Sony has been one of the more reliable brands when it comes to supporting its old devices, but until now it didnt have an official policy on how long support lasts. So, heres a bit of clarity and piece of mind.
Sony commits to upgrading its all of its premium devices to the latest Android version for two years after launch. These top devices all participate in the Security Update Program too, to patch security risks and vulnerabilities.
Mid-range and entry-level devices dont get a set period of support. If the company decides the hardware cant deliver a stable user experience with the new software, they will not be updated.
Also, not mid-range all phones are are in the Security Update Program (and entry-level handsets are not mentioned at all). Patches will be delivered in updates ranging from stand-alone updates to major Android updates and the timing may vary between carriers.
Finally, for a more recent bit of security issues Meltdown and Spectre. Basically, every Xperia since the Xperia X generation will get patched. Heres the full list: Xperia XA1, Xperia XA1 Ultra, Xperia L1, Xperia XA1 Plus, Xperia XA2, Xperia XA2 Ultra, Xperia L2, Xperia X Performance, Xperia X, Xperia X Compact, Xperia XZ, Xperia XZ Premium, Xperia XZs, Xperia XZ1 and Xperia XZ1 Compact.
PS. Googles latest policy for its Pixel 2 phones says 3 years of Android updates (up from 2 years for the original Pixels).