Guides / Enterprise
Firmware and security updates after EOSL
After end of service life the vendor publishes no new firmware or software releases, and many download portals lock access when the contract ends. If you secure the last version beforehand and isolate the system afterwards, you can keep running hardware safely without patches.
Before the cut-off: secure the last version
The most important step happens before the EOSL date, while the support contract is still active:
- Install the last released firmware: BIOS/UEFI, BMC (iLO, iDRAC, IMM, CIMC), controllers, drives, NICs.
- Archive everything: images, release notes, checksums, compatibility matrices, ideally central and versioned.
- Back up configurations: running configs of switches and firewalls, storage configurations, licence keys.
- Test the downloads: check the files are complete and can be installed offline.
After EOSL: protect unpatched systems
New vulnerabilities are no longer fixed after EOSL. You can limit the risk organisationally:
- Put management interfaces (iLO, iDRAC, IPMI, CIMC) in a dedicated management network, never in production or on the internet.
- Minimise services: disable unused protocols and ports, deactivate default accounts.
- Network segmentation: make the system reachable only from the networks that really need it.
- Tighten monitoring: collect logs centrally and alert on anomalies.
- For network devices, check for each new vulnerability whether the affected service is enabled at all.
What third-party maintenance covers for firmware
A third-party maintenance provider is usually not allowed to ship new vendor firmware. After EOSL this does not matter, because the vendor no longer publishes anything. Third-party maintenance covers the hardware side: spare parts, diagnosis and on-site engineers under an SLA. For the software side you need the measures above.
Partner recommendation · Ad
Have your installed base reviewed?
Our partner TechCare Solutions produces a free EOSL audit: which systems are affected, what continued operation via third-party maintenance costs, and where a refresh pays off.
Request a free EOSL auditFrequently asked questions
Do I still get firmware updates after EOSL?
No. Vendors publish no new releases after end of service life. Install and archive the last released firmware before the cut-off date.
May I install archived firmware after the contract ends?
That depends on the vendor's licence terms, which differ by vendor. Plan so that the last version is installed before the contract ends.
Is hardware without security updates a compliance problem?
Not automatically. NIS2, ISO 27001 and insurers expect documented risk handling: segmentation, monitoring, maintenance under an SLA and a planned replacement date.