Most small offices have a computer nobody wants to touch. It runs the label printer, or the old accounting software, or the door-lock system. It still works, so nobody has ever questioned it. Its last security update was years ago.
This is the second common way small businesses get breached: attackers use old, well-documented flaws in products the vendor stopped fixing long ago. Every product has an end-of-support date, and nobody sends you a reminder when it passes.
Last week's step was Reduce: shrink what's exposed. This week is step two, Replace: find the gear that's past its support date and decide what to do with each piece.
What "end of life" actually means
End of life, or end of support, is the date a vendor stops fixing security flaws in a product. The product keeps working. It stops getting safer, while attackers keep learning how to break it. Every flaw discovered after that date stays open for good.
Verizon's 2026 Data Breach Investigations Report found that only 26% of the most dangerous known-exploited vulnerabilities were fully fixed in 2025, and that the median time to fix them rose from 32 to 43 days. Those are products that still receive patches. Products past their support date never get a fix at all.
The US government has reached the same conclusion about network equipment. In February 2026, CISA issued a directive ordering federal agencies to find and replace unsupported edge devices: firewalls, routers, switches, wireless access points and similar gear, with all of it gone within 18 months. CISA's reason was widespread exploitation of exactly these devices by advanced attackers.
Your business isn't bound by that directive, but the same devices sit in small offices, and checking yours takes about an afternoon.
What's still running past its support date
Each of these keeps working after support ends, so it tends to stay in place.
1. Operating systems
Windows 10 reached end of support on October 14, 2025. Windows Server 2012 R2 lost extended support in October 2023, and its paid extra-years program ended on October 14, 2026. Older Windows 7 and 8 machines still turn up in small offices, usually attached to something expensive.
Microsoft sells a bridge: Extended Security Updates for Windows 10 cost organizations $61 per device in year one, double each year, for up to three years. Treat it as time to plan a migration, with a fixed end date.
2. Office software
Office 2016 and Office 2019 also lost support on October 14, 2025. Microsoft says the apps may keep working, but warns of "serious and potentially harmful security risks."
3. Routers, firewalls, VPNs and switches
Gear at the edge of your network is the riskiest to leave behind, because it faces the internet. It's also the gear that gets installed once and never revisited, including the modem or router your ISP supplied years ago.
4. Printers, copiers, NAS drives and cameras
These are set-and-forget devices. Vendors often stop releasing firmware updates a few years after a model is discontinued, and nobody is watching for the notice.
5. Point-of-sale and payment terminals
Registers often run an older operating system because they were set up once and never touched again. Payment processors and cyber insurers often expect supported, patched systems.
6. The legacy-app machine
One old PC or server kept alive because the program that runs part of the business, a scheduling tool, a design package or an accounting system, won't run anywhere else. Everyone knows it's fragile, and nobody wants to be the one who turns it off.
7. Old phones and tablets
Employee devices that no longer receive operating system updates but still open company email and files.
Why nobody flags it
In most small businesses, out-of-support gear stays in place for ordinary reasons:
- It works. Nothing breaks, so nothing forces a decision.
- Nobody sends a notice. Vendors publish support dates, but they don't call you when yours arrives.
- No inventory. If you don't know what you own and which version it runs, you can't see what has expired. That's why Week 1 starts with the list.
- Replacing it feels expensive. The cost is visible and the risk isn't, so the purchase keeps getting pushed back.
- Something depends on it. The old machine runs the one program nobody can move.
- Nobody owns it. No one is assigned to notice when a device goes out of support.
So the replacement gets pushed to next year, every year.
How to find it in one afternoon
Start with the device list from Week 1 and add three columns: model, version or firmware, and support end date.
- Check the computers. On Windows, press the Windows key and R, type winver and press Enter to see the version. On a Mac, open the Apple menu and choose About This Mac. If your business manages devices through Microsoft 365 or Google Workspace, the admin console also lists the operating system on each enrolled device.
- Read the labels on the network gear. Find the model number on the router, firewall, switch and access points, then log in to each one to see its firmware version.
- Look up the dates. Search the model name plus "end of support," and check the manufacturer's support page. endoflife.date is a community-run site that tracks support dates for hundreds of products, including Windows, phones and network operating systems.
- Check the quiet devices. For printers, copiers, NAS drives and cameras, look at the manufacturer's firmware page. As a rule of thumb, a device with no firmware update in the last couple of years deserves a closer look.
- Ask the people who set things up. Your IT provider, your point-of-sale vendor and the company that installed the cameras can tell you what's past support. Your cyber insurance questionnaire often asks the same question.
- Write the date down. Record the support end date next to every item, and set a calendar reminder six months before each one.
What to do with each one
Every item on your list gets one of five outcomes. Pick the cheapest one that removes the risk.
| Choice | Use it when | Example |
|---|---|---|
| Retire | Nobody uses it | The old DVR, the spare printer, the forgotten server |
| Upgrade | The hardware can run a supported version | A Windows 10 PC moved to a current Windows, Office 2016 moved to a subscription |
| Replace | It can't be updated and it's worth keeping the function | An old router or firewall, a camera system past support |
| Isolate | A legacy program forces you to keep it for now | The old machine on its own network, with no internet access and few people who can reach it |
| Bridge | You need time to do one of the above | Paid extended security updates, with a firm date to finish moving off |
Start with anything that faces the internet: routers, firewalls, VPNs and cameras. Attackers scan the internet for these devices constantly.
The Replace checklist
The goal this week is a list of what's past support and a plan for each item. The replacements can follow on a schedule.
- Add the dates to your list. Model, version and support end date for every device and program.
- Retire what nobody uses. Unplugging costs nothing and removes the risk completely.
- Fix the internet-facing gear first. Replace or update any router, firewall, VPN or camera system that's past support.
- Isolate what you can't replace yet. Put the legacy machine on its own network, cut its internet access and limit who can reach it.
- Put it on a calendar and a budget. Set a yearly review, a reminder six months before each support date, and a line in the budget so the next replacement is planned instead of an emergency.
Keep it supported
Older equipment is fine as long as the vendor still ships security fixes for it. Track the support dates, and schedule each replacement before the date passes.