What Is End of Life?
"End of Life" (EOL) marks the date when a vendor stops providing security patches, updates, and support for a software product. After EOL, vulnerabilities remain unpatched, compatibility issues go unresolved, and no official assistance is available. EOL typically follows earlier milestones like "End of Sale" or "End of Security Support," making it the final stage in a product's supported lifecycle.
Why EOL Matters
- Security risk: Unsupported software accumulates unpatched vulnerabilities, becoming an increasingly attractive attack vector. Your attack surface grows with every passing day post-EOL.
- Operational stability: As surrounding technologies evolve, EOL components may fail, corrupt data, or cause integration problems. Migration costs compound the longer outdated components remain in use.
- Compliance exposure: Regulations like CRA, NIS2 or PCI-DSS require reasonable security measures. Running EOL software can violate these obligations, creating liability and potential penalties.
EOL Under the Cyber Resilience Act
The EU's Cyber Resilience Act (CRA), phasing in through 2027, transforms EOL from a business decision into a regulatory obligation. Key requirements include:
- Defined support periods: Manufacturers must declare how long they will provide security updates—minimum five years or the expected product lifespan.
- Transparency: Support commitments must be disclosed before purchase and users notified ahead of EOL.
- Free security updates: Patches must remain available throughout the declared support period.
- Vulnerability handling: Coordinated disclosure processes and technical documentation are mandatory.
For organizations using software in the EU market, the CRA means EOL tracking is no longer optional - it's a compliance imperative. That is, why we added EOL information to our component database, where available.
Machine-Readable EOL: EoX and CycloneDX
Manual EOL tracking doesn't scale. Modern supply chain management requires machine-readable formats that automated tools can process. Industry standardization groups like OASIS and ECMA already reacted:
- EoX provides a structured milestone taxonomy—End of Sale, End of Security Support, End of Service Life—enabling asset management and security tools to flag components approaching critical dates automatically.
- CycloneDX, the OWASP SBOM standard, incorporates lifecycle metadata directly into Software Bills of Materials. Components carry support status indicators (active, limited support, end of life) with timestamps and source references. This data propagates through the supply chain, giving downstream consumers visibility into the support posture of every dependency.
Together, these formats enable continuous, automated EOL monitoring rather than reactive discovery after incidents occur.
Why This Matters for TrustSource Users
Effective EOL management requires three capabilities: identifying components approaching or past EOL, enriching SBOMs with lifecycle data, and surfacing actionable reports for decision-makers.
TrustSource provides features that address these needs—integrating EOL intelligence into your SBOM workflows, portfolio analysis, and compliance reporting. The following articles explain how to configure and use these capabilities.
Comments
0 comments
Article is closed for comments.