This is typically an expensive and cumbersome option, but it's not unusual for enterprises to need to maintain and secure support to legacy systems. The whitelist would be helpful in risk reduction here, but since most browsers will remove the supporting APIs, you'd need to encapsulate a working configuration and secure it appropriately. You might think about providing a virtualized, ephemeral desktop environment that allows users to access your software with a legacy software configuration on modern clients, while insulating your environment from risk.This would allow you and/or your customers to run the application unchanged, while still getting security and functional updates that keep Flash Player working. Your organization and/or customers could license and distribute a maintained version of Flash Player within their organizations.Adobe AIR is EOL, but HARMAN maintains and distributes a copy of the AIR SDK that you can license. You could convert your web application to a standalone AIR application.We're already at a fairly high level of friction in that regard, but it gets worse. Before then, the browsers will continue to make Flash Player increasingly painful to run. The story ends with the browsers removing the plug-in APIs necessary for Flash Player to run.

The EOL guide you pointed to links off to the roadmaps for each of the major US browsers.

How to get around adobe flash player