How long do you guys keep your Xperia?

Being a security conscious person I'm wondering you guys keep your phones even after support has ended. How long after? Is it really safe to do that with no longer getting security patches? I've never really been one to keep devices after they stop getting updates but it's so damn expensive and I really don't like the other competitors which is why I stick with Sony.