Sooner or later, every small business running on third-party software gets the email: the product has an expiration date. It isn’t a price hike, a UI refresh, or a mandatory upgrade. It’s a date on the calendar after which the software stops being supported. The vendor calls it a sunset. For the people whose daily operations depend on it, it’s a deadline with real teeth.
What happens between the day that email lands and the day the lights go out is where small businesses tend to make their most expensive mistakes. The pattern is predictable enough to walk through in order: what to do before the email arrives, what to do the week it does, and what to clean up afterward.
Before the email arrives, build a short list you can actually read
Businesses that handle a sunset well already know what they run on. That sounds obvious until you try to produce the list. Most small businesses can name their accounting tool and their email provider. Far fewer can name the plug-in that syncs their point-of-sale to their inventory system, or the vendor behind the scheduling widget on their website.
When that back-end plug-in gets discontinued, the owner finds out from a customer complaint, not from a vendor notice nobody opened. Owners who discover these dependencies late sometimes end up commissioning software development services to rebuild the piece nobody was watching, usually under more time pressure than they’d like.
A workable inventory doesn’t need to be elaborate. One spreadsheet, four columns: the software, what it does for you, which vendor owns it, and where the renewal or sunset notice would land if one were sent. Keep it somewhere you’ll open twice a year.
The day the email lands, read the dates carefully
Vendor sunset notices rarely give you one date. They give you a sequence, and the sequence matters more than any single milestone. Expect an end-of-sale date (no new licenses), an end-of-support date (no more patches or help desk), and an end-of-life date (the thing stops working, or stops being safe to run).
Microsoft’s Windows 10 announcement is a useful recent example: the operating system kept running after October 14, 2025, but technical assistance, feature updates, and security updates stopped on that date. Running fine and being supported are two different things.
Pull the three dates out of the email and put them on an actual calendar. Then back up from the earliest hard deadline and ask one question: how many weeks of work does a real replacement take, and does that fit? If it doesn’t fit, you’ve already learned the most useful thing the email was going to tell you.
Decide between replace, rebuild, and ride it out
Three paths tend to be on the table, and small businesses underweight the second one almost every time.
- Replace with a comparable product. The fastest route when a credible alternative exists. The trap is assuming features map one-to-one; they rarely do, and the workflows your staff built around the old quirks have to be rebuilt around the new ones.
- Rebuild something custom. More realistic for small operators than it sounds, especially for the narrow slice of software that encodes how your specific business works. Worth a conversation when the off-the-shelf replacement would force you to change the way you do business to fit its assumptions.
- Ride it out. Keep running the discontinued software past its end-of-life date and accept the risk. Sometimes defensible for an isolated, non-networked tool. Rarely defensible for anything that touches customer data, payments, or the public internet.
The third option is where most of the damage slips in unnoticed. The ENISA flash note on discontinued software is blunt about why: once the vendor stops shipping patches, third-party tools (anti-malware, peripherals, integrations) gradually stop supporting it too, and your exposure compounds the longer you wait.
After cutover, close the loop on security and access
A migration isn’t finished when the new system is live. It’s finished when the old one is off, its credentials are revoked, and nothing is still pointing at it. Forgotten installations are where sunset risk turns into breach risk: an unpatched admin console, a service account still wired into a workflow nobody remembers, a laptop in a back office running the old client because the person who used it changed roles.
Federal cybersecurity officials have grown blunter about this. A 2026 CISA directive ordered agencies to inventory and remove end-of-life devices on tight timelines, citing active exploitation by sophisticated attackers. Small businesses don’t get a directive, but attackers don’t care about the distinction. The same unsupported box is the same target.
The last task is almost administrative: update the inventory you built in step one. New vendor, new sunset clock, new place the notice will land. The next email is already on its way. The point is to be the business that reads it in time.
This content is provided for informational purposes only and is not a substitute for professional advice. AFP editorial staff were not involved in the creation of this content.
Share
