Debian eLTS offers 7 years: https://wiki.debian.org/LTS/Extended https://wiki.debian.org/LTS/Extended That said, if you're really in the position of depending

Debian eLTS offers 7 years: https://wiki.debian.org/LTS/Extended https://wiki.debian.org/LTS/Extended That said, if you're really in the position of depending on a free project for over five years of security support, you probably will be totally fine with just ignoring the fact it's out of support. Just keep running Debian 6 for a decade, whatever. The code still runs. Pretend you've patched. Sure, there are probably some vulnerabilities, but you haven't actually looked to see if the project you're actually using right now has patched all the known vulnerabilities, have you? (Spoiler, it hasn't: https://arxiv.org/abs/0904.4058 https://arxiv.org/abs/0904.4058)