“It still works” is the most expensive sentence in IT.

Every business has one. A PC in the corner of the workshop. A server in a cupboard that somebody’s predecessor set up. A router with a film of dust and a light that’s been blinking since 2015. Ask about it and you’ll hear the same four words: “But it still works.” I’ve heard that sentence in every job I’ve had in more than 20 years, and I’ve come to think it’s one of the most expensive in IT. Unsupported software and old equipment carry on working right up to the day they let someone in.

Working and safe are different things

A piece of technology has two lives. The first is how long it carries on doing its job. The second is how long its maker keeps fixing the security flaws that are found in it. The second is nearly always shorter.

Flaws turn up in all software, all the time. While a product is supported, the maker releases updates to close them. Once support ends, the flaws are still found and still published. They just stop being fixed. From that day the product gets a little less safe every month, while looking exactly the same from the outside.

That’s why “it still works” is the wrong test. Of course it works. Windows 10 didn’t stop starting up when Microsoft ended its support. It works for you, and it also works very nicely for anyone who knows about a hole that will never now be closed.

We’ve seen where this leads

In May 2017 the WannaCry ransomware spread across the world in a day. In England it disrupted around a third of NHS trusts. Thousands of appointments and operations were cancelled, and ambulances were sent elsewhere. The Department of Health later put the cost at about £92 million.

The weakness WannaCry used had a fix. Microsoft had released it two months earlier. The organisations that were hit were running computers that hadn’t had the update, or versions of Windows too old to get it. The National Audit Office’s verdict was that it was a relatively unsophisticated attack that basic IT security would have prevented.

That was nine years ago and the pattern hasn’t changed. When I’m called to a cyber incident, one of the first things I look for is the oldest thing on the network. It’s very often part of the story.

Why it’s suddenly a bigger problem

Three things make this more pressing than it used to be.

A lot has just gone out of support. Windows 10 reached the end of free support on 14 October 2025. The extra year of security updates Microsoft offered to home users ended this month. Businesses can still pay for extended updates until October 2028, at a price per device that doubles every year, which is Microsoft’s way of telling you to move on. Office 2016 and 2019 and the older versions of Exchange Server went the same way in the same month.

It’s wider than computers. Routers, firewalls, Wi-Fi access points, network storage boxes, printers, phones, door entry systems and cameras all run software, and all of it has an end date. Many of these get fewer years of updates than a PC, and nobody thinks to check. We reported recently that cameras were attackers’ favourite target.

Finding the holes has got faster. Attackers scan the whole internet for known weaknesses within hours of them being published, and AI tools are making the search for flaws in old code quicker still. I wrote about that in AI found the bug. Volunteers had to fix it. Old kit used to be protected a little by obscurity. That’s gone.

Nobody budgets for the server in the cupboard until the day it becomes the most expensive thing the business owns.

Ashley Adkins, fromIT

The sums people get wrong

I do understand why old equipment stays. Replacing it costs money now. Keeping it costs nothing now. On a spreadsheet that’s an easy decision, and I’d never tell a business to replace things for the sake of it.

But the comparison is wrong. One side is a known cost on a date you choose. The other is an unknown cost on a date someone else chooses. A week without the main system, a specialist to investigate, customers to notify, and then the replacement you were avoiding, bought in a hurry at full price.

There are quieter costs as well. Cyber Essentials requires that software is supported and kept up to date, so one forgotten machine on the network can cost you the certificate, and with it some contracts. Cyber insurance proposal forms often ask about unsupported systems directly. And every year you wait, the move gets harder, because fewer people remember how the old thing was set up.

What I’d do

1. Make a list with dates on it. Every computer, server, phone, router, firewall and connected gadget, with the date its updates stop. Makers publish these. For most businesses this is an afternoon’s work, and it’s usually the first time anyone has seen it all in one place.
2. Sort it into three piles. Supported and updating. Out of support within a year. Already out of support. The third pile is this quarter’s job.
3. Replace or upgrade what you can. Often it’s cheaper than expected. A PC that can’t run Windows 11 can be replaced for a few hundred pounds. A small-office router costs less than a day of lost trading.
4. Isolate what you can’t. Sometimes an old machine runs a lathe, a lab instrument or a piece of software with no modern version. Then take it off the internet, put it on its own network away from everything else, and stop using it for email or browsing. Write down why it’s still there and who agreed.
5. Put end dates in the budget. If you know five laptops go out of support in 2028, that’s a line in next year’s plan and no surprise to anyone.
6. Ask before you buy. “How many years of security updates does this get?” is a fair question for any supplier. If they can’t say, buy something else.

If you’d like a quick sense of where you stand, the free Cyber Essentials readiness check asks about this along with the other basics, and takes about five minutes.

A kinder way to say it

I don’t think the people who say “it still works” are being careless. They’re being careful with money, and that’s a good instinct. The equipment was bought to do a job, it does the job, and nothing visible has changed.

So I’d change the question people ask. Instead of “does it still work?”, ask “is anyone still fixing it?” It takes a minute to find out, and the answer tells you whether the thing in the cupboard is an asset or a liability. Go and have a look at yours this week. If the label on the front has yellowed, I think you already know what you’ll find.