End-of-life software

On May 12, 2017, WannaCry encrypted hundreds of thousands of machines, and a good share of them still ran Windows XP, which Microsoft had stopped patching in April 2014. A fix for the exploited flaw had been out since March for supported versions. On May 13, Microsoft shipped an exceptional patch for XP, and the move stood out precisely because it broke the rule. End-of-life software is a product whose vendor has stopped issuing security updates on a date announced well in advance. Windows 7 has received none since January 14, 2020, and Windows 10 none since October 14, 2025, except for customers paying for Extended Security Updates. For an underwriter the date matters more than the brand: after it, every newly published flaw stays exploitable indefinitely across the affected fleet. The application therefore asks what share of the estate is out of support, and which systems cannot be migrated (controllers, workstations driving a machine, line-of-business software tied to an old version). A candid answer backed by documented isolation usually carries more weight than a no that turns out to be false at the first claim. On the wording side, several market forms carry an unpatched vulnerability exclusion, or a retention and sublimit that worsen as the flaw ages; an XP workstation falls into it by design. Network segmentation serves as the compensating control when migration is impossible, and the underwriter will credit it as long as it can be verified. One caveat: an unsupported system that talks to nothing is a modest risk; network exposure is what makes it dangerous. Not to be confused with a zero-day: there, nobody has a fix yet; here, the vendor has decided not to write one.