How long do smart home devices get security updates?

Four to five years is the usual promise from the big smart home brands, but each one starts counting at a different moment, and the promise is a floor rather than an end date. Google guarantees critical security updates for Nest devices for at least 5 years from the day it started selling that model on the US Google Store. Amazon and Ring guarantee at least four years from the day you bought the device new directly from them, or a fixed date per model if that is later. Philips Hue promises five years from purchase, three for its Bridge. Appliances are the weak spot: when Which? asked makers in 2020, only Miele gave a definitive figure.

Three different clocks, and which one your device runs on

• From launch. Google counts from "the date we start selling them on the US Google Store." A Nest camera launched in 2021 and bought new today has no guaranteed time left.
• From your purchase. Philips Hue counts from the date you bought the product from an authorized reseller. Amazon and Ring do too, but only if you bought new with Amazon itself as the seller on amazon.com, or from ring.com.
• A fixed calendar date. Amazon and Ring publish an "at least through" date for every model. Bought elsewhere, as a gift or refurbished, that date is your whole guarantee.

The Amazon and Ring rule takes whichever of its two dates is later. An Echo Dot (5th Gen) bought new from Amazon in October 2026 is covered until at least October 2030, four years on, because that beats its listed date of December 31, 2029. The same speaker from a supermarket is guaranteed only to the end of 2029.

This is why two answers circulate. The headline figure is only true on launch day for a Google device, or for an Amazon one bought direct; for everyone else it is shorter. The same trap catches people buying phones, as the phone support periods and their end dates show.

End dates for popular devices, in one table

Google publishes a launch date and five year minimum for every Nest device, with a column saying whether each is still patched. Amazon and Ring publish a date per model. Side by side, as of October 2026:

For Amazon and Ring, the listed date is everyone's minimum; buying new direct in the last four years can only push it later. Ring's end dates alone span seven years, from the end of 2024 to the end of 2031 for its 2K and Elite models, and parts of one system age differently: a first generation Alarm Base Station is covered to 2030, while a Video Doorbell 2 at the same front door already ran out.

Past the minimum is not the same as unsupported

Google's list holds a detail most coverage misses. The original Google Home launched on November 4, 2016, so its minimum ran out in 2021, yet it is still marked as receiving critical security updates. So are the Nest Mini, whose minimum ended on October 22, 2024, and the 2017 Google Home Mini. Only the first Chromecast, from 2013, is marked no.

The guaranteed period is a floor. Amazon and Ring write that after the stated period they "may continue to provide software security updates for as long as we can (subject to technical and other limitations)." Philips Hue treats later updates as discretionary.

So a device inside its period is one you can rely on. One past it may still be patched, but nothing obliges the maker to continue.

What the end actually looks like

Because these devices work through the maker's servers, the end of updates often arrives with the end of the app. Google's first and second generation Nest Learning Thermostats show the pattern. From October 25, 2025 they were unpaired and removed from the Nest and Home apps. Remote control and notifications stopped, and Google's support page states that the devices "will no longer receive software or security updates." They still heat the house, with schedules and temperature changes on the thermostat itself. Amazon lists the Echo Look and Amazon Cloud Cam as deactivated, and Philips Hue ended support for its first Bridge on April 30, 2020.

That split, a device still doing its physical job without updates, is the common end state, and the risky one because it stays on your network. A camera or doorbell running on firmware nobody patches is an exposure, which is why keeping a camera feed away from everybody else depends on current software as much as on a strong password.

Appliances: the category without a clear answer

When the UK consumer group Which? asked appliance makers in June 2020, not one had published its update policy for consumers. Samsung confirmed a minimum of two years. Miele was the only brand to give a definitive figure: 10 years of security updates for its smart appliances. Beko gave a maximum of 10 years, and BSH, Hoover and Candy, LG and Whirlpool said "the life of the product" without saying what that meant. Which? set that against typical lifespans of 10 years for dishwashers and washing machines and 11 for fridge freezers and tumble dryers.

The "smart appliances only get two years" line still quoted online comes from that survey: one brand's minimum in 2020, not an industry rule. What holds up is the mismatch. If the app is not why you bought the appliance, leaving it off your network removes the question.

What the law now requires

• United Kingdom. Since April 29, 2024, the Product Security and Telecommunications Infrastructure (PSTI) regime has required makers of consumer connectable products to publish the minimum length of time security updates will be provided, with an end date, in a clear, accessible and transparent manner. It does not set a minimum length.
• European Union. The Cyber Resilience Act sets a length. Article 13 requires a support period of at least five years, or the expected time in use if a product is expected to be used for less, and the end date, with month and year, must be clear at the time of purchase. Those main obligations apply from December 11, 2027. Its reporting obligations began on September 11, 2026.

Neither rule covers a device sold in the US, where the maker's own published policy is the commitment you have.

How to check your devices and what to do next

1. Find the exact model and generation. Ring's Stick Up Cam (2nd Gen) ran out at the end of 2024; the Stick Up Cam Pro is covered to the end of 2029. For devices you own, Amazon shows the date for your unit in Manage Your Content and Devices, and Ring shows it under Software Security Updates in Ring's Control Center.
2. Leave automatic updates on. A guarantee is worth nothing on a device that never installs what it is sent, and which updates to install at once and which can wait explains why firmware is the category people neglect.
3. Replace in order of what the device can see and hear. A smart plug or bulb past its date is low stakes. A camera, doorbell, lock or anything with a microphone comes first, for the reasons in what a smart speaker hears and stores. Whatever stays, give it its own password, since one reused password undoes any amount of patching.
4. Check the box everything connects through. Every device here reaches the internet through your router, which has its own end date, covered in how long routers get security updates.
5. Before passing a device on, remove it from your account and reset it with the steps for wiping a device properly.
6. When buying, treat the end date as a specification alongside price. Prefer devices that keep working locally on open standards, the test set out in what to buy first for a smart home, because those survive a maker walking away.