The Hidden Cost of End-of-Life Hardware: When Vendors Stop Providing Firmware Updates

The cost of end-of-life hardware rarely arrives as a breakdown. It arrives as a vulnerability that will never be patched, a paid extension you didn't budget for, or a forced replacement on the vendor's schedule instead of yours. Once a router, firewall, switch, NAS or PC passes its vendor's last support date, newly discovered security flaws stay open, and attackers actively look for exactly those devices. The FBI warned in May 2025 that criminals were turning end-of-life routers into proxies for crime. The fix isn't to replace everything early. It's to know each device's support dates, budget for them, and retire internet-facing equipment first.

How long do vendors keep supporting hardware?

Source: Cisco End-of-Life Policy page; Microsoft Learn Windows 10 lifecycle and Extended Security Updates pages (updated 17 Nov 2025); FBI Internet Crime Complaint Center PSA (7 May 2025); QNAP support status page; all checked 8 Nov 2026. Support periods vary by product line and change over time, so always check the notice for your exact model.

What do the dates in an end-of-life notice mean?

Vendors use similar milestones under slightly different names. End of sale is the last date you can order the product new. End of software maintenance (or end of vulnerability support) is when firmware and security fixes stop. Last date of support is when the vendor stops taking support cases and supplying replacement parts. Cisco's policy shows how far apart these can be: hardware support can run five years past end of sale, but operating-system fixes taper off much earlier, with one year of critical fixes followed by two more years of fixes and patches.

The date that matters most for security is the end of firmware and vulnerability fixes. A switch that still powers on and still has a valid hardware contract can already be unpatched. When you read a notice, write down that date for every model you own, not just the end-of-sale date. We cover the same idea for operating systems in is your business ready for the end of another popular operating system?

Why are end-of-life edge devices targeted?

Because they sit on the internet and can't be fixed. The FBI's May 2025 alert described criminal proxy services built on end-of-life routers infected with variants of TheMoon malware, and advised owners to replace end-of-life routers and turn off remote administration. Firewalls, VPN gateways, NAS boxes with remote access and old access points carry the same risk: once a flaw is published, every unpatched unit stays exposed for as long as it's plugged in. The router case is covered in detail in why a S$300 router could be costing your business thousands, and switch risks in our post on network switches.

Retire by exposure, not by age. An unsupported firewall facing the internet is urgent; an unsupported switch in a locked rack with no remote access can usually wait for the next budget cycle.

What does running unsupported hardware really cost?

There are three kinds of cost, and most businesses only budget for the first.

• Paid extensions. Windows 10 shows the pattern. Microsoft's commercial Extended Security Updates cost US$61 per device in the first year, and "the price doubles every consecutive year, for a maximum of three years". CALC (illustrative): US$61 + US$122 + US$244 = US$427 per PC for three years, or US$8,540 for 20 PCs, which is a meaningful share of the cost of replacing them.
• Forced replacement. When support ends, you replace on the vendor's timeline, often at short notice and at whatever the market price is that quarter.
• Exposure. An unpatched device can become the entry point for an incident, and Singapore's PDPA expects organisations to protect personal data with reasonable security arrangements. Running internet-facing equipment with known, unfixable flaws is hard to defend.

Firmware matters beyond routers. Laptop and desktop BIOS/UEFI updates, NAS operating systems, printer firmware and meeting-room devices all follow vendor lifecycles. Interactive displays are a good example of hardware outliving its software, as we describe in your Android smart board could become obsolete before the screen dies. Second-hand and refurbished equipment needs the same check, because some of its support window has already been used (see the problem with refurbished enterprise hardware in production).

Is it ever reasonable to keep end-of-life hardware?

Yes, with conditions. End of life doesn't make a device unsafe overnight. An internal switch with no internet exposure, a lab server isolated on its own network segment, or a printer with remote management turned off can run past its support date at lower risk, especially if you add compensating controls: segmentation, no inbound internet access, remote administration disabled and close monitoring. Replacing working equipment early also has a cost, including e-waste. What isn't reasonable is not knowing which devices are past support. Our post on the most dangerous device in your office covers how unmanaged equipment slips through.

How do you build an end-of-life plan?

1. List every network, storage and computing device with model, serial number and location.
2. Record each model's end-of-sale, end-of-firmware-updates and last-support dates from the vendor's notice.
3. Rank devices by exposure: internet-facing first, then devices holding data, then internal infrastructure.
4. Budget the replacement or paid extension a year before the firmware date, not after it.
5. When buying, ask the supplier for the model's lifecycle status so you don't buy hardware that is close to its end of sale.

Buying in Singapore

When an older firewall, switch or NAS reaches end of support, current models to compare include the FortiGate 30G at S$766.80 and the FortiGate 50G at S$1,168.80 (check whether security service subscriptions are included in the quote), the HPE Aruba Instant On 1930 24-port managed switch at S$408 and the Synology DS925+ NAS at S$1,260 (all listed 8 Nov 2026, including GST). Prices change; ask for a current quotation. Send us your device list and we'll help you check lifecycle status before you buy replacements. Use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.

Frequently asked questions

What is the difference between end of sale and end of support? End of sale is the last date to buy the product new. End of support is when the vendor stops fixes and service. Firmware and security fixes often stop earlier than hardware support, so check that date first.

How long does Cisco support hardware after end of sale? Cisco's policy gives five years of TAC support and replacement parts from the end-of-sale date for hardware, but operating-system fixes run for one year of critical fixes plus two further years of fixes and patches.

How much does Windows 10 Extended Security Updates cost? Microsoft lists US$61 per device for the first year of commercial ESU, with the price doubling each year for up to three years. That works out to US$427 per device over three years (CALC).

Why are old routers a security risk? They no longer receive updates, so known flaws stay open. The FBI warned in May 2025 that criminals were turning end-of-life routers into proxies, and advised replacing them and turning off remote administration.

Do we have to replace end-of-life equipment immediately? Not always. Prioritise internet-facing devices and anything holding data. Internal devices can sometimes run longer with segmentation, no remote access and monitoring, as long as you track them and plan their replacement.