A patch lifecycle is the period during which a product continues to receive security fixes, bug repairs, and maintenance from its vendor. It starts when a product is released and ends when support stops or moves to limited maintenance. In practical security terms, the lifecycle tells defenders how long they can expect vulnerabilities to be corrected and how long the product remains a reliable part of a secure environment.
This matters because attackers often target software after support ends. Once patching slows or stops, known flaws may remain exploitable for months or years, giving threat actors an easy path into devices, networks, or accounts. Defenders use patch lifecycle information to plan upgrades, replace aging systems, and prioritize exposure to unpatched products. In mobile fleets, for example, a shrinking support window can force security teams to retire devices before the hardware fails, simply because the software can no longer be trusted to receive timely fixes.