End-of-Life (EOL) Software

End-of-life is the software industry's equivalent of a discontinued car model — except the car keeps driving after support stops, on public roads, with no more safety recalls. Running EOL software is a calculated risk; the calculation is the executive's job, and most organisations never actually make it.

What It Is

Software reaches end-of-life when its vendor ends support: no security patches, no bug fixes, no compatibility work, often no licensing availability for reinstatement. The lifecycle is usually staged — end of sale, then end of mainstream support, then extended support (paid), then EOL — with dates the vendor publishes years ahead. The pattern is universal across operating systems, databases, frameworks and applications; every organisation runs a permanent portfolio of software somewhere on this curve. Legacy system is the softer cousin: still supported, but old, poorly understood, and expensive to change.

Why It Matters to You

The risk of EOL software is unpatched vulnerabilities accumulating on systems still exposed to users and networks — the root cause behind a large share of major breaches, which is why cyber-insurers and regulators increasingly treat known-EOL systems as negligence rather than misfortune. The executive discipline is a portfolio view: an inventory of what runs the business, its support status, and its exit dates — with migrations funded ahead of the cliff rather than after an incident forces them. The reason EOL persists is that migration is real money and the risk is probabilistic; that trade-off is legitimate, but only when made deliberately, on the record, with compensating controls named.

When You'll Meet It

In IT portfolio reviews, security audits, insurance questionnaires, and M&A due diligence. Ask for the list of EOL systems touching regulated data or public interfaces — there is always a list, and its age tells you everything.