And another blog post from the recent past I outlined why a patch policy and an update policy maybe critical for survival of an organization.
On rare occasions, and actually more often than desirable critical software upon which the organization relies to operate cannot be updated or patched simply because this piece of software has reached its end-of-life.
Normally, I T staff will start running around like decapitated chicken, and try to find alternative Solutions to this very important problem.
If the software in question does not require Internet access it is possible to run it in virtualized environment's so that it does not endanger rest of the system that is connected to the network and the Internet.
If you're willing to take a bit of risk you may consider limited Internet access if the software requires it.
https://lars-hilse.de/lhx18/2019/10/why-you-should-isolate-un-patchable-end-of-life-software/