What is an Extended Security Update? SQL Server 2016 just hit the wall

SQL Server 2016 reached the end of extended support on 14 July 2026. Microsoft has confirmed that any instance still running it stops receiving security patches — unless you’re paying for Extended Security Updates.

So what is an ESU?

An Extended Security Update is a paid subscription that keeps critical security patches flowing to a product Microsoft has otherwise retired. That’s the whole offer. No new features. No bug fixes. No non-critical patches. No support if something breaks. For SQL Server 2016 it runs up to three years, ending July 2029, and the price climbs each year you stay on it.

Think of it as a paid extension on a deadline you already missed. It isn’t a security control — it’s a receipt for borrowed time.

Why this catches businesses out

Here’s the pattern we see across client environments in Sydney and Central West NSW: almost nobody decides to stay on an ageing SQL Server. They find out they’re on one when a software vendor says the practice management or booking system “only supports 2016”. The database isn’t the project — it’s a dependency nobody has looked at in years. The ESU invoice is usually the first time that risk shows up on a budget line where a director can actually see it.

That’s also why ESU quietly becomes permanent. Year one feels cheap next to a migration. By year three you’ve paid multiples for a server you were always going to replace, and you’re back at the same wall with less runway.

What to do about it

Find out what you’re actually running before you decide anything. Ask your vendors — in writing — which SQL versions they support today, not “soon”. If you buy ESU, buy it with a migration date attached, not as a renewal. And if a 2016 instance is sitting on an internet-facing server, treat that as urgent rather than budgetary.

If you’re not sure what’s lurking in your server room, that’s a fair place to start. Our managed IT support team can audit what you’re running and map an upgrade path, and our cybersecurity team can tell you which end-of-life systems are genuinely exposed. Get in touch if the ESU quote landed on your desk this week.