Exceptions will only be approved if there is a valid reason why the system cannot be upgraded and remediation steps such as obtaining extended support, EDR clients, and network firewalls have been put in place (these are just examples and not an exhaustive list). Submit a security exception as early as possible, to allow time to implement mitigations needed before End of Life. More information on exception requests here
