Is It Safe To Keep Using A MacBook That No Longer Gets Support?

Apple's MacBook lineup is generally well-regarded for its polished hardware and long software support period. While Apple doesn't officially give a binding software support timeline for MacBooks, a look at the trends in the past shows that the company offers around five to eight years of macOS updates for new MacBooks. This is a perfectly safe period to use your MacBook as you are getting new features, bug fixes, and security patches. But what happens after Apple announces a new macOS version, like macOS 27 Golden Gate, and your MacBook stops getting the latest OS updates? Is it still safe to keep using your MacBook? Well, generally speaking, yes, it's largely safe, but only for a limited period of time and with a caveat.

Once Apple stops delivering new features and OS updates to MacBooks, it doesn't completely ditch support for them. The company still releases security patches for the two or three most recent prior macOS releases even after a newer version launches. That security support typically runs for about two additional years, after which most MacBooks will not get anything. However, in some cases, Apple has been seen releasing security patches well into the third year. For example, MacBooks with macOS Monterey were receiving security patches well over two years after macOS Ventura's release. Even so, nothing beyond the official support window for any particular version of macOS is guaranteed. 

One of the primary reasons to avoid using a MacBook after it has stopped receiving security patches is that it's at risk of being targeted by malware or other actions by bad actors. In a notable example from 2021, a likely state-sponsored attack targeted visitors to Hong Kong political and media websites using an XNU kernel privilege escalation flaw in macOS Catalina and Mojave. The same flaw was not present in macOS Big Sur. However, for folks running the older versions at the time, it was a problem because their MacBooks were no longer supported and did not receive the new version. Although Apple patched the flaw after Google's Threat Analysis Group (TAG) reported it, MacBooks with Catalina and Mojave remained at risk until the patch rolled out.

Attackers can also sometimes keep an eye on patched zero-day vulnerabilities in newer macOS versions and then use those vulnerabilities to target older versions that don't get the patches. These are referred to as N-day vulnerabilities. Even in the case of the previously mentioned Hong Kong attack, an N-day vulnerability was used. 

All this makes it pretty unsafe to keep using a completely unsupported MacBook. Moreover, while you may be safer if your MacBook is still getting security patches after the support period, there is a small risk during the period between the time a serious vulnerability is found being actively exploited and Apple patching it. Depending on your risk tolerance and risk profile, you can choose to upgrade to a new MacBook immediately after it stops receiving major macOS versions or wait until it stops getting security patches.