19 checks to find the tech that stopped getting security patches

Nothing broke on Oct. 13. The computers turned on, Word opened and the schedule loaded. But that day, Office 2021 stopped receiving security fixes, Windows 11 24H2 Home and Pro reached end of support and the last paid updates for Windows Server 2012 ran out. Windows Server 2016 follows on Jan. 12, 2027.

Software past its end-of-support date keeps working, but every flaw found afterward stays open. The Cybersecurity and Infrastructure Security Agency lists unsupported software first among its cybersecurity bad practices. The HHS Office for Civil Rights has already settled for $150,000 with a behavioral health provider after a malware breach affecting 2,743 people, citing a failure to patch and the use of outdated software.

The hard part is finding these systems. They sit on servers in closets, underneath the EHR, inside copiers and on the PC that only runs the lab interface. Here are 19 places to check, and what to do with what you find.