What happens when software reaches end of support?
The software keeps running, but the vendor stops issuing security fixes, so every weakness found after that date stays open. Over time the software around it moves on and stops working with it, and insurers, auditors and customers begin to ask why it is still in use.
Nothing happens on the day
End of support is the date after which a vendor no longer issues fixes for a version of its product. SQL Server 2016 passed that date on 14 July 2026. .NET 8 and .NET 9 both reach it on 10 November 2026, and Windows Server 2016 on 12 January 2027.
On the morning after, the system works exactly as it did the day before. Nothing is switched off and no warning appears. That is why the dates are so often missed, and why a business can run unsupported software for years without knowing.
What changes afterwards
Security fixes stop. Weaknesses in software keep being found long after it is released. For a supported version, the vendor issues a fix. For an unsupported one, the weakness is published and stays open, and the published details tell an attacker where to look. The exposure grows with every month that passes.
The surrounding software moves on. A business system depends on an operating system, a database, a framework and libraries, and connects to browsers and other systems. Each of those keeps changing. Their makers stop testing against the old version, hosting providers retire it, and a replacement server may not run it at all. Faults begin to appear that have nothing to do with your own code.
The vendor stops answering. If a fault turns out to be in the product itself, there is nobody to raise it with.
People start asking. Cyber insurance proposal forms and customer security questionnaires commonly ask whether any software in use is out of support. The UK’s Cyber Essentials scheme requires software in scope to be supported, with unsupported software removed or cut off from the internet. A buyer’s technical checks, if the business is ever sold, will ask as well.
For some products the vendor sells paid security updates for a few years beyond the end date. They deal with the first of these problems and none of the others.
What to do about it
Start by finding out what you run. Many organisations do not know which versions sit underneath their systems. Our end-of-support check is a free script that lists what a server is running and when support for each item ends, and the end-of-life pages give the dates for Windows Server, SQL Server, .NET and Access.
Then rank by exposure. A system that faces the internet or holds personal data comes first. An internal system on a closed network is a lower risk and can wait its turn, though not indefinitely.
Upgrading is often a smaller job than feared. Moving a database or a server to a supported version frequently needs only modest changes to the application that runs on it. The harder cases are applications built on a technology with no successor, where the answer is to replace the affected parts in stages. Our page on unsupported software sets out the options, and a code audit reports the support status of everything a system depends on.
Related questions
Will our software stop working on the end-of-support date?
No. Nothing switches off. The risk builds gradually as unfixed weaknesses accumulate and the surrounding software moves on.
Is it illegal to run unsupported software?
There is no law against it as such. If the system holds personal data, UK data protection law expects appropriate security measures, and software that no longer receives security fixes is hard to defend after a breach. Take advice if this applies to you.
Can we pay to extend support?
For some products, yes. Microsoft sells Extended Security Updates for certain versions, for example SQL Server 2016 until 17 July 2029. They cover security fixes only and are best treated as time bought for a planned upgrade.
Does our application have to be rewritten when its platform goes out of support?
Usually not. Often the database or server can be upgraded with modest changes to the application. A rewrite is only needed where the application is built on something with no upgrade route.
Want the answer for your system?
Tell us what the software does and what you are trying to decide. We will reply with a straight answer and what we would need to know to be more precise.