Unsupported software: make the replacement plan part of the insurance review
A working device can still be an unsupported risk. Record support dates, exceptions and migration plans before answering a cyber questionnaire.
Working normally is not the same as being maintained
A workstation can still open invoices and run a familiar application after its vendor stops maintaining the relevant software version. That apparent continuity can hide a security problem and an insurance question. The Swiss OFCS device guidance, Microsoft lifecycle resources and published Swiss cyber conditions were checked on 16 October 2026. OFCS recommends keeping systems current because obsolete software creates an entry point for attackers. Do not use the absence of a visible fault as evidence that security updates are still supplied. Identify the exact product and version; a vendor’s brand name alone does not tell you whether that installation remains supported.
Build a lifecycle register, not just a device list
For each essential system, record its owner, version, vendor support status, security-update source and planned replacement date. Include firmware, specialist applications and equipment that an external supplier maintains. Ask the supplier what its maintenance contract actually covers after the manufacturer’s support ends. If an extended-support arrangement exists, keep evidence of eligibility, scope and deployment rather than assuming an invoice proves every device is enrolled. A register should make exceptions visible. It should not label an unsupported machine compliant merely because it is rarely used, physically intact or awkward to replace during the busy season.
A hypothetical migration with a real operating constraint
Imagine a design SME discovers that one workstation runs an unsupported application needed to read older customer projects. Immediate removal would disrupt current commitments, but leaving it unchanged indefinitely also creates exposure. The team asks its IT specialist for a time-limited arrangement, a tested replacement workflow and a documented migration budget. Those measures do not create insurance cover automatically or guarantee technical safety. The example shows the tradeoff between business continuity and accumulated risk. Assign an owner and deadline, record residual exposure and ask the insurer how the actual situation should be disclosed. A planned exception should lead to a decision, not become a permanent undocumented habit.
Read obligations and exclusions with the declaration
The Mobilière cyber conditions linked here define the role of the policy and special conditions and contain provisions concerning security measures and obsolete systems. Their effect depends on the specific clause and event; they should not be reduced to a blanket statement that every old computer voids every claim. Ask how your own insurer treats unsupported components, compensating measures and a declared transition period. Answer questionnaire questions accurately, including the scope of any statement that all systems are updated. If reality changes, ask whether and how the declaration needs updating. Outsourcing IT does not make an inaccurate answer accurate or remove the need to understand it.
Make replacement and verification part of routine management
Schedule support-date reviews before renewal and before purchasing new software, not only after a cyber incident. Budget for migration, compatibility testing, staff training and safe retirement of old data. Confirm that the replacement actually receives updates and that important workflows still function. Keep technical evidence with the insurance review but restrict access to sensitive system details. Ask Clearwise to compare obligations and exclusions using the documented environment rather than an idealised diagram. The useful outcome is a supported, maintainable estate and a truthful risk description. A cyber policy can address selected financial consequences; it is not a substitute for a lifecycle decision that the business has postponed.
Sources and further reading
Original Clearwise analysis. External reporting provides context; rules and contract terms must be verified with the competent authority or provider. Some press articles may require a subscription.
Apply this to your situation
Compare your actual documents and clarify what matters before making a commitment.
Request a free consultationGeneral guidance, not a binding quote or personalised legal, tax or investment advice. Examples are hypothetical and results are not guaranteed.
