Fifty-nine days passed between March 14 and May 12, 2017. During that gap, the fix for the flaw WannaCry would exploit was already published by Microsoft, in bulletin MS17-010. People who installed it watched the disaster on TV. People who didn't saw a screen asking for $300 in bitcoin. But one detail gets lost when the story is told quickly: the Windows XP machines had no fix waiting for them. The system had been officially dead since April 2014. Microsoft ended up releasing a patch for it during the attack itself, a rare exception, on a day when British hospitals were cancelling appointments. The National Audit Office later counted 81 of 236 NHS trusts as affected. Those machines weren't caught through carelessness. They were caught because they were somewhere carelessness was no longer even possible. #### <br>The map a patch draws For an attacker, every monthly fix to a still-supported system is a clue. You compare the file before and after the update, see what changed, and learn where the hole was. The technique is called *patch diffing* and it is routine in security research, the good kind and the bad. Now add an older version that shares much of its code with the new one. The vendor fixes the new one, publishes, and the equivalent hole in the old one stays open, with its location practically announced. Code doesn't rot with age. What happens is that the world around it keeps discovering things and it stops receiving answers. The risk rises every month, quietly, without anything changing on the computer. An uncomfortable conclusion follows: the machine that didn't fail in seven years doesn't prove security. It proves nobody has tried yet, or that someone already got in and kept quiet. #### <br>It's not just Windows Python 2 was retired on January 1, 2020. CentOS 7 ended on June 30, 2024. Anyone who works with servers knows retired on the calendar doesn't mean switched off in practice. There's a Python 2.7 script in a scheduled job somewhere, generating a report someone reads on Mondays. There's a VPS running a 2019 CentOS that nobody touches because last time the site went down for forty minutes. And there's that dependency its author stopped maintaining, which three other libraries still pull in. In these cases the risk is rarely a targeted attack. It's more boring: automated scanners sweep the internet looking for known vulnerable versions, without choosing victims. If you run unsupported software, you don't need to be interesting to get caught. You just need to be there. #### <br>What if the machine isn't on the network? It's the best objection and it carries weight. There is industrial equipment, medical devices, CNC machines whose certified software can't be updated without recertifying the whole device. Isolation is the reasonable answer and often the only one. It only answers part of it. Stuxnet crossed isolated networks in 2010 inside USB sticks. Isolation reduces the attack surface, it doesn't remove it, and the discipline that sustains it (nobody plugs in the vendor's laptop, nobody copies a file by stick) is the kind of rule that dissolves after two years. If isolation is your only defence, treat it as such: real segmentation, a log of what goes in, a plan for the day it fails. Not as a permanent state of rest. #### <br>Windows 10, 381 days later The closest case is Windows 10, whose support ended on October 14, 2025. Counting to today, that's 381 days. On June 25, 2026 Microsoft extended its free consumer security-update programme to October 12, 2027, when the end had been set for October 2026. The detail that matters is that the programme isn't automatic. Security fixes only reach a Windows 10 machine that is enrolled in ESU. A PC that never enrolled has received none of the fixes from these months. The extension protects those who signed up, not those who never knew it existed. It's a strange situation. A patch is published for the same version of the system, and some identical machines don't get it because of a settings menu nobody opened. In an inventory of twenty machines there is always a twenty-first. That's the one.