Guidesecurity13 min read

Is your router still getting security updates?

Ahmad JAug 31, 2026

Your ISP wrote the update promise for your router, not the manufacturer. What BT, Sky, Virgin, Vodafone and TP-Link each actually commit to.

A practical guide to getting it right.

The 10-second answer

It depends on who made your router, and for most British homes on who SOLD it to you, because the box came with the broadband and the provider answers for it rather than the manufacturer. There is an answer for more routers than people think: UK product-security law obliges anyone selling a connectable product here to publish a support period, so the fact exists in a document somewhere. What it does not do is oblige anyone to make that document easy to find, or to publish it in the same shape as the next company. So the honest position is that some routers have a printed end date you can read today, some have a date you have to work out from a rule the maker published separately, and some have nothing at all. The one answer nobody should accept is silence read as an all-clear.

In this guide

In the UK, the provider answers for a router that came with broadband, not the manufacturer, so support period documents must be sought from the provider rather than the hardware maker.
Across five UK providers and 57 listed routers, Sky is the only provider to publish a signed, per-model statement with a printed calendar end date, while Virgin Media publishes no end dates for any of its hubs.
The same router model, the F5394, is covered by BT until April 2031 but by EE only until September 2028, because each brand's support clock starts from its own sales date rather than the manufacture date.
Every one of the 445 TP-Link rows in the dataset is past its calculated end-of-support date because the company's end-of-life list has not been updated beyond 5 December 2022, leaving the published list unable to confirm current support status for any model.

Signaldefinitive7independent sources

Start with who answers for your box#

This is the question that decides everything else, and it is not the one most people ask. If you bought your router, the manufacturer answers for it. If it arrived with your broadband, the provider answers for it, and the manufacturer usually will not, because you are not their customer. Those are two entirely different documents, kept in two different places, and looking in the wrong one is the most common reason people conclude that nobody publishes anything.

Where your router came from	Who publishes the support period	What you get
You bought an Asus	Asus, in its UK networking-product support table	A printed end date for that model
You bought a TP-Link	TP-Link, as an end-of-life list plus a published rule	A date you calculate: end of life, plus three years
It came with your broadband	Your provider, in a compliance document or a support PDF	A period per box, in whichever format that provider uses
Anything else	Usually a policy page with no model list	A promise about future products, and no date for yours

Asus, TP-Link and five UK providers, read 17 August 2026. The support periods exist because the Product Security and Telecommunications Infrastructure Act requires them; the four different shapes exist because nothing requires a common format.

One note on dates before any of the numbers below. Every figure in this piece was read on 17 August 2026 from the document the company publishes itself, and each of those documents is linked at the end. Support periods change when a company revises a statement or adds a product to a list, so a figure here is what was published on that date rather than a permanent fact. Where you need today's answer for your own box, the checker at the end reads the same datasets and shows you when they were last verified.

The same box, two providers, two different answers#

Here is the clearest illustration that the provider is the answer and the hardware is not. BT and EE belong to the same group and ship several of the same boxes, listed under the same manufacturer model numbers. The F5394 is one of them. BT covers it to April 2031. EE covers the identical model to September 2028.

Heads-up

Same hardware, same group, two years and seven months between the two answers. Neither company is doing anything wrong, and that is what makes it worth knowing: both promise a minimum period measured from the sales start of the product, and each brand started selling it at a different time. The clock is attached to the sale, not to the box.

The consequence is practical. If you have moved between providers in the same group, or bought a used router, or inherited one with a house, the date on the manufacturer's label tells you nothing. The question that has an answer is which brand supplied it and when that brand started selling it. Both figures above come from the two companies' own product-support PDFs, and both are linked at the end of this piece.

What each provider actually publishes#

Across five providers there are 57 boxes with a published position, and the positions are not four versions of the same thing. One provider prints a signed calendar date. Two publish a table of periods running from a sales start. One publishes the manufacturer of every box and no dates at all. The fourth publishes a list of the kit it has stopped supporting.

Provider	What it publishes	So the answer is
Sky	A signed Statement of Compliance per model, with a start and an end	A calendar date. The Sky Max Hub runs to 30 August 2026
BT and EE	A product-support PDF listing a minimum period from each product's sales start	A month, once you know which brand supplied the box
TalkTalk	A cyber-security table, plus a separate list of unsupported devices	A month, and a published list of 47 devices it no longer supports
Virgin Media	The manufacturer and model number of every box, and no dates	Nothing about time. It points you at the manufacturer instead

Read from each provider's own document on 17 August 2026. On that date, of the 57 boxes covered, 34 were inside a published support period, 19 were past the end of one, and 4 had no published period at all.

Two of those rows deserve their own sentence. The first is Sky's, because it is the strongest document in this whole area: a signed statement, per model, with a printed calendar date, which is the same class of fact as a manufacturer's own table. The second is Virgin Media's. The only Virgin Media kit with a published end date is its two streaming boxes, not any of its hubs. All four of its hubs are named down to the manufacturer and the model number, and then the trail stops.

The most precise thing anyone has published, and what it leaves out#

BT's UK Declaration of Conformity for its Smart Router is worth reading if you ever wondered whether these documents are boilerplate. It is current, it is signed, and it does not dodge the question. It declares conformity with the product-security regulations and it cites EN 303 645 provision 5.3-13 by name, which is the provision that requires a defined support period. It is the same clause Sky cites on the line directly above the date Sky prints.

Key point

BT's Declaration of Conformity for the F5394, signed 31 March 2026, cites the defined-support-period clause and names no period. The period is published separately, in BT's Product Support document.

This is not an accusation. The period is published, in a different BT document, and this piece links both. It is here because it is the cleanest example of why the answer feels unfindable: the document that names the obligation and the document that satisfies it are two separate files, and only one of them is attached to the router. Anyone searching for their support period will find the first and reasonably conclude there is nothing to find.

Routers people bought: two makers, two opposite answers#

If you chose your router rather than being sent one, the list gets shorter fast. Two manufacturers publish something a person can look their own model up in: Asus and TP-Link. Between them that is 370 distinct models and 549 rows, counting the hardware versions TP-Link dates separately. Everyone else publishes a policy, which is a promise about how long support will last and not a statement about your router.

Asus prints the date. 104 of its networking products are listed with an end date, and 87 of them are still dated in the future. It also adds a sentence worth taking at face value: "And extended support may be provided after the stated date." So an Asus date is a floor rather than a ceiling, which is the opposite of how a support date usually behaves and is genuinely good news.

370

router models Asus and TP-Link publish between them, across 549 rows

104

Asus networking products listed with an end date

of those still dated in the future

TP-Link publishes something different, and the difference matters more than it looks. It publishes an end-of-life list, and separately a rule: "TP-Link will provide security updates for our products during the pre-defined support period. The defined support period will end 3 years after the product's end-of-life date." That gives you a date by arithmetic rather than by reading. It also means the answer is only as current as the list.

Heads-up

The list is where this breaks down. Read on 17 August 2026, nothing on TP-Link's end-of-life list is dated later than 5 December 2022, so the latest support date it can possibly produce is three years after that, and that date has passed. As of 17 August 2026, every one of the 445 TP-Link rows in our dataset was already past its end of support, and the list itself was roughly three years behind. That is not a claim that every TP-Link router is unsupported. It is the stronger and more uncomfortable point: the published list can no longer tell you either way.

Not on any list is not the same as fine#

This is the sentence that everything above is arranged to avoid writing, and it is the one most tools write by accident. A search that returns nothing looks like a clean bill of health. It is not one. Absence means the maker has not published, or has not published in a form anyone can look a model up in, and neither of those is a statement about whether your router is being patched.

The reason differs by maker, and the difference is the useful part. These are the positions as of 17 August 2026. Asus lists the networking products covered by UK PSTI, which is not its whole back catalogue, so an older model can be absent and unsupported. TP-Link's end-of-life list has gained no entry dated later than 5 December 2022, so a model missing from it is not evidence of anything. And where a router is from neither maker, the reason is simpler still. Only Asus and TP-Link publish a list that can be read model by model. The other makers checked publish a policy and no dates.

What this means for you

So the actual procedure, in order

Turn the router over and read the label. You want two things: the brand on the front of the case, and the model number on the label, which is often not the name the provider markets it under.
If a provider's name is on the case, that provider answers for it, not the manufacturer. Search for that provider's product security or product support page, which is where the period is published, and not its help pages about your broadband.
If a manufacturer's name is on it, look for that maker's own support-period list. Asus publishes a table; TP-Link publishes an end-of-life list and adds three years to it; most others publish a policy with no model list.
If you find nothing, do not read that as a pass. Ask your provider or the manufacturer directly for the defined support period for your model, which is a specific phrase from the regulations and gets a more useful answer than asking whether the router is safe.
If the answer is that support has ended, the fix is a different box rather than a setting. For a provider-supplied router, that is a conversation with the provider, and it is often free, because you do not own it.

Look up your own router

Our free checker holds 370 Asus and TP-Link models and 57 boxes from five UK providers, and answers from what each company actually published: a printed date where there is one, the arithmetic shown where the date is derived, and a plain "nobody has published this" where nothing exists. It never treats a blank result as good news.

How long does a router get security updates?

There is no single figure, and any article giving you one has averaged across companies that publish nothing. Where a period is published it typically runs a few years from the product's sales start rather than from the day you got it. Asus prints an end date per model and says support may run longer. TP-Link publishes a rule instead: three years from a product's end-of-life date. Broadband providers publish their own periods per box, and among the 57 UK boxes we checked, 19 are already past theirs.

My router came with my broadband. Who is responsible for updating it?

Your provider. It supplied the product, so it carries the published support period, and it is the one pushing firmware to the box. The manufacturer's name may be on the label, and in most cases the manufacturer will not answer a question about a box it sold to a network rather than to you. Virgin Media is the clearest case: it publishes the maker and model of every hub it ships and then points at the manufacturer for anything about dates.

My router is not on any list. Does that mean it is still supported?

No, and this is the most important thing on this page. It means nobody has published an answer you can look up, and as of 17 August 2026 that is where both lists stand. TP-Link's end-of-life list has gained no entry dated later than 5 December 2022, so a model missing from it is not evidence of anything. Asus lists the networking products covered by UK PSTI, which is not its whole back catalogue, so an older model can be absent and unsupported. An empty search result is a statement about what has been published, never about what is being patched.

Two of my neighbours have the same router as me. Why is their end date different?

Almost certainly because a different company supplied it. The published period usually runs from a brand's own sales start, so the same hardware can carry different dates under different labels. The clearest example is within one group: BT covers the F5394 to April 2031 and EE covers the same model number to September 2028. Hardware versions matter too, which is why TP-Link dates them separately.

What actually happens when router updates stop?

Nothing on the day, and nothing you will be told about. The router keeps working. What changes is that flaws found after the final update stay open, and a router is the one device on your network that every other device trusts, so an unpatched flaw there is worth more to an attacker than the same flaw on a laptop. Everything you own that reaches the internet does so through it.

Why does UK law come into this at all?

Because it is the reason any of these dates exist. The Product Security and Telecommunications Infrastructure regime requires anyone selling a connectable product in the UK to publish a defined support period, which is why manufacturers and providers publish documents they had no commercial reason to write. It does not standardise the format, which is why the answers here take four different shapes, and it says nothing about how long that period has to be.