How Long Do Business Phones Get Security Updates?

When you choose a business phone, the date it stops getting security updates matters more than its camera, chip or screen. After that date, new flaws stay unfixed on a device that holds your email, files and sign-in apps, and, if it is in scope, the phone no longer meets Cyber Essentials.

This guide covers what UK law makes manufacturers publish, what Cyber Essentials expects of phones, the support end dates for recent Apple, Samsung, Google and rugged models, and how to plan around them.

Why the support end date matters more than the spec sheet

Once a phone stops receiving security updates, newly found vulnerabilities stay open. That matters because a business phone holds company email and files, often the authenticator app staff sign in with, and access to customer data.

End dates vary widely. Samsung's Galaxy XCover7 Pro is supported until 31 May 2032, the older XCover7 only until 28 February 2029: from today, about five and a half years against under two and a half (our calculation). Three points shape how to read any end date:

• The clock starts at launch, not when you buy. A phone bought late in its model's life has less support left.
• A minimum is not a maximum. Updates may run longer than the published period, but you cannot plan on that.
• Security updates and OS upgrades differ. Security updates fix flaws; operating system (OS) upgrades add new versions and features. Samsung promises the XCover7 up to four OS upgrades but up to five years of security updates.

The law: what PSTI makes manufacturers publish

The UK's Product Security and Telecommunications Infrastructure (PSTI) regime came into force on 29 April 2024. It covers consumer connectable products, which the NCSC confirms include smartphones and cellular tablets.

The key requirement is the "defined support period": the minimum length of time, "expressed as a period of time with an end date", for which security updates will be provided. Manufacturers must publish it clearly, and the regulations say the requirement is not met if the period is shortened after publication. The Office for Product Safety and Standards (OPSS) enforces the regime, and the NCSC notes that non-compliance is a criminal offence, with fines of up to £10 million or 4% of qualifying worldwide revenue, whichever is higher.

One caveat: PSTI is framed around consumer products. Business phones are the same models, so the published period is a useful buying input, but we are not suggesting PSTI covers business-only sales.

What Cyber Essentials expects of phones

The NCSC's Cyber Essentials scheme runs on version 3.3 of its requirements, effective from 27 April 2026 and assessed with IASME's "Danzell" question set. Mobile phones are named in four of the five technical controls:

• Staff-owned phones count. Personal phones that access organisational data or services are in scope. Phones used only for calls, texts and multi-factor authentication (MFA) apps are not.
• Supported software only. Operating systems and apps must be licensed and supported, and removed, or cut off from the internet, once they are not.
• 14-day patching. Updates must be installed within 14 days of release if they fix flaws the vendor rates critical or high risk, fix flaws scoring 7 or above on CVSS v3, or come with no severity details. Automatic updates should be on where possible. IASME made its 14-day patching questions automatic fails from April 2026, and says systems must be supported at the date of certification.
• Device locking. A biometric, password or PIN is required. An unlock-only PIN should be at least 6 characters, with lockout after at most 10 failed attempts, or no more than 10 guesses in five minutes.
• Approved apps only. On phones, malware protection means allow-listing: only approved, code-signed apps can run.

Our reading, not the NCSC's wording: a phone whose OS no longer gets security updates cannot meet "licensed and supported", and cutting a phone off from the internet defeats its purpose. In practice, replace unsupported phones, or limit them to calls and texts, before your next assessment. Our Cyber Essentials self-assessment guide walks through the questions, and Cyber Essentials vs Cyber Essentials Plus explains the two levels.

Apple iPhone

Apple publishes a UK PSTI Statement of Compliance for each iPhone. Each gives the same defined support period, "Minimum 5 Years from the first supply date", plus the model's first supply date. Apple publishes no calendar end date and no count of iOS upgrades, so you work out the earliest end date yourself.

Because the clock starts at first supply, an iPhone 16 bought today has a minimum of under three years left, while an iPhone 18 Pro has almost five (our calculation). If you keep phones for four years or more, that favours a current model. Statements are on Apple's regulatory site, for example the iPhone 17 statement.

Samsung Galaxy

Samsung says it extended security support for Galaxy devices by up to seven years from January 2024. More usefully, each Samsung UK product page has a model-specific field, "Security Update Period (Valid until)", with a calendar end date:

• Galaxy S26, S26+ and S26 Ultra: 28 February 2033 (see the S26 Ultra page).
• Galaxy S26 FE: 30 September 2033.
• Galaxy Z Fold8 Ultra, Z Fold8 and Z Flip8: 31 July 2033.
• Galaxy A57 and A37: 31 March 2032.
• Galaxy A27: 31 July 2032.
• Galaxy A17: 31 August 2031.
• Galaxy XCover7 Pro: 31 May 2032.
• Galaxy XCover7: 28 February 2029.

Rely on that field rather than the generic seven-year footer on many pages, which appears even on models whose own details say six. Samsung's business page also warns that "security maintenance release cadence and timelines may not be committed" for A2x and A1x models, such as the A27 and A17. For the XCover7, a Samsung Switzerland document lists a later end date than the UK page; plan on the UK date.

Samsung's Enterprise Edition phones add a three-year warranty and "up to 7 years of firmware updates either monthly or quarterly". Check each model: Samsung's UK launch release gives the A57 Enterprise Edition seven years of security releases, but a Swiss Samsung document says six.

Google Pixel

Google's policy is the simplest: Pixel 8 and later phones get seven years of OS, security and Pixel Drop updates. The catch is the start date: the seven years run "from when the device first became available on the Google Store in the US", and Google publishes the starting month, not an end date:

• Pixel 11, 11 Pro, 11 Pro XL and 11 Pro Fold: August 2026, so updates to around August 2033.
• Pixel 10a: March 2026, so around March 2033.
• Pixel 10, 10 Pro and 10 Pro XL: August 2025, so around August 2032.
• Pixel 10 Pro Fold: October 2025, so around October 2032.

Those end months are our calculation, not Google's. OS upgrades are also covered for the full seven years.

Rugged and budget brands

Check a rugged phone's support date as carefully as its drop rating; our best rugged phones guide compares models in detail.

• Samsung XCover7 Pro and XCover7: 31 May 2032 and 28 February 2029, as above.
• Crosscall publishes a security update table giving the month after which updates are "not guaranteed": December 2033 for the CORE-M6 and STELLAR-X5s, December 2032 for the CORE-Z5 and December 2034 for the STELLAR-M6. Two dates conflict with other Crosscall sources: the CORE-M6 launch release said December 2032 (the table is more recent) and the STELLAR-X5s product page says December 2031. Planning on the earlier date is safer.
• HMD XR21 (formerly Nokia XR21): HMD's own pages variously give August 2027, July 2027 and summer 2027, so assume mid-2027, under a year away.
• Budget import brands such as Doogee, Blackview and Ulefone: we found no published security update period. Ulefone promises "at least two Android OS updates" for eligible new devices but no security patch duration.

Without a published end date you cannot plan a replacement or be sure updates are still arriving.

Current models side by side

The phones in this guide differ by about six years in remaining support. Counting from 27 October 2026 (our calculation):

Price tier is a poor guide: Samsung's mid-range A57 and A37 have later published end dates than the iPhone 18 Pro's published minimum, and the entry-level Galaxy A17 outlasts the rugged XCover7. A model's age matters as much as its brand.

Building support dates into how you buy and replace phones

How to find a phone's end date

• Samsung: the "Security Update Period (Valid until)" field on the model's Samsung UK page.
• Apple: the model's UK PSTI statement gives the first supply date; add five years for the minimum.
• Google: the Pixel update policy lists each model's US availability month; add seven years.
• Others: look for a security update page or a date on the product page, or ask the supplier in writing.

Make it part of buying

1. Set a minimum remaining support at purchase. If you keep phones for four years, do not buy a model with three years left, and allow a margin for phones kept longer.
2. Match contracts to support. A handset contract should not outlast the phone's security updates; see our guide to SIM-only vs handset contracts.
3. Record the end date against each phone in your asset register or device management tool (see our Intune device management guide).
4. Turn on automatic updates so the 14-day rule is met without chasing staff.
5. Review the fleet before each Cyber Essentials assessment and replace any phone that will be out of support on the day.

When a phone nears its end date

We suggest planning replacements six to twelve months ahead to fit your budget cycle. Once the date passes, replace the phone or remove company email, files and apps so it is used only for calls and texts, and wipe it before reissuing or recycling. For phones with long support, see our best business mobile phones for 2026 and iPhone vs Samsung vs Pixel for business.

How Omega IT can help

Omega IT offers business mobile and device management, and quotes business mobile on EE, O2, Vodafone and Three, with SIM-only and handset plans quoted against your business's real usage. It also offers cyber security services and is Cyber Essentials Plus certified. Read more about business mobile and device management or get a free, no-obligation quote.

Sources

• GOV.UK (DSIT): The UK Product Security and Telecommunications Infrastructure (Product Security) regime (updated 2 May 2024)
• legislation.gov.uk: SI 2023/1007, Schedule 1, paragraph 3: information on minimum security update periods
• NCSC: Smart devices: new law helps citizens to choose secure products (29 April 2024, updated 14 August 2026)
• GOV.UK (OPSS): Regulations: consumer connectable product security (updated 17 March 2025)
• NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3 (April 2026)
• NCSC: Cyber Essentials resources
• IASME: Important update: changes to Cyber Essentials for April 2026 (12 February 2026)
• IASME: Preview the self-assessment questions for Cyber Essentials
• Apple: UK PSTI Statements of Compliance for iPhone 17, iPhone 18 Pro, iPhone 17e, iPhone Duo and iPhone 16
• Samsung: Samsung Mobile Security: update scope
• Samsung UK: product pages for the Galaxy S26 Ultra, Galaxy A57, Galaxy A17, Galaxy XCover7 Pro and Galaxy XCover7
• Samsung UK: Galaxy for Business and Enterprise Edition
• Samsung UK Newsroom: Galaxy A57 5G and Galaxy A37 5G launch (25 March 2026)
• Samsung Switzerland: B2B EOP Management 2026
• Google: Learn when you'll get software updates on Google Pixel phones; Pixel availability dates
• Crosscall: Security updates; STELLAR-X5s
• Business Wire: Crosscall launches CORE-M6 (8 December 2025)
• HMD: HMD XR21 and specifications
• Ulefone: Commitment to at least two Android OS updates (29 August 2026)

General guidance, accurate to October 2026. Diagrams by Omega IT.