What does EOL stand for?
EOL stands for End-of-life. The vendor's announcement that a product is no longer sold or developed. Devices past EOL may still work, but the next stage, end of support, means no more patches, and running them becomes a security and compliance risk.
End-of-life is the point in a product's lifecycle where the vendor stops selling and developing it. The date that matters most for security comes with it or after it: end of support, when security patches stop. Vendors publish these dates years ahead. Microsoft, for example, gives products under its Fixed Lifecycle Policy a minimum of five years of mainstream support, followed for some products by a period of extended support. A system past end of support keeps running, which is why it tends to stay in place, but every vulnerability found from then on stays open.
EOL in practice: an example
Windows 10 reached end of support on October 14, 2025. A clinic still runs it on the PC attached to an X-ray machine and cannot simply upgrade, because the imaging software is approved only for that system. The interim answer is a compensating control: the PC is moved to an isolated network segment with no internet access while the replacement is budgeted.
What EOL is confused with
EOL vs EOS: what is the difference?
On the CompTIA list EOS is end-of-support, the date when security updates and vendor help stop. EOL is the wider announcement that the product is finished. Each vendor defines its milestones on its own lifecycle pages, so read those for the exact meaning of a date.
EOL vs legacy system: what is the difference?
A legacy system is one that is old but still in use. It may or may not be past EOL. A system past end of support that is still in production is the risky kind of legacy.
Which exams cover EOL?
EOL is on the official CompTIA acronym list for two of the four exams covered here.
- Network+ N10-009: 3.0 (Network Operations).
- A+ 220-1201 and 220-1202: 220-1202 1.0 (Operating Systems); 220-1202 2.0 (Security).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A router model is past its vendor's end-of-support date and a new vulnerability in its firmware is published. What should the administrator expect?
- No patch will be released for that model
- An automatic update within 24 hours
- A free replacement device
- That only newer models are affected
Show the answer
A. No patch will be released for that model. End of support means the vendor no longer fixes the product. The realistic options are replacement or compensating controls such as isolation.
2. A critical system cannot be replaced for another year, although its operating system is past end of support. Which measure reduces the risk in the meantime?
- Isolating it on a restricted network segment
- Giving all users administrator rights on it
- Connecting it directly to the internet for updates
- Disabling its logging
Show the answer
A. Isolating it on a restricted network segment. Segmentation limits who can reach the unpatched system and what it can reach. The other options widen the exposure or remove visibility.
Sources: Microsoft Learn: Fixed Lifecycle Policy; Microsoft Learn: Windows 10 Home and Pro lifecycle; NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 12 November 2026.