a financially motivated group had been attacking end-of-life SonicWall SMA 100 remote access appliances since at least October 2024, including fully patched ones ¹³. The attackers used stolen administrator credentials to plant a rootkit that hid its own files and erased logs, and Google assessed the activity may support data theft, extortion and ransomware ¹³. Google's hardening advice ended with one line: replace end-of-life SMA 100 appliances ¹³.

South Staffordshire Water, 2026. In May 2026 the UK Information Commissioner's Office fined the water company's parent £963,900 over a breach that began with a phishing email in September 2020 and went undetected for about 20 months ¹⁴. Attackers took more than 4.1 terabytes of data affecting 633,887 people, including bank details and National Insurance numbers ¹⁴. The ICO's findings listed unsupported software, including Windows Server 2003, alongside monitoring that covered 5% of the environment ¹⁴.

Why the Usual Approach Fails

Most companies learn about end of support from a scanner, an auditor, or an incident, after the decision has been made by default.

The date belongs to nobody. A server's end date sits in a vendor document. The application owner assumes infrastructure tracks it, infrastructure assumes procurement does, and procurement tracks contract renewals, which are different dates.

Retirement has no budget line. Replacing a database or an appliance is a project. It competes with revenue features and loses until the deadline makes it urgent.

Extended support is treated as a solution. Paid extensions buy time, and the vendor prices them to end. Windows 10 Extended Security Updates double each year and stop after three ¹. They cover security fixes only ¹³. A company that buys the extension without funding the exit has moved the deadline and raised the price.

Appliances get forgotten. Firewalls, VPN concentrators and routers run vendor firmware that does not show up in desktop or server inventories. They sit on the internet edge, which is where CISA, the FBI and Google's investigators found attackers working ⁶⁹¹³.

The Framework: The Lifecycle Register

Run end of support the way finance runs debt maturities. Each item has a principal, a maturity date, and a plan to refinance or repay, reviewed on a fixed schedule.

The register holds one row per product version in use, across five categories: operating systems, databases, language runtimes and frameworks, network and security appliances, and commercial applications. Each row records the version, count of instances, internet exposure, business owner, vendor end date, any paid extension with its price and final date, the chosen path, and the budget year that pays for it.

Set the decision point by lead time. Internet-facing appliances and anything holding regulated data need a decision 24 months before the vendor date. Databases and server operating systems need 18 months, since migration testing is slow. Desktops and runtimes need 12. A row that reaches its decision point without a funded plan goes to the audit committee as an exception.

Choose one of four paths. Upgrade in place when the vendor offers a supported version and the application tolerates it. Replace when the product line is ending. Buy paid extended support only with a dated exit plan funded in the same budget. Isolate and accept, removing internet exposure and recording the risk with an executive signature, only when the first three are impossible and the system holds nothing regulated.

Price the late decision. The cheapest moment to act is before the date. Exhibit 2 shows how the bill grows when the decision slips.

Scenario	Year one	Year two	Year three	Three-year total
Replaced before October 2025	$0 ESU	$0 ESU	$0 ESU	Replacement cost only
Enrolled in ESU from the start, then retired	$24,400	$48,800	$97,600	$170,800 plus replacement
Ignored, then enrolled in year two	$0	$73,200 (years one and two together)	$97,600	$170,800 plus replacement, with a year unpatched

Source: author's illustrative estimate using Microsoft's published commercial price of $61 per device for year one, doubling each year, and cumulative enrollment ¹. Year two is $122 and year three $244 per device. Excludes volume discounts, cloud-managed discounts and hardware. Replacement is required in every scenario; ESU only delays it.

Replacement happens in every row, so the extension only changes when it happens and how much is spent first. Waiting saves nothing either, because late enrollment charges for the missed year while the devices sat exposed.

Costs, Risks, and Tradeoffs

Area	Cost or risk	Mitigation
Capital timing	Replacements land in budget years chosen by vendors	Plan 18 to 24 months ahead and smooth spend across years
Inventory effort	Building the first register takes weeks, and appliances and embedded runtimes hide from scanners	Start with internet-facing devices and regulated data stores; add categories quarterly
Forced upgrades	Some upgrades break applications or require licensing changes	Test early; budget a paid extension for the few systems that cannot move in time
Extended support	Annual price rises and security-only coverage 13	Buy only with a dated, funded exit in the same approval
Accepted risk	Isolated legacy systems still fail audits and can still be reached internally	Require executive signature, remove internet exposure, review each quarter
When this is wrong	A small firm on SaaS with few owned servers or appliances has little to register	Track the handful of owned devices and rely on vendor contracts for the rest

Source: author's analysis.

Industrial and medical equipment is the hardest case. Some controllers and devices are certified on an old operating system and cannot change without recertification. For those, isolation, monitoring and a replacement schedule tied to the equipment's capital plan are the honest answer. CISA's directive itself excludes operational technology for this reason ⁶.

How to Act

Window	Actions	Owner	Milestone
First 30 days	Inventory every internet-facing appliance and its firmware version. Check each against its vendor's end-of-support list.	Network or security lead	100% of edge devices listed with vendor end date
First 30 days	Name an owner for the register and one business owner per system.	CIO	Register owner named; owners assigned for every edge device
First 90 days	Extend the register to server operating systems, databases, runtimes and commercial applications. Record end dates, extension options and prices.	Infrastructure and application leads	Register covers all production systems; every row has a date and owner
First 90 days	Decide a path for everything already past support or reaching it within 24 months. Remove or replace any end-of-life edge device.	CIO with CFO	Zero end-of-life devices on the internet edge; every near-term row has a chosen path
First 365 days	Put retirements and extensions into the annual budget by year. Report the register to the audit committee quarterly. Align evidence with PCI DSS 12.3.4 where cards are in scope.	CFO with CIO and compliance	Budget lines for every retirement in the next two years; four quarterly reports delivered
First 365 days	Make end-of-support review part of every purchase: record the vendor's published support term before signing.	Procurement	Support term recorded on 100% of new technology contracts

Source: author's recommendation, informed by CISA BOD 26-02 milestones ⁶ and PCI DSS v4.0 requirement 12.3.4 ⁸.

Questions to Ask Your Team

1. Which of our internet-facing devices are past their vendor's end-of-support date today?
2. What reaches end of support in the next 24 months, and is each one in a budget?
3. Who owns the end date for each production database and operating system?
4. Where are we paying for extended support, what does it cost next year, and when does it stop?
5. If an auditor asked for our annual technology review and the remediation plan management approved, what would we hand over?
6. Which systems have we decided to isolate and accept, and who signed for that risk?
7. Does every new technology contract record the vendor's support term?

Closing

Unsupported software is a liability with a known maturity date and a rising carrying cost. The vendor publishes the date, the regulator expects you to have seen it, and attackers look for the equipment that missed it. Keep one register, decide each retirement 18 to 24 months ahead, fund it in the year it falls, and report the balance to the audit committee every quarter.

---