Microsoft will end support for Office 2016 and Office 2019 in October 2025, leaving businesses exposed to security, compliance and functionality risks. Dr Yvonne Bernard, CTO, Hornetsecurity, outlines how organisations can prepare, migrate and protect against threats.
What tools does your organisation use in day-to-day operations? Does the Microsoft Office suite come to mind? For those using on-premise installations rather than cloud-based solutions, Microsoft Office is the backbone of daily operations. From contracts drafted in Word to presentations in PowerPoint and Excel budget sheets, these tools are vital across industries. But what happens when critical support for this software becomes obsolete?
Microsoft has announced that as of October 14, 2025, support for its Office 2016 and Office 2019 packages will end. This switch-off of support is a cybersecurity and compliance cliff edge for many businesses that continue to use these products, including the 80% of SMEs (which use some form of Microsoft product in their daily operations.) To remain safe from security risks and compliance violations, it’s vital that organisations double check which version of Microsoft Office they use and update their systems if they fall under either of these categories.
It’s time to act: what steps should you take?
With the end-of-support deadline drawing near, IT teams should take several steps to ensure no security risks arise. Start by taking a full inventory of affected users and critical business processes. Who on the team is using these tools? What type of tasks do they carry out? How often? Conducting a risk assessment will help determine whether security or compliance threats may occur if outdated software is used.
Once this step is complete, a strategic decision should be made about which Office applications to use moving forward. Microsoft 365 offers regular updates and cloud advantages, making it a future-proof option. Office LTSC 2024 could be an alternative for isolated environments, but just like Office 2016 and Office 2019, it has a defined support end date.
After determining the best applications, it’s time to create a migration plan and pilot phases. Is there compatibility with existing hardware and applications? Have sufficient resources and budget been allocated to ensure a smooth transition? A pilot project is essential to identify issues early, test the migration and develop best practices before a company-wide rollout.
Organisation-wide training and early communication are also critical. Employees need to clearly understand what is changing, why and how it benefits them. Providing transparency, reassurance and opportunities for feedback increases employee buy-in. Training on new features, combined with a phased rollout, minimises disruption.
Failure to act: the repercussions
Companies that fail to update systems and continue using outdated Office packages may face:
- Heightened security risks – Unpatched vulnerabilities may be exploited by cybercriminals, leading to breaches with financial, legal and reputational consequences.
- Compliance violations – Old, unsupported software can breach regulatory requirements and trigger penalties.
- Functionality and compatibility issues – Bugs, data corruption and missing features are likely, as older versions miss Microsoft 365’s updates.
- End of technical support – After October 14, Microsoft will no longer provide technical support for Office 2016 and 2019.
- Increased operating costs – Legacy systems demand more maintenance, with emergency fixes driving up costs.
- Cyber insurance risks – Using unsupported software could result in denied or reduced coverage.
Migrating to Microsoft 365 and the need for third-party solutions
Microsoft 365 had over 400 million active seats worldwide in 2024 and continues to grow. While migration seems simple, organisations must consider Microsoft’s Shared Responsibility Model: Microsoft secures the cloud infrastructure, but businesses remain responsible for protecting their own data.
M365 does not provide long-term backups, focusing instead on live data retention. Microsoft’s own backup service currently covers Exchange Online, SharePoint Online and OneDrive for Business but excludes critical data in Microsoft Teams and Planner. Relying solely on Microsoft leaves gaps, making third-party solutions a necessity.
Best practices include:
- Conduct regular security audits of third-party vendors.
- Create and test an incident response plan.
- Provide ongoing cybersecurity awareness training for employees.
Becoming the first line of defence
Research from Hornetsecurity shows that 26% of organisations fail to provide IT security training to end-users, leaving them exposed. Employees are often the first line of defence, and a ‘human firewall’ is essential.
Any strong human firewall rests on three principles:
1. Mindset – Educate employees on common cyber threats.
2. Skillset – Train staff to spot and respond to potential attacks.
3. Toolset – Provide tools to detect and prevent suspicious activity.
The clock is ticking
The end of support for Microsoft Office 2016 and 2019 is a pressing cybersecurity concern. Migrating to a supported solution like Microsoft 365, combined with third-party security and training, will strengthen defences against tomorrow’s threats. Businesses must act now to avoid costly risks and ensure compliance.
