Many enterprise fleets include devices that no longer receive security updates, and most IT teams don’t know how many until something forces them to look. The devices still work, so nothing flags them.
If you’ve just found out that part of your fleet has stopped getting patches, you’re not alone, and you’re not in an emergency yet. You are carrying a risk that grows every month those devices stay in service.
This post covers how security update support works for mobile devices, how to find which of yours are near the end, what the risk really is, and your options.
How security update support works for mobile devices
Mobile devices receive security fixes through their operating system, and those fixes have to come from the device manufacturer. Support isn’t open-ended. Each model has a window, and when it closes, the patches stop.
For Android, Google publishes regular Android security bulletins describing fixes, and manufacturers then deliver them to their devices. For enterprise devices in Google’s Android Enterprise Recommended program, the requirements oblige manufacturers to publish the date through which each device is guaranteed to receive security updates, and how often those updates ship.
Older Windows-based rugged devices are a separate case. Windows CE and Windows Embedded Handheld are already past the end of Microsoft’s support, which the post on planning a Windows CE migration covers in detail.
How to find out which of your devices still get updates
You can build a clear picture of your exposure in a few days. Most of the information is already in your systems or published by manufacturers.
- Export the fleet from your device management platform, with model, operating system version, and security patch level for each device.
- Look up each model’s support end date on the manufacturer’s published security update page.
- Compare patch levels with the latest available for each model, to find devices that are supported but not updated.
- Group devices by status, such as fully supported, ending within a year, and already unsupported.
- Add where each group is used, so you know which sites and roles carry the most risk.
The end-of-service-life FAQ explains the difference between end of sale, end of support, and end of life, which helps when reading manufacturer notices.
Is it safe to keep using devices without updates?
It isn’t safe indefinitely. An unpatched device is exposed to any security flaw discovered after its last update, and those flaws become public as soon as fixes are released for newer devices.
Unsupported devices also tend to fall behind in other ways. Business apps eventually drop support for older operating system versions, and device management features may stop working on them, so the problem grows beyond security over time.
The risk depends on what the device can reach. A device on your corporate network, with access to business apps and personal information, carries more risk than one locked to a single function. Just know that you remain accountable under PIPEDA for personal information on devices you control, so an unpatched device involved in a breach is a hard thing to defend.
The practical answer is that unsupported devices can stay in service for a short, planned period while you replace them, with tighter controls in the meantime. They shouldn’t stay indefinitely.
Your options for devices near the end of support
You have three realistic options, and most fleets use a mix depending on how close each group is to its end date.
| Option | Fits best when | Trade-off |
|---|---|---|
| Restrict and extend briefly | Devices are newly unsupported and a replacement is already scheduled | Only a stopgap, and restrictions can limit what workers can do |
| Replace now | Devices are already unsupported, failing, or handle sensitive data | Unplanned cost and a rollout on a short timeline |
| Refresh on a planned cycle | Devices still have a year or more of support left | Requires planning and budget ahead of time |
Restricting a device usually means limiting its network access, removing apps it doesn’t need, and locking it to its core function. That reduces the risk while the replacement is arranged. It doesn’t remove it.
The device lifecycle management guide covers how to plan refreshes so devices are replaced before support ends, and the post on device refresh planning for Canadian retailers shows one sector’s approach.
How to reduce risk on devices you can’t replace yet
When replacement has to wait, tighter controls reduce the exposure. They’re a bridge to replacement, not a substitute for it.
- Limit network access to only the systems the device needs for its job.
- Lock the device to its core apps using kiosk or single-app mode in your device management platform.
- Remove personal information the device doesn’t need to hold, and avoid storing data locally.
- Watch these devices more closely for unusual activity or failed check-ins.
- Set a firm retirement date for each device and record it with the risk owner.
Document the decision. If an unsupported device stays in service, someone should own that risk in writing, with the controls applied and the replacement date agreed.
Build support dates into device selection
The easiest way to avoid this problem next time is to check support commitments before buying. A device that costs a little less but loses security support sooner can be the more expensive choice over its life.
When comparing models, ask each manufacturer for the published security update end date and update frequency. Factor the support window into the refresh plan from day one, so replacements are scheduled before support ends rather than after.
What actually happens when support dates aren’t tracked
When nobody tracks support end dates, the fleet ages out quietly. Devices bought in the same year lose support in the same year, and the first anyone hears of it is an audit finding, a security incident, or an app that stops installing.
Then the replacement has to happen all at once and in a hurry. The post on what a healthy refresh cycle looks like covers how to stagger replacements so that doesn’t happen again.
Where outside help fits
Tracking support dates, planning refreshes, and replacing devices on schedule is ongoing work. It’s easy to do once and hard to keep doing alongside everything else.
Through lifecycle management, our in-house Canadian team tracks each device’s status and helps plan replacements before support ends, then stages new devices and securely retires the old ones. Just know that it fits best for larger, multi-site fleets. A small fleet with one or two device models can usually track support dates in a simple calendar.
Questions we hear about device security updates
How do I know if my devices still get security updates?
Export your fleet from your device management platform with model, operating system version, and security patch level. Then check each model’s support end date on the manufacturer’s published security update page. Compare each device’s patch level with the latest available to find supported devices that simply haven’t been updated.
Is it safe to use a phone or scanner that no longer gets updates?
Only for a short, planned period. Unpatched devices are exposed to security flaws discovered after their last update. If they connect to your network or hold personal information, restrict what they can access and schedule their replacement rather than keeping them in service indefinitely.
When should enterprise mobile devices be replaced?
Before their security support ends, ideally on a planned cycle. Other signals include rising repair costs, batteries that no longer last a shift, and devices that can’t run the apps your operation needs. Tracking each model’s support end date lets you schedule replacements instead of reacting to them.
Where to start
Export your fleet with model and patch level, and look up the support end date for each model. Sort the results into supported, ending soon, and unsupported. That one list tells you how much risk you’re carrying today and which devices to replace first.
References
- Android Open Source Project, Android Security Bulletins. Index of security fixes for Android devices.
- Google, Android Enterprise Recommended requirements. Requirement for manufacturers to publish security update end dates.