US and British cybersecurity agencies urged organizations in February 2026 to replace unsupported equipment at the edge of their networks. Their warning explains why a business may retire a working router or firewall: the hardware can keep running after the manufacturer stops fixing its security flaws.
A router directs network traffic, while a firewall controls which connections are allowed through. When these devices connect an organization’s systems to the outside world, their condition involves more than whether their lights are on.
The February 5 advisory from the Cybersecurity and Infrastructure Security Agency, FBI and UK’s National Cyber Security Centre says attackers exploit unsupported edge devices to enter networks and reach sensitive information. Edge devices sit at the boundary between an organization’s network and external systems.
A related US directive applies to federal civilian executive branch agencies. The wider advisory encourages other organizations to act, but it does not impose that federal requirement on every private business.
A product has more than one end date
Equipment can reach the end of its sales period, repair coverage and software support at different times. Buying a model that has been discontinued does not necessarily mean its manufacturer has already stopped supporting it.
Cisco’s product lifecycle policy, for example, distinguishes the date when orders end from the last date customers can receive support under eligible service contracts. It also sets separate provisions for replacement parts and software maintenance.
The details depend on the product and its published notice. A buyer looking at a discounted device therefore needs to know which support dates apply to that particular model and software version. A lower purchase price may come with fewer supported years remaining.
Security updates repair weaknesses in software or firmware, the software embedded in a device. A working power supply or replacement circuit board cannot supply a missing security update.
That creates a separate issue from the availability of physical repairs. Our reporting on Texas’s electronics repair law examines access to parts, tools and documentation. Those resources can help keep hardware usable, but businesses must also check the software support needed for its intended role.
Replacement costs include the changeover
A new device’s invoice is only part of the expense. Staff must configure it, check that it works with existing systems and arrange the changeover. Where employees or customers depend on the connection, the business also needs a plan for restoring service if the installation goes wrong.
Australian Signals Directorate guidance on legacy technology says replacement can become harder as older systems become embedded in business processes and the skills needed to maintain them grow scarce. It recommends considering future replacement and decommissioning costs when buying technology.
This gives procurement teams a reason to ask about the supported lifespan before signing an order. They can compare the purchase price with maintenance charges, available expertise and the likely cost of moving to a successor product.
Some companies buy outside help for this work. As our coverage of ScanSource’s planned MicroAge acquisition explains, managed IT services can include ongoing network monitoring, maintenance and security support. The customer still needs clarity about who tracks each device’s support deadline and who pays for replacement.
Plan the retirement before support expires
The US and UK advisory recommends an inventory of network edge devices and their support timelines. When immediate replacement is impossible, it calls for installing the latest available supported software. That can address previously fixed weaknesses; it does not provide fixes for flaws discovered after support ends.
The advice concerns a device’s exposure and support status, not an automatic rule to discard every older piece of equipment. Australian guidance also recognizes temporary risk-reduction measures where replacement takes time. Those measures need to be assessed against the system’s actual role.
Retirement also requires attention to stored information. The US National Institute of Standards and Technology’s September 2025 media sanitization guidance addresses making sensitive data inaccessible before storage media are reused or disposed of.
For the next purchase, the support timetable belongs alongside the price and performance specifications. Knowing when maintenance ends gives the business time to budget, test a replacement and move operations before a working device becomes an urgent problem.
