SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-patch-unpatchable-isolate

A legacy device can no longer be patched because the vendor ended support. What does NIST SP 800-40r4 suggest?

Isolate it or use other methods to mitigate the risk.

Start playing free

  1. Ignore it because there are no patches
  2. Isolate it or apply other compensating mitigations ✔
  3. Patch it with a different vendor's updates

Why: End-of-life assets are a known weak spot. When patching is impossible, NIST suggests isolation or other mitigations. Network segmentation and tight access rules are common ways to do this.

Huh, didn't know that: NIST says delaying routine patching also makes later emergency patching harder and more disruptive.

The dad joke
My old server is end-of-life. We don't patch it, we just whisper 'good luck' through a firewall.
Like this card?
Play the game

References

Answer: Isolate it or apply other compensating mitigations. End-of-life assets are a known weak spot. When patching is impossible, NIST suggests isolation or other mitigations. Network segmentation and tight access rules are common ways to do this.

  1. NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-40r4.pdf
    This is the implementation of isolation or other methods to mitigate the risk of systems that cannot be easily patched.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyGiving each user only the access needed for their assigned tasks follows which principle?Security & PrivacyWhich hardening step reduces the attack surface by removing what a system does not need?Security & PrivacyA list of applications authorized to run, with everything else blocked by default, is called what?

That's stuff everyone should know.