Software that no longer receives security updates accumulates vulnerabilities that will never be fixed. Windows 7, Office 2010, Windows Server 2012, and dozens of other commonly used products have reached end-of-life. Businesses still running them are permanently exposed to known, exploitable vulnerabilities.
End-of-life (EOL) software is software that its vendor no longer supports — no more security patches, no more bug fixes, no more updates. Once software reaches EOL, any vulnerability discovered in it after that date will never be fixed. Researchers and attackers continue to find vulnerabilities in EOL software — but only attackers benefit, because there's no patch coming.
The challenge for NZ businesses is that EOL software is common — particularly in operational technology environments (manufacturing equipment, POS systems, specialist industry software) where upgrading is complex and expensive. In a 2024 survey of NZ businesses conducted by Optimyze during IT assessments, approximately 35% of organisations had at least one internet-facing system running an EOL operating system.
The EOL Timeline: What's Already End-of-Life
Products that have already reached EOL that NZ businesses commonly still run: Windows 7 (EOL January 2020), Windows 8.1 (EOL January 2023), Windows Server 2012/2012 R2 (EOL October 2023), Office 2013 (EOL April 2023), Office 2016 (EOL October 2025), Exchange Server 2013 (EOL April 2023), and Internet Explorer (EOL June 2022). Any of these products still in use are permanently unpatched for vulnerabilities discovered after their EOL date.
The Specific Risk: Known, Unpatched Vulnerabilities
The reason EOL software is disproportionately targeted is that attackers build exploit kits for known vulnerabilities and deploy them against known EOL systems — confident that no patch will ever close the vulnerability. Microsoft continued to release emergency security updates for Windows XP (EOL in 2014) in response to WannaCry in 2017 — because the vulnerability was so serious and the number of remaining XP users so large. This was exceptional. Normally, EOL vulnerabilities accumulate permanently.
Compensating Controls When Replacement Isn't Immediate
Sometimes EOL systems can't be immediately replaced — specialist software, vendor certification requirements, or cost may make immediate upgrade impractical. In these cases, compensating controls reduce (but don't eliminate) the risk: network isolation of the EOL system (place it on a separate VLAN with restricted internet access and firewall-controlled access from other segments), enhanced monitoring (EDR or at minimum process monitoring if EDR is incompatible with the system), and expedited planning for replacement.
EOL software isn't a historical problem — it's an active one. Every new vulnerability research paper, every NVD CVE disclosure, every patch Tuesday from Microsoft potentially includes a finding that affects your EOL system and will never be fixed. The only complete remediation is replacement.
