A vulnerability scanner has identified an out-of-support database software version running on a server. The software update will take six to nine months to complete. The management team has agreed…

While extended support *might* provide some mitigation (e.g., emergency patches), it does not eliminate *all* risk associated with running out-of-support software, especially if the vendor's support is limited compared to fully supported versions.

An extended support contract does not change a valid vulnerability finding into a false positive; the software is still out-of-support and has known vulnerabilities.

The company is not transferring the *risk* of the vulnerability to the software vendor; they are paying the vendor for *support* during a period of unmitigated risk, the financial and operational impact of a breach would still fall on the company.

The company has acknowledged the vulnerability (out-of-support software) and the difficulty in patching it immediately. By agreeing to an extended support contract, they are consciously deciding to continue operating with the known vulnerability for six to nine months (during which the extended support is active) without fully remediating it, thus accepting the inherent risk associated with that vulnerability.