The Ticking Time Bomb: 10% of Small Business PCs in Israel Run on Dead Software

A new report from the XIT monitoring system, released on July 25, 2026, has uncovered a critical security deficit within the small business sector in Israel. The data, sampled from a wide array of endpoints, suggests that one in ten computers is currently operating on an End-of-Life (EoL) operating system. These machines, running versions of Windows 10 or older that are no longer supported, represent a permanent and unfixable risk to the organizations that rely on them.

While missing a scheduled update is a common administrative hurdle, running an EoL system is a fundamental security failure. For these machines, manufacturers no longer issue security patches, meaning any newly discovered vulnerability becomes a permanent open door for attackers. This finding is particularly relevant for the global supply chain; as small businesses are often the entry point for larger corporate breaches, the lack of basic hygiene in one region can have cascading effects internationally.

The Gap Between Maintenance and Irreversible Exposure

The XIT data makes a sharp distinction between poor maintenance and irreversible exposure. While 30% of the sampled computers had pending updates and 10% were missing critical security patches—issues that can be solved with proper IT management—the 10% running unsupported systems are essentially security "black holes." Even the most skilled network administrator cannot block OS-level vulnerabilities when the vendor has ceased support.

The scale of this risk is underscored by the discovery of 193 potential vulnerability findings across just 10 monitored computers, encompassing 27 unique CVE identifiers. Alarmingly, 16 of these vulnerabilities have already been flagged by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) as being actively exploited "in the wild" (Known Exploited Vulnerabilities). Among the software flagged were common tools like Notepad++ and Java 8, featuring CVSS severity scores as high as 9.8. While these findings are based on product names and require further version-specific verification, their presence on unsupported systems significantly expands a business's attack surface.

Operational Decay: Beyond Security Risks

The report also highlights a significant level of operational attrition that threatens daily productivity. Nine out of ten computers in the sample carried at least one active system alert. Driver errors were the most prevalent issue, affecting 60% of the fleet and serving as a primary driver of system instability. The consequences are tangible: in a single 30-day window, the monitored fleet recorded nine "Blue Screen of Death" (BSOD) events and 39 critical system errors in just 24 hours.

Hardware performance is also reaching a breaking point. Average RAM consumption sits at 62%, but 10% of machines are under extreme stress, exceeding 85% utilization. Furthermore, while average free disk space is 57%, one-tenth of the computers are operating with less than 15% capacity. A full disk is more than a storage inconvenience; it prevents the OS from writing temporary files, leading to software crashes and, crucially, the inability to download and install the very security updates needed to protect the business.

The High Cost of IT Neglect

For a small business, the combination of aging infrastructure and poor habits creates a perfect storm. The sample showed an average system uptime of 122 hours without a reboot, and in 20% of cases, local firewalls were found to be completely disabled. This environment is ideal for ransomware. For instance, the presence of CVE-2020-0878 in the Edge browser, combined with a disabled firewall and an old OS, provides an easy path for lateral movement within a network.

The findings serve as a stark reminder for small enterprises globally: IT infrastructure is not a "set and forget" asset. To avoid a total business collapse, experts recommend a proactive maintenance model. This includes the immediate replacement of EoL hardware, continuous monitoring of disk health, and the implementation of strict weekly update cycles to ensure that minor technical debt does not evolve into a catastrophic security breach.