When a device can no longer be updated, the safest choice is to retire and replace it. If you must keep it, reduce what it can reach and do: turn off remote access, remove sensitive accounts, and keep it off networks that matter. Do not treat a workaround as equal to support.
Why the date is a cliff
The NCSC suggests treating the support end date as a use by date and avoiding devices that are out of support or will be soon. After that date, newly found flaws stay open. A smart device is a computer on your network, and the NCSC warns that a compromised device can be used to access your network.
Option 1: retire it
For anything that watches, listens or controls a lock, retire it. Cameras, baby monitors, door controls and routers are examples where the risk is highest. Factory reset it, remove it from your account, and dispose of it through a recycling route, or follow the NCSC guidance on selling or giving away devices if it has resale value.
Option 2: reduce what it can do
If you must keep a device for a while, the following steps reduce exposure.
- Turn off remote access if you do not need it. The NCSC advises this.
- Remove accounts and data you do not need on it.
- Change the password to a unique strong one.
- Turn off features that use the microphone, camera or location if you do not use them.
- Keep it off any network where sensitive devices live, if your equipment supports a separate network for guests or devices. Check your router's documentation for how.
None of this fixes the underlying software. It shrinks what an attacker gains.
Option 3: replace it with a supported device
When you replace it, look for the published support period. In the UK, covered products must state it. The earlier post on checking support periods gives a method. Aim for a replacement with several years of support.
What makers should plan for
ETSI EN 303 645 addresses constrained devices that cannot have software updated. It says the manufacturer should publish the rationale for the absence of updates, the period and method of hardware replacement support, and a defined support period. It also says the product should be isolable and the hardware replaceable. If you ship such a device, you need a replacement plan in place before you sell it.
When the device is a router
A router sits at the edge of your network and every device depends on it. The NCSC page does not give router specific advice, but its general rule applies: avoid devices that are out of support. Check your router maker's support page and plan the replacement.
Quick check
Can I keep using a device that has lost support if I turn off the internet?
A device with no network connection is much less exposed, but it may lose features. If it needs the internet to function, it is still exposed.
Sources
- NCSC: Smart devices, using them safely in your home
- NCSC: Buying and selling second-hand devices
- ETSI EN 303 645 V2.1.1 (2020-06)
Last reviewed: 19 October 2026.
