EOL (End of Life): Meaning, Risks and Protective Measures

What Does EOL Mean?

EOL is short for end of life. The vendor no longer maintains the product. It keeps running, but it is no longer repaired and no longer secured.

This applies to operating systems, applications, databases, firmware and hardware such as routers, firewalls or servers. Programming languages and libraries also have an expiry date.

Watch out with the abbreviation: in programming, EOL stands for end of line, the end of a line in a text file. In IT security, it almost always means end of life.

The Phases of the Life Cycle

Many vendors split the life cycle of their products into phases. The names differ, but the flow is often similar:

1. General availability: the product is new on the market and gets new features and updates.
2. End of sale (EOS): the product is no longer sold. Updates usually continue.
3. End of regular support: new features stop. Often there are only security updates.
4. Extended support: some vendors deliver security updates for a fee for a while.
5. End of life: there are no more updates and no more help.

The terms are not used the same way everywhere. Some vendors say end of support, others EOL or EOSL (end of service life). What counts is always the life cycle information of the vendor in question.

Well-Known Examples

• Windows 7: support ended in January 2020. Many computers kept running it for years after that.
• Windows 10: support ended on October 14, 2025. For a fee, there are extended security updates (ESU) for a limited time.
• Hardware: routers, firewalls and VPN devices get no more firmware updates after support ends. Devices at the network edge are then a popular target.

A well-known warning was the WannaCry ransomware in 2017. It spread through a flaw in Windows and hit above all computers without current updates. Microsoft even released an emergency patch for Windows XP, which had long been out of support.

Why EOL Is a Security Risk

After support ends, new vulnerabilities are no longer fixed. Attackers know this. They look for systems that will never get rid of a known flaw. For many of these flaws, ready-made exploits exist.

• Open flaws: every newly found vulnerability stays open for good.
• No support: the vendor no longer helps with faults and outages.
• Compatibility: new software and security tools often no longer run on old systems.
• Compliance: auditors, insurers and customers see EOL systems as a gap.
• Follow-up costs: emergency work after an attack is usually more costly than a planned switch.

EOL in ISO 27001, BSI and EU Law

ISO 27001 requires the management of technical vulnerabilities in control A.8.8. The BSI IT-Grundschutz covers the topic in module OPS.1.1.3 patch and change management. A system without updates can hardly meet these requirements.

Vendors are also being held more to account. From December 2027, the EU Cyber Resilience Act requires them to deliver security updates for a set support period. As a rule, this is at least five years. They must state the period at the time of purchase.

How to Handle EOL

1. Keep an inventory: record all systems with vendor, version and end of support. See vulnerability management.
2. Track the dates: compare the inventory with the vendors' life cycle dates on a regular basis. Public overviews such as endoflife.date help with this.
3. Plan early: start the switch one to two years before support ends and plan the budget.
4. Set priorities: systems that face the internet or hold sensitive data come first.
5. Check support when buying: prefer products with long, clearly promised support periods.
6. Test the replacement: try out the successor and the migration before you switch.

When a System Cannot Be Replaced

Sometimes there is no other way. A machine control or a medical device only runs on an old operating system. In that case, keep the risk as small as you can:

• Isolate: put the system in its own network segment without internet access. See network segmentation.
• Limit access: only a few people and systems may access it.
• Monitor: unusual connections are logged and reported.
• Use extended support: if the vendor offers it, it buys time.
• Document the exception: the reason, the safeguards and a planned end date belong in the risk register.

Finding EOL Systems

A vulnerability scan shows where outdated versions with known flaws are running. The SnapScan vulnerability scan checks your systems for known vulnerabilities of all severity levels. It does not actively attack them. On top of that, patch management keeps supported systems up to date.

Conclusion

EOL means the vendor no longer fixes flaws. Every system that keeps running like this becomes less secure over time. If you know the support dates, plan early and strictly seal off systems that cannot be replaced, you keep the risk small.