End-of-life is the only IT risk that arrives with years of warning and still manages to surprise people. Nothing breaks on the day support ends. The software keeps working, which is exactly the problem: the consequence is invisible until a flaw appears that will never be fixed, or a client asks whether you are running supported systems and you have to guess. This is how to turn that into ordinary scheduled work.
The four kinds of end-of-life
They behave differently and get missed for different reasons.
- Operating system versions. The best publicized and still the most missed, because the edition matters. A Windows version can reach end of updates on the Home and Pro editions a full year before the Enterprise edition of the same version, so advice aimed at large organizations does not apply to you.
- Business applications. Your practice-management, accounting or industry-specific software. These often go quiet rather than announcing: no formal notice, just a version nobody updates any more and a vendor who stops answering questions about it.
- Firmware on devices. Routers, firewalls, access points, cameras, printers, door controllers, refrigeration and HVAC controllers. The device keeps doing its job perfectly for a decade while the software inside it stops getting fixes. When a vendor describes a product line as legacy and says it no longer receives software or security updates, that is an end-of-life notice in commercial language.
- Interfaces and APIs. The one people never see coming. A platform retires an older way for applications to connect, and something quietly stops working: a copier that scanned to email, an integration a previous IT person built, a backup tool nobody looked at.
Build the register
One table, six columns, and it does not need software. What it is, where it is, version, support end date, who owns the upgrade, and what it would cost to replace. Fifteen rows is a normal small-business answer. The value is not completeness, it is that the blank cells become visible. A row where nobody can name the version, or where the owner column is empty, is the finding.
Build it from three sources: what you pay for (your subscriptions and invoices tell you most of the software story), what is plugged in (walk the office and the comms cabinet, write down make and model), and what connects to your systems (the integrations and connected apps lists in Microsoft 365 or Google Workspace). This is the same inventory discipline that makes IT documentation worth keeping.
Decide early: extend, upgrade, or replace
Each row gets one of three answers, and the honest comparison matters because paying to extend is usually designed to get more expensive over time. Extended support pricing commonly doubles each year, which is a nudge rather than an offer. Run the arithmetic over the realistic remaining life of the asset, not just the next twelve months, and compare it against replacement.
Extend when there is a specific, time-boxed reason: an application that genuinely will not run on the new version, a certified device, a replacement already budgeted for a known quarter. Upgrade when the path is a version change rather than new hardware, which is the cheap pile and usually the biggest. Replace when the vendor has stopped shipping fixes entirely, because at that point no amount of money buys you a patch.
Handle the awkward cases
Every small business has two or three rows that resist the plan. The machine running the one piece of software nobody wants to touch. The device the vendor abandoned but that still does something essential. When you cannot upgrade or replace yet, reduce exposure instead: take management interfaces off the internet, put the device on its own segment so it cannot reach everything, remove internet access it does not need, and restrict who can log in. An unsupported system that nothing can reach is a manageable risk. An unsupported system answering the open internet is how most of the ugly incidents start.
Make it a calendar habit
Support deadlines cluster, often in the same month each year, which means an annual review beats a crisis response. Put one 60-minute block in the calendar at the same time every year, refresh the register, and look twelve months ahead rather than at today. Anything with a date inside that window gets a decision now, while it is still a budget conversation instead of an emergency.
Two cheap additions make it stick: put each known end date directly in the calendar as its own reminder a quarter ahead, and whenever you buy anything, ask for the support end date at purchase and add the row immediately. The register stays current for free if it gets fed at the point of sale.
What this means for your business
Unsupported software is not an abstract compliance ding. It is a system that stops receiving fixes for flaws attackers are actively exploiting, sitting on the same network as your files, and it eventually surfaces as an exclusion on a cyber insurance application or a failed answer on a client security questionnaire. The businesses that get hurt by these deadlines are almost never the ones that decided to keep something old on purpose. They are the ones that never knew what they were running. A register and an annual hour is the whole difference, and it is work we help small businesses set up once so it runs itself afterward.