A phone can be fully updated and still be behind. CISA's guidance for highly targeted people says newer hardware has security features older hardware cannot support, and that software updates alone will not deliver the maximum benefit. Check how long your model gets updates, and replace it when support ends.
What CISA says
Two points matter here. First, CISA recommends choosing the latest hardware version from the manufacturer, because newer hardware often includes critical security features that older hardware cannot support. Second, it recommends regular updates: check weekly and turn on automatic updates for the operating system and apps.
For Android, CISA suggests prioritizing models from makers with strong security track records and long term update commitments. It lists three qualities:
- Hardware level security features, often called a secure enclave or hardware security module, for storing cryptographic keys
- Security updates at least monthly
- A commitment to security updates for at least the next five years
Those are CISA's stated criteria for highly targeted individuals. They are a useful yardstick for anyone.
How to check your phone
- Find the model and the OS version in your settings.
- Look up the maker's support page for that model and find the end date for security updates. If you cannot find one, treat that as a warning sign.
- Check the date of the last security patch. If it is months old and the phone is offering no updates, support may have ended.
- Check that automatic updates are on. CISA's example of a person who kept choosing Remind Me Later and was infected through a known flaw shows why.
We have not verified specific support windows for any model. Use the maker's own pages.
A simple decision rule
- Still receiving monthly patches with at least two more years of support: keep it.
- Receiving patches but support ends within a year: plan the replacement now so it is not rushed.
- No longer receiving patches: replace it, and do not use it for banking, work email or sign in codes in the meantime.
For executives, the cost of a new phone is small next to the cost of an account takeover.
What a new phone does not fix
Hardware does not stop you approving a prompt or typing a password into a fake page. Combine it with phishing resistant sign in, as in the CISA checklist.
Moving to a new phone safely
- Update the new phone before restoring.
- Move your authenticator and passkeys using the platform's official method.
- Sign out of the old phone from your account settings.
- Wipe the old phone before selling or recycling it.
- Check your messaging app's linked device list.
Work phones
If your employer issues the phone, ask IT about update policy rather than guessing. Personal phones used for work are a different problem, covered in our guide to bring your own device.
Quick check
Do software updates alone give full protection on old hardware?
No. CISA says without recent hardware, software updates alone will not provide the maximum available security benefit.
How long should an Android maker commit to updates?
CISA suggests at least five years, with security updates at least monthly.
Sources
Last reviewed: 19 October 2026.
