Windows 10 support ended on 14 October 2025. If your business still has machines running it without extended security cover, those machines have now gone the best part of a year without security patches, and every month widens the gap between the vulnerabilities attackers know about and the fixes your PCs will never receive.
You are not alone, which is part of the problem. Surveys through the transition found over a third of small businesses had no clear migration plan, and around one in seven did not know support was ending at all. Attackers read the same surveys. Unpatched Windows 10 estates are now among the softest targets in the UK, and “it still works fine” is doing a lot of dangerous lifting in small-business IT right now.
This guide covers what has actually changed, what Extended Security Updates buy you (and what they cost from October 2026), how to check whether your machines can move to Windows 11, and the sensible order to do things in.
What “end of support” actually means
Windows 10 still boots. Your software still runs. What stopped in October 2025 is the flow of security fixes: when researchers or criminals find a new hole in Windows 10, Microsoft no longer patches it for ordinary installations. Feature updates, bug fixes and standard Microsoft support ended too.
Three knock-on effects matter for businesses:
- Compliance and certification. Cyber Essentials requires software in scope to be supported and receiving security updates. Unsupported Windows 10 machines are a straightforward certification failure, which also means trouble for any contract or tender that demands certification. Our Cyber Essentials certification service sees this constantly.
- Insurance. Cyber policies commonly require supported, patched systems. Running an unsupported OS hands your insurer an argument at exactly the moment you need them to pay.
- Software support. Vendors are dropping Windows 10 from their tested platforms. One note of relief: Microsoft 365 Apps continue to receive security updates on Windows 10 until October 2028, so Office itself is not the immediate emergency. The operating system underneath it is.
The ESU ladder: buying time, at a doubling price
Microsoft sells Extended Security Updates (ESU) for businesses that cannot migrate in time: security patches only, no new features, no support. The pricing is designed to push you off it:
- Year one (October 2025 to October 2026): $61 per device, roughly £50.
- Year two (October 2026 to October 2027): $122 per device, and if you did not buy year one, you must buy it retrospectively as well, so joining late costs $183 per device before coverage even starts.
- Year three (October 2027 to October 2028): $244 per device. Then it ends, full stop.
The design is transparent: ESU is a bridge for machines you cannot replace yet, not a way to keep the fleet alive. As one industry assessment put it, ESU is a fallback, not a strategy. With the year-two boundary arriving in October 2026, a business enrolling now needs to think hard about whether that money is better spent on replacement hardware it will need anyway by 2028.
Machines running in cloud or virtual desktop environments, and devices covered by certain Microsoft cloud subscriptions, can qualify for ESU at no extra cost; if you are already paying for Microsoft 365 E3 or run virtual desktops, check before buying anything.
Can your machines run Windows 11?
Windows 11 is a free upgrade for eligible Windows 10 devices. Eligibility is the catch: it requires TPM 2.0 (a hardware security chip) and, in practice, an Intel 8th-generation / AMD Ryzen 2000 processor or newer. As a rule of thumb, business machines bought from 2019 onwards usually qualify; older ones usually do not, and the workarounds that force Windows 11 onto unsupported hardware have no place on business machines.
So the first real task is an audit, machine by machine: which devices upgrade free, which need replacing, and which are due for replacement soon anyway. Most businesses discover the problem is smaller than feared: a typical estate splits into a majority that upgrade in place and a minority of older machines whose replacement was overdue regardless. Our guide to hardware refresh cycles covers how to budget that without a nasty one-off hit.
A sensible plan from here
If your business still runs Windows 10, here is the order we work through with clients:
- Audit the estate this week. Every device: model, age, Windows version, Windows 11 eligibility. This takes hours, not weeks, with the right tooling.
- Upgrade the eligible machines. Free, and largely disruption-free when scheduled properly: files, applications and settings carry across. Batch them outside working hours.
- Decide per-machine on the rest: replace or bridge. Replacement is usually the right answer for anything also slow, out of warranty or near the end of its refresh cycle. ESU is the bridge for the genuinely awkward cases: the PC that drives a machine tool, the till that runs legacy software.
- Buy ESU deliberately, not by default. If a machine needs the bridge, enrol it and diarise its retirement. Remember the October 2026 price step: bridging a machine for two more years costs $183 to $427 of updates on hardware that is, by definition, already old.
- Check the estate you cannot see. Home workers’ machines that access business data count. So does the forgotten PC in the warehouse. Unsupported machines with access to your systems are your problem wherever they sit.
If a machine cannot be upgraded, cannot justify ESU, and cannot be replaced yet, it should at minimum come off the internet and away from email, the two routes by which unpatched machines actually get compromised.
The bigger picture
The uncomfortable truth is that Windows 10’s retirement is not really an IT event; it is a test of whether a business manages its technology or reacts to it. Businesses with a managed refresh cycle barely noticed October 2025. Businesses without one are now choosing between paying Microsoft escalating rent on old hardware or funding an unplanned fleet replacement, all while running raised risk.
That is fixable, and this is a good moment to fix it: an estate audit rolls naturally into a refresh plan, a patching discipline and the security baseline schemes like Cyber Essentials formalise. Our cyber security service builds exactly that baseline for Scottish businesses.
Frequently asked questions
Is it illegal or non-compliant to still run Windows 10?
Not illegal, but for many businesses it is non-compliant: Cyber Essentials fails unsupported operating systems in scope, insurers commonly require supported software, and sector regulators expect patched systems. The exposure is contractual and financial rather than criminal.
Can we just pay for ESU and forget about it?
For up to three years, per device, at a doubling price each year, and only until October 2028. ESU buys planning time for machines that genuinely cannot move yet. As a whole-fleet strategy it costs more than replacement and ends in the same place.
Is the Windows 11 upgrade really free?
Yes, for eligible Windows 10 devices, and your files and applications carry across. The cost sits in the ineligible machines, which need replacing, and in the planning to do it without disruption.
What happens if we do nothing?
The machines keep working while the unpatched vulnerability list grows. The realistic outcomes are an incident (ransomware operators specifically hunt unsupported systems), a failed certification or insurance condition, or software that stops supporting your OS at an awkward moment. Doing nothing is a decision; it is just one with a worsening payoff.
We’re a small office of ten PCs. What would this actually cost us?
Typically: an audit (hours of work), free upgrades for the majority of machines bought since about 2019, and replacement of the older minority at normal business-PC prices. For most ten-seat offices that is a planned, modest spend, far smaller than a single day of ransomware downtime.
Get the audit done
If any part of your estate is still on Windows 10, the audit is the urgent bit, and it is exactly what our free IT health check covers: every machine checked for Windows 11 eligibility, a per-device recommendation, and a costed plan you can phase. Get in touch before the October 2026 price step makes the awkward options more expensive.
