Every operating system and app reaches an end of support date. After that, the maker stops fixing security problems, so any new weakness stays open for good. Attackers look for these devices because they know they will never be patched.
Cyber Essentials does not allow unsupported software on devices in scope. They must be upgraded, replaced or kept completely away from your business data and the internet.
How to check your own setup
- Windows 10. free security updates ended on 14 October 2025. Microsoft sells Extended Security Updates for a limited time, which keeps a device patched, but it is a stopgap, not a plan.
- Macs, iPhones and iPads. check the version in Software Update. Older hardware stops receiving new versions after a few years.
- Android phones and tablets. each manufacturer supports a model for a set number of years. Check the manufacturer's support page for your model.
- Old software. look for programs nobody updates any more, such as an old version of Office or accounts software.
How to fix it
- List every device with its operating system and version. My guide to listing your devices and services shows how.
- Upgrade anything that can be upgraded, for example Windows 10 to Windows 11 if the hardware supports it.
- Budget to replace anything that cannot be upgraded, starting with devices used for email and banking.
- If one old machine must stay, for example to run a piece of equipment, disconnect it from the internet and keep business email and files off it.
The mistakes people make
- Keeping an old laptop "just for one job" that still gets used for email.
- Forgetting phones. An old phone with work email on it counts.
- Leaving it until the last week before a Cyber Essentials assessment.
Got a question about this?
Ask me about your own setup and I'll give you a plain English answer, usually within one working day.