Additional resource for the lesson “Keeping Devices Secure: Updates and Safe Habits” — Online Security course
Every phone reaches a point where the manufacturer stops issuing device updates. The device keeps working, nothing visibly changes, and from that day it stops receiving the fixes that everything else depends on. Knowing when that happens is part of choosing a phone.
A. Why this matters
The companion resource on system updates covers why a patch matters and how to automate the process. This one is about devices specifically — and about the question nobody thinks to ask when buying a phone: for how long will it keep receiving these fixes?
An out-of-date device is vulnerable. An unsupported device is permanently out of date, and no setting can change that.
The key idea: updates protect a device only while the manufacturer is still issuing them. After that, the device continues working normally while the protection quietly stops improving.
B. Key concepts
Six ideas about devices rather than software in general.
The security patch level
Phones show, usually under About or Software information, the date of the last security update they received.
Why it matters to you: It is the most useful number on that screen and almost nobody looks at it. If it is more than a few months old, the device is not receiving fixes.
End of support
The point at which a manufacturer stops issuing updates for a model. It varies widely, from a few years to seven or more.
Why it matters to you: Nothing announces it on the device. The phone works exactly as before, which is precisely what makes it easy to miss.
Support length as a purchase decision
Manufacturers now publish how long each model will receive updates.
Why it matters to you: This is worth checking before buying rather than after. A cheaper phone supported for two years is not cheaper than one supported for six.
System updates and app updates
The operating system and the applications update through different mechanisms, and both matter.
Why it matters to you: An app store can keep applications current on a phone whose system has stopped being updated — which helps, but does not close flaws in the system itself.
Apps from official stores
Installing from Google Play or the App Store means the app also receives updates automatically.
Why it matters to you: Software installed from outside the stores usually does not update itself, which turns a one-off decision into an ongoing exposure.
What to do with an unsupported device
It can still be used for things that matter less: music, an alarm clock, a camera, a device with no accounts on it.
Why it matters to you: The realistic advice is not ‘replace it immediately’. It is ‘stop keeping your email, banking and password manager on it’.
C. A practical example: a phone that still works fine
A phone bought four and a half years ago. Battery is acceptable, apps still open, nothing appears wrong.
- The manufacturer stopped issuing security updates for that model eighteen months ago.
- Every flaw found in the system since then remains open on this device.
- The apps still update, so the phone feels current — which is exactly the confusion.
On this phone are the primary email account, a banking app and the authenticator generating second factors for both.
A proportionate response
- Check the security patch date, so the situation is known rather than assumed.
- Move the accounts that matter — email, banking, authenticator — to a supported device.
- Keep the old phone for things with nothing attached to them.
- Factor support length into the next purchase.
The point is not that the phone is dangerous. It is that the most valuable accounts should not be the ones sitting on the device that stopped being fixed.
D. Try it yourself: check the date
Five minutes, and most people have never looked at this screen.
Step 1 — Find your security patch level
- Android: Settings, About phone, Android version — the security update date is there.
- iPhone: Settings, General, Software Update shows whether you are current; the model’s support status is published by Apple.
Step 2 — Judge what you find
- Within the last few months: fine, and automatic updates will keep it that way.
- Over a year old with nothing available: the device is very likely out of support.
Step 3 — Confirm the automatic settings
- System updates: automatic.
- App store: automatic app updates on.
Step 4 — If it is unsupported, decide what stays on it
- Not the primary email, the banking app or the authenticator.
- The rest can stay as long as you know where things stand.
Step 1 takes under a minute and answers a question most people have carried unexamined for years.
E. Videos, articles and further resources
Independent and institutional sources in English.
NCSC (UK) — Install the latest software and app updates
The UK authority’s guidance, including the specific advice to avoid phones no longer supported by their manufacturer.
https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/install-the-latest-software-and-app-updates
CISA — Update software
Why keeping software current is one of four basic actions, in plain language.
https://www.cisa.gov/secure-our-world/update-software
FTC — How to protect your phone from hackers
Practical protection steps for the device itself.
https://consumer.ftc.gov/articles/how-protect-your-phone-hackers
NCSC (UK) — Cyber security advice for you and your family
The UK national authority’s advice hub for individuals: short, practical guidance written for people who are not IT professionals.
https://www.ncsc.gov.uk/section/advice-guidance/you-your-family
Google — Use Play Protect to keep your apps safe and your data private
How Android keeps apps checked and updated. Platform documentation rather than independent advice.
https://support.google.com/android/answer/2812853?hl=en
NCSC (UK) — Top tips for staying secure online
Six short pieces of advice from the UK’s national cyber security authority. A good starting point if you want the essentials without the jargon.
https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online
Links checked in August 2026. For how long your specific model is supported, the manufacturer publishes this: Apple and Google both list supported devices and update windows.
F. The Cyber Welfare Framework: Skills, Awareness, Secure Behavior
This lesson sits on the Secure Behavior pillar at level FL1, and connects to a purchasing decision most people make without this information.
Skills
- Finding the security patch date on a phone.
- Checking whether a model is still supported.
- Deciding which accounts belong on which device.
For professionals and organizations
- Setting a minimum supported-device standard for anything accessing company data.
Awareness
- Understanding that a working device and a supported device are not the same thing.
- Recognising that app updates can mask a system that has stopped being updated.
- Knowing that support length is a purchase criterion, not a technical detail.
For future instructors and ambassadors
- Having people check their patch date live. It is the single most surprising number in this course.
Secure Behavior
- Keeping automatic updates on for both system and apps.
- Installing only from official stores, so applications keep updating themselves.
- Moving critical accounts off devices that are no longer supported.
For organizations
- Including support duration in procurement criteria (R6).
G. Questions to sit with
- What is the security patch date on your phone right now? Go and look.
- Do you know how long your device will keep receiving updates?
- Is your email, banking app or authenticator on a device that is still supported?
- When you last chose a phone, did support length come into it at all?
H. What to do now
The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply to devices.
Keeping the device current
- R6 — Keep the software on your devices up to date, with automatic updates enabled.
- MS4 — Keep a strong passcode on the device, which matters more as the device ages.
- R5 — A six-digit PIN at minimum.
What you install on it
- R17 — Do not open attachments from unknown sources.
- R9 — Connect over HTTPS only.
- MS5 — Use a browser that updates itself.
Minimum commitment: Installing from official stores means applications keep updating themselves without you tracking them.
Two things, today
- Check the security patch date on the phone you use most.
- If it is old and nothing is available, decide which accounts should move to a supported device.
Neither requires spending anything. The second one is a decision about where your email lives, not about buying a phone.
In short
- A device that works is not necessarily a device that is still being fixed.
- The security patch date is the number that tells you, and it takes a minute to find.
- App updates can continue on a system that has stopped being updated — which is misleading.
- Support length belongs in the purchase decision, not discovered afterwards.
Related resources in this course
The wider picture on updates and devices:
- System Updates: The Security Measure That Looks Like Maintenance
- Device Lock: The Barrier Everything Else Sits Behind
- Download Security: Deciding Before You Install
Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.
If you would like to follow the whole path, the Cyber Welfare Program is free and open to everyone.
Leave a Reply