Your system runs on software that is out of support

How this usually comes to light

Few people check support dates out of curiosity. More often somebody else raises it. A Cyber Essentials assessment asks whether your software is still supported by its vendor. A cyber-insurance questionnaire asks the same. An auditor’s report lists an old database version as a finding, or your IT provider says a server is too old to keep patching.

The system, meanwhile, works as well as it ever did, which makes the finding easy to resent. It is still worth acting on.

What out of support means

Vendors publish a date for each version of their products after which they stop issuing fixes. Past that date the software keeps running. Nothing switches off. What ends is the supply of security updates: when a new vulnerability is found, supported versions are patched and yours is not.

Some dates that catch business systems out:

• SQL Server 2014 stopped receiving security fixes on 9 July 2024, and SQL Server 2016 on 14 July 2026.
• Windows Server 2012 and 2012 R2 reached the end of support on 10 October 2023.
• .NET 6 ended on 12 November 2024, three years after its release.
• Internet Explorer 11 was retired on 15 June 2022.

Our end-of-life pages list the date for every version, including SQL Server, Windows Server and .NET.

How much the gap matters depends on exposure. An out-of-support web server facing the internet is a serious risk. An old database on an internal network, reachable only by the application, is a lesser one, though an assessor is still likely to raise it.

Finding out what you are running

This takes less effort than most people expect. Ask your IT provider for the operating system version of each server the system uses and the version of the database. Ask whoever maintains the application which framework version it targets and which third-party components it includes. Put the answers in a list with the vendor’s support date beside each. That list is the basis for every decision that follows.

Your options

Upgrade in place. Move the component to a supported version and leave the application otherwise as it is. For operating systems and databases this is often less work than feared: a SQL Server database can usually be moved to a current version with few or no changes to the application. It needs rehearsing on a copy and testing by the people who use the system.

Pay for extended security updates. Microsoft sells Extended Security Updates for some products for a limited period after support ends. For SQL Server 2016 the programme runs until 17 July 2029. It keeps the fixes coming and improves nothing else, so it is a stopgap for when an upgrade cannot be done in time.

Isolate it. Take the system off the internet, restrict which machines can reach it, and accept that it stays as it is. This suits a system near retirement. It does not suit one that staff or customers need to reach from outside.

Replace it. Where the platform has no upgrade route, replacement or staged modernisation is what remains. It is the largest piece of work, so establish first that the cheaper options are closed.

Where we would start

We would draw up the list and mark each item with its support date and its exposure. In most systems only a few items need attention.

Then we would deal with them in order: anything facing the internet first, then the database, then the application framework. Each upgrade is rehearsed on a copy before the live system is touched. For .NET applications, our fixed-price .NET upgrade assessment is the usual starting point.