The software keeps running after support ends. What stops is the stream of fixes, and that changes your security exposure and the answers you can give an auditor.
The ERP still posts invoices and prints pick tickets. Nothing broke the day support ended, and nothing will break tomorrow. That is exactly what makes an unsupported system easy to keep running and easy to underestimate.
If you run an older Dynamics product, the dates are already set. Dynamics NAV 2017 leaves extended support on January 12, 2027, less than three months from now (Microsoft Lifecycle). NAV 2018 and Dynamics GP 2018 follow on January 12, 2028 (Microsoft Lifecycle). Current Dynamics GP gets support and updates through December 31, 2029, with security patches ending April 30, 2031 (Microsoft). AX 2012 R3 left extended support in January 2023.
Extended support already means security fixes only, with no new features or regulatory updates. After the extended end date, even the security fixes stop.
An unsupported system does not get weaker on its own. The world around it changes. New flaws are found in the software and in the SQL Server and Windows Server versions it depends on, and no fix is coming for them. Every one stays open for as long as you run that stack.
That matters because attackers use known flaws. The Verizon 2025 Data Breach Investigations Report found that exploiting vulnerabilities was the way in for 20% of breaches. Among small and midsize businesses, ransomware showed up in 88% of breaches, with a median payment of $115,000 (Verizon 2025 DBIR, via Help Net Security).
The FBI’s Internet Crime Complaint Center logged more than 1 million complaints in 2025 and almost $21 billion in reported losses. It counted 3,611 ransomware complaints, and critical manufacturing ranked second among critical infrastructure sectors for cyber threats (FBI IC3 2025 Internet Crime Report). Distribution sits right next to those manufacturers in the supply chain, connected by EDI, portals, and shared order data. Your ERP is one of the systems holding that data.
Patching is not just an IT preference. If you take card payments and your ERP or its servers sit in scope, PCI DSS v4.0.1 requirement 6.3.3 expects critical and high-severity patches to be installed within one month of release (PCI Security Standards Council). That is hard to show when the vendor has stopped releasing them.
The same question shows up in other places: an auditor’s IT controls review, a lender’s due diligence, or a large customer’s supplier security questionnaire asking whether your core systems are vendor-supported. A plain "no" usually means extra controls, extra paperwork, or an exception someone has to sign.
Dynamics 365 Business Central online is a service Microsoft runs. Microsoft hosts it, updates it on a published schedule, and applies security fixes without your team scheduling a weekend outage (Microsoft Learn). The service is certified to ISO 27001, with the full list of certifications in Microsoft’s compliance documentation (Microsoft Learn). Microsoft also publishes a direct migration path from Dynamics GP to Business Central online.
Dynamics 365 Finance & Supply Chain Management runs on the same Microsoft-managed model, with regular service updates that keep every customer on a current version. If you are weighing which one fits your operation, our Dynamics 365 Finance & Supply Chain Strategic Assessment maps your processes against both.
One thing does not move to Microsoft: your side of the shared responsibility model. Your team still owns users, security roles, multifactor sign-in, and what data goes where. The difference is that IT spends that time on access and data, not on keeping an old server alive.
If the answers point to a date within the next year or two, you have time to plan a move on your terms rather than on an incident’s.
Western Computer has spent nearly 40 years and more than 1,750 Dynamics implementations moving distributors off GP, NAV, and AX, and the move goes best when it starts with an honest look at the stack. Security is one of the risks an aging ERP hands to IT, and we put the rest in writing.
Read The Distributor’s IT Risk: What an Aging ERP Really Costs the Team Holding It Together
Sizing the investment first? The Microsoft Dynamics 365 pricing estimate gives you a self-guided read on which product fits and what it would cost.