Most findings in a vulnerability report have a fix: install the update, change the setting, restart the service. End-of-life software is different. When a vendor stops supporting a product, new vulnerabilities in it are still discovered, but nobody ships a patch. The finding will be on every report from now on until the system is upgraded, replaced or removed.

That makes end-of-life (EOL) software one of the most important things a report can point out, and one of the easiest to bury in a long list.

Why EOL deserves its own section

A missing patch is a task. An unsupported system is a decision. Treating it like one more finding causes three problems:

It looks fixable when it isn't. A ticket that says "patch Windows Server 2012 R2" can't be closed, because there is nothing left to install.

The real risk is understated. The scanner can only flag vulnerabilities that are already known. On an unsupported product, every new one found from now on stays open for good.

The fix needs budget.…