The security check to make before buying any smart device

Since the Product Security and Telecommunications Infrastructure (PSTI) Act 2022 came into force, UK manufacturers of connected devices have been legally required to publish, clearly and accessibly, the minimum period for which a product will receive security updates. That single figure, easy to miss on a spec sheet, tells you how long a phone, tablet, TV, camera or smart home gadget will keep getting the patches that close security holes.

The trouble is that this figure varies hugely between brands, and between product categories, and the industry hasn't settled on a consistent way of measuring it. Some manufacturers count support from the day a model launches. Others count it from the day it's discontinued, which can mean a much shorter real-world window if you buy it late in its life. Nobody tells you this at the till.

What this actually means for you

Here's roughly what's on offer across common device types, based on current manufacturer commitments:

Phones. Google's Pixel 8 onwards gets at least seven years of support from launch, matched by newer Samsung phones. Some Fairphone models reach eight years. Apple promises five years from launch, though Which? found real-world support has stretched to six years or more without that being guaranteed. Older Google and Samsung phones, and Xiaomi's range, sit much lower, with Xiaomi offering as little as two years.

Tablets. Samsung's Galaxy Tab S10 Lite, S11 and S11 Ultra get at least seven years from launch. Lenovo tablets range from two to three years depending on model.

TVs. Samsung's Tizen-based TVs get up to seven years on eligible models; other Samsung and LG sets get five years from launch. Panasonic now guarantees three years, down from a previous five. Philips is estimated at around three years, though that figure is an estimate rather than a published commitment.

Security cameras. Google Nest cameras get at least five years from launch. Imou offers just two.

Wi-fi extenders and mesh systems. Amazon Eero, Devolo and Google promise at least five years from launch. Mercusys, Netgear and TP-Link instead count three years from a product's end-of-life date, which can mean a shorter window overall.

Smart radiators. Tado promises ten years from release. Honeywell offers two years after end-of-life.

Laptops. Windows 11 machines are supported until October 2031, Windows 10 until October 2027, ChromeOS until 2034, and Apple Macs get at least five years from launch.

Kindles. Amazon's original Kindle ran for 18 years before support ended this year for every model made before 2012. Those devices can no longer buy or download ebooks from the Kindle Store, and factory resetting one now makes it unusable. New Kindles carry a four-year guarantee.

When support ends, a device doesn't stop working and the risk doesn't jump overnight. But it stops receiving the firmware updates and security patches that keep it current, and the gap between an unpatched device and a patched one widens as time goes on, partly because AI tools are making it easier for criminals to find and exploit old vulnerabilities.

What to do

• Before buying any connected device, find its published minimum security support period. Manufacturers are legally required to make this clear.
• Favour longer guaranteed periods, particularly for phones, tablets and anything connected to your home network.
• Check whether the stated period runs from launch or from discontinuation. The second is usually worse news if you're buying later in a product's life.
• If you own a Kindle made before 2012, don't factory reset it. It will become unusable, though it will continue to work as it currently does otherwise.
• Once a device's declared support period has passed, think about replacing it, especially if it's always connected to the internet.
• The National Cyber Security Centre publishes further guidance on securing individual devices, worth a look if you want specifics beyond buying advice.

What this does not fix

Checking a support date tells you how long a manufacturer intends to keep patching a device. It doesn't tell you whether that patch will arrive on time, whether the device was secure to begin with, or whether you've set it up safely, with a strong, unique password and sensible network settings. A device with ten years of promised support is still only as secure as the account behind it. A VPN encrypts your connection and hides your location from the sites you visit, which is useful, but it has no bearing on whether your smart camera or your old Kindle is still receiving security patches. That's a manufacturer's job, not a VPN's.