Most Android devices receive security updates for only 2 years from release – yet can remain on sale for much longer than that. Which means it is possible to by a brand new Android phone today that is already too old to receive security updates.
When considering which smartphones and tablets to deploy to staff, it is important to consider the commitment from the manufacturer to supply security updates against the expected duration of service for the device. It is a bold security manager who will try to explain to the board why two year old tablets that are still working the field need to be scrapped because they run vulnerable software that will never be patched.
While Apple devices are usually more expensive than similar Android devices, Apple has been providing security updates for 4 or 5 years since the phone is first released. In contrast the longest supported Google Pixel phone receives only a 3 year commitment to security updates, and most other Android phones receive only 2 years.
According to a new report from Which? more than a billion Android devices (40% of all devices in the world) were no longer receiving security updates as of May 2019 (the most recent statistics published by Google ).