End of sale means you cannot buy the product new. End of support means help and fixes stop. End of life usually means the vendor is finished with it entirely. Vendors use these terms differently, so ask for each date in writing and treat the end of security fixes as the one that matters most.
The four dates
Vendors do not share one vocabulary. Treat the labels below as a checklist of questions, not as universal definitions.
| Date | Typical meaning | What changes for you |
|---|---|---|
| End of sale | Product stops being offered to new buyers | Nothing yet, but it is a warning |
| End of feature updates | No new functionality | You still get fixes |
| End of security fixes | No more patches for new flaws | Risk grows with every disclosed flaw |
| End of life | Support, fixes and often downloads end | You run it at your own risk |
The date that decides your exposure is the end of security fixes. Help desk support can end long before or after it. Some vendors list only one date and call it "end of support," which hides the difference. Ask which of the four it is.
Why the gap between dates matters
After the end of security fixes, flaws are still discovered. NIST SP 800-161 Rev. 1 notes that organizations have limited visibility into how the technology they acquire is developed and maintained, and that risk includes products that are vulnerable because of poor practices in the supply chain. An unsupported product is the plainest example: nobody upstream is fixing anything.
You also face a scanning problem. For an unsupported product, a quiet scan result can be misleading, since new advisories may never be published for it. Our post on end of life software and scan results covers that.
What to ask before you sign
- What are the planned dates for each of the four stages for the version I am buying?
- How far ahead will you announce each date?
- Is the end of security fixes at least as late as the end of the contract term I am signing?
- Is there an extended support option after the date, and what does it cover? See our extended support questions.
- Will you keep publishing advisories for flaws in the unsupported version?
- Do you offer source or binary escrow if you stop supporting the product?
Point 3 is easy to miss. A three year contract on a version whose security fixes end in eighteen months is a mismatch the vendor created. Ask them to fix it or to commit to a migration path.
What to do on your side
Create a record for every commercial product with these fields: version, owner, end of security fixes date, and replacement plan. Review it at least quarterly. The rule of thumb for planning is to start the migration while the old version is still supported. Migrations that start after the date happen under pressure and often skip testing.
If you have an unsupported product that you cannot replace yet, treat it as an exception with an owner and an expiry date, not as a permanent state. Isolate it from the internet, limit who can reach it, and watch it closely.
Quick check
Which date should I track first?
The end of security fixes for your exact version. That is when new flaws stop being patched.
Does end of sale mean the product is unsafe?
No. It is a warning that support dates may follow. Ask the vendor for the full schedule.
Safeguard helps you keep this honest with SBOM and dependency scanning, plus asset discovery to find products you did not know were running.
Sources
Last reviewed: 19 October 2026.
