--- title: "Does the Applicant use any operating system, hardware or software that is no longer supported / End-of-Life?" url: https://insuranceposture.com/questions/endpoint-and-patching/applicant-operating-system-hardware-software-no-longer-supported-end category: "Endpoint protection and patching" canonical_key: q_edr_004 evidence_state: partial updated: 2026-08-24 --- # Does the Applicant use any operating system, hardware or software that is no longer supported / End-of-Life? URL: https://insuranceposture.com/questions/endpoint-and-patching/applicant-operating-system-hardware-software-no-longer-supported-end Section: Endpoint protection and patching Evidence state: Partly verifiable from your tenant Every estate of any age has some. The question is whether you know where it is and what surrounds it, because carriers will find out either way. ## What the carrier is actually asking The carrier is asking whether anything in your environment no longer receives security updates from its vendor: operating systems past end of support, database versions out of extended support, appliances the manufacturer has stopped maintaining, and applications whose vendor has disappeared. It usually asks for the detail if you answer yes. ## Why it is underwritten Unsupported software accumulates vulnerabilities permanently. Once a vendor stops issuing fixes, every new flaw is unpatchable, and public exploit code arrives faster than compensating controls get built. Carriers ask because unsupported internet-facing systems are among the strongest predictors of an intrusion they will pay for. ## Where the answer lives in Microsoft 365, Entra ID, and Azure The cloud estate exposes operating system versions and update state directly. On-premises appliances and line-of-business software need their own inventory. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Azure | Virtual machine operating system versions and update assessment state | A version inventory across subscriptions, with anything past support identified rather than aggregated away | | Azure | App Service runtime stacks and their support state | Language runtimes and frameworks past end of support, which age out quietly and are internet-facing by default | | Azure | Database engine versions and their support lifecycle | Managed database versions approaching or past end of support | | Microsoft 365 | Device compliance policies with minimum operating system versions | A floor enforced by policy, so end-of-life endpoints lose access rather than persisting unnoticed | | Asset inventory | Appliances, firmware, and line-of-business applications | Vendor support status per item. Attested, and usually the part that surprises people | **Answering yes is normal** A candid yes with an inventory, a segmentation story, and a decommissioning date reads as competence. A no that a scan later contradicts reads as a misrepresentation. Carriers see unsupported systems constantly; what they rarely see is an insured who knows exactly which ones and why. ## What a defensible yes requires - An inventory exists that maps systems to vendor support status, refreshed rather than compiled once. - Anything unsupported is isolated: no internet exposure, restricted network reach, tightened access. - Each unsupported item has an owner and a dated plan, whether replacement, upgrade, or extended support purchase. - Endpoint policy enforces a minimum operating system version so the workstation fleet does not age past support silently. - Extended support arrangements, where purchased, are documented and current. ## How this answer goes wrong The answer is often no in good faith and wrong in fact. Nobody counts the appliance in the comms room whose firmware has not been updated since installation, the virtual machine running a legacy application that finance needs at quarter end, or the framework version underneath a public web application. External scanning finds these, and so does a claims investigation. ## If this answer turns out to be wrong Agent coverage, patch state, and end-of-life software are the answers that move fastest without anyone deciding to move them, so this block is where an accurate answer most often ages into an inaccurate one before the policy expires. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [why an accurate answer ages, and when the policy makes that matter](https://insuranceposture.com/glossary/point-in-time-underwriting). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Will answering yes get us declined? Usually not by itself. It leads to follow-up questions about isolation and timeline. Unsupported systems that are internet-facing are the case where markets do decline. ### Does extended support count as supported? Yes, when it is purchased and current, and it is worth stating explicitly because otherwise the version number tells a different story. ### What about firmware on network gear? It counts, and it is the most commonly missed category. Devices that were fully supported when installed reach end of life quietly, several network refreshes ago. ### How do we handle software whose vendor is gone? Treat it as unsupported permanently and manage it by isolation. State it plainly; carriers understand the situation and respond to how it is contained. ## Related questions - [How frequently is software updated, vulnerabilities patched, unnecessary services disabled?](https://insuranceposture.com/questions/endpoint-and-patching/frequently-software-updated-vulnerabilities-patched-unnecessary-services-disabled) - [What is the critical patching target (24h / 72h / 7d / >7d)?](https://insuranceposture.com/questions/endpoint-and-patching/critical-patching-target) - [Does the Applicant conduct regular vulnerability scans?](https://insuranceposture.com/questions/network-and-logging/applicant-conduct-regular-vulnerability-scans) - [Has the Applicant applied network segmentation within its environment?](https://insuranceposture.com/questions/network-and-logging/applicant-applied-network-segmentation-within-environment) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.