Challenges
Replacing end-of-life hardware and software
When support for a firewall, server or operating system ends, so do the patches. Windows 10 and Exchange 2016 and 2019 reached that point in October 2025. A planned replacement costs less than an emergency one.
The challenge
Your firewall was set up years ago and nobody has touched it since. A server still runs an old operating system, and some laptops are on Windows 10, which reached end of support on 14 October 2025. Nothing has broken yet, but none of it gets security updates any more, and if the hardware fails the manufacturer will not repair it.
If it is left
Unsupported means unpatched. Every vulnerability found from now on stays open on that device, and attackers look for exactly those. A failed server with no warranty becomes an emergency purchase at whatever price is available that week, with the data recovered under pressure. Cyber Essentials fails an estate with unsupported software in it, so does many an insurer's questionnaire, and the longer the list grows the larger the single bill that eventually replaces it all at once.
What good looks like
An inventory that says, for every device and system, when its support ends and what replaces it; the replacements ranked by risk and spread across budgets rather than forced by a failure; Windows 10 machines moved to Windows 11 or retired, the old Exchange server's mail in Microsoft 365, the cupboard server in our private cloud or Azure, the firewall replaced by one we keep current; and then a managed service that keeps it that way, so the list never grows back.
What to do first
Before you call anyone
Count the Windows 10 machines
Windows 10 stopped receiving security updates on 14 October 2025. Some can be upgraded to Windows 11 for free if the hardware qualifies; many older ones cannot. The count tells you the size of the job.
Open the comms cupboard
Write down the make and model of the firewall, the switches and the server, and look up each on the manufacturer's end-of-life page. The firewall is the one that matters most and the one most often forgotten.
Check the server operating system and the mail server
Exchange Server 2016 and 2019 and Office 2016 and 2019 all reached end of support on 14 October 2025. A server running them is unpatched now, not later.
Ask what the warranty says
A server out of warranty fails on its own schedule. If the business cannot wait a week for parts, the replacement date is now.
Rank by what would hurt
The firewall and the mail server before the laptops; the accounts server before the print server. Spend in that order.
Cyber Essentials fails an estate with unsupported software in it, so the end-of-life list doubles as a list of Cyber Essentials gaps. The Cyber Essentials check shows where you stand on all five controls, with no name or email needed.
What we would do first
-
Find out what is out of support
An IT wellness assessment reviews your hardware, software, networks and applications, and identifies the security risks and weak points.
-
Rank what to replace first
Findings in plain language, with recommendations ranked by risk and explained to you in person.
-
Plan the migration
A migration strategy that fits how your business runs, so replacements are budgeted for and scheduled rather than forced on you by a failure.
-
Keep it current afterwards
Devices kept secure and up to date, firewall firmware and threat signatures kept current, and server updates and patches applied on a schedule.
How we approach it
-
Inventory and end-of-life dates
Every device, operating system, application and firewall listed with its support status and end-of-life date, from the health check, and the Windows 10 machines sorted into upgradeable and not.
-
Rank and budget
Replacements ranked by risk and cost, explained in person, and spread across budget periods: the firewall and the mail server now, the laptops in waves, the server when its workload moves.
-
Replace the risky edge first
A hosted Fortinet firewall we keep current replaces the box nobody touches; Exchange mail moves to Microsoft 365; Windows 10 machines are upgraded to Windows 11 where the hardware qualifies and replaced where it does not, enrolled in Intune on the way.
-
Move the server workload
The cupboard server's applications and data move to the Odyssey private cloud or to Azure in planned stages, with backup built in and the old server kept until the new one is proven.
-
Keep the list from growing back
Managed service tracks end-of-life dates for everything under management, so next year's replacements are in next year's budget rather than next year's emergency.
The services that apply
-
IT health check
The inventory with end-of-life dates and the replacements ranked by risk is the health check's report, and the plan is yours whether or not we deliver it.
-
Complete Managed IT
End of life managed ahead of time is part of the managed service, which is how the list stops growing back once it has been cleared.
-
Hosted firewall
The out-of-support firewall is the single riskiest device on most lists; a hosted firewall we patch and tune replaces it without another box to forget.
-
Cloud infrastructure support
A server whose workload moves to Azure or our private cloud still needs patching and monitoring afterwards, and this service does it.
-
Microsoft and Azure
Exchange mail into Microsoft 365, Windows 11 machines enrolled in Intune, and Azure for the applications that leave the cupboard server.
How you would buy it
Every hour we work falls under one of four engagement models. These are the ones that fit this situation; How we work compares all four.
-
02
Fixed price
A defined piece of work or project
The health check is a fixed fee, and each replacement project, from a firewall migration to a server move or a laptop refresh, is surveyed and priced as a fixed sum before we start.
-
03
Retainer
The way most of our clients work with us
Keeping the estate in support afterwards is managed service from your retained hours: patching on a schedule, end-of-life dates tracked, and the next replacement planned before it is forced.
Who you would work with
A tech consultant
Runs the health check, ranks the list and walks the board through what to replace first and why.
A project manager
Runs the replacement projects, the waves of laptops and the server move, around your operations.
Our engineers
Odyssey employees who build the replacements, migrate the mail and the server workloads, and patch what remains.
Further reading
-
Guide
Understanding EOL IT services: a guide
End of life: when a manufacturer stops supporting hardware or software. What it means for your firewalls and servers.
Read the guide →
Questions people ask
How can I tell if my hardware or software has reached end of life?
Manufacturers publish end-of-life dates: Microsoft's lifecycle pages for Windows, Office and Exchange, and each vendor's page for firewalls and servers. The health check does the lookup for everything you run and puts the dates in one list.
We still have Windows 10. What should we do?
Windows 10 reached end of support on 14 October 2025, so it no longer receives free security updates. Microsoft's paid Extended Security Updates for organisations cover up to three years, a stopgap rather than a plan. Upgrade the machines that qualify for Windows 11 and replace the ones that do not, in waves.
Our email is on an old Exchange server. Is that urgent?
Yes. Exchange Server 2016 and 2019 reached end of support on 14 October 2025, and an unpatched mail server facing the internet is a common way in. Moving the mailboxes to Microsoft 365 is usually the right replacement, done in stages with the old server kept until the move is proven.
What happens when a firewall reaches end of life?
The manufacturer stops providing updates, patches and technical support, and any hardware warranty expires, so the firewall is exposed to new threats and will not be repaired if it fails. Cyber Essentials also requires critical updates on firewalls within 14 days, which an unsupported one cannot receive.
Is an unsupported server a compliance risk?
It can be. As well as missing security patches, running servers on end-of-life software fails Cyber Essentials and can put you in breach of regulations such as GDPR or PCI-DSS, and insurers ask about it directly.
Why plan replacements rather than wait for a failure?
A planned replacement can be budgeted for, scheduled around the business and done in waves. A failure forces an emergency purchase at that week's price, unplanned downtime and a recovery under pressure.
Can we spread the cost?
Yes. The list is ranked by risk, so the firewall and the mail server go first and the laptops follow in waves across budget periods. A server workload often moves to our private cloud or Azure, which turns a capital purchase into a monthly charge.
Do we have to use Odyssey to do the replacements?
No. The health check's plan is yours to act on with your own team or another supplier. If you ask us, each replacement is priced as a fixed sum from the plan.
Talk to a human about end-of-life hardware and software
Call and we answer within three rings. Or tell us what you need and we will call you back at any time.