Windows 10 stopped receiving free security updates on 14 October 2025. Most businesses did not stop using it. They bought a year of Extended Security Updates, filed the problem under “next year,” and moved on.
Next year is now three weeks away. ESU Year One coverage ends on 13 October 2026, and the decision you make before that date costs roughly half of what the same decision costs in November. Here is what actually changes, what each option really costs, and what we would do in the time that is left.
What Actually Changes on 13 October
Nothing breaks. No machine stops booting, no application stops opening, and nobody arrives at work to find a blocked screen. That is precisely what makes this deadline dangerous — the consequence is invisible and cumulative rather than immediate.
What stops is the monthly security patch. Every vulnerability disclosed after that date stays open on those machines permanently. Within a few months you are running an operating system with publicly documented, publicly exploited holes that will never be closed. Attackers watch these dates more carefully than IT departments do, because unpatched Windows is the cheapest way into a business there is.
The second consequence is the one that tends to get executives’ attention faster: cyber insurance. Renewal questionnaires increasingly ask whether all systems receive current security updates. Answering that honestly with unsupported Windows in the building can affect a renewal, a premium, or a claim. Answering it dishonestly is considerably worse.
The Four Options, Priced Honestly
Move to Windows 11
For any machine that meets the requirements, this is the answer, and the licence is already covered — the upgrade itself is free for eligible Windows 10 Pro devices. The work is testing your line-of-business applications and scheduling the disruption, not buying anything.
Buy ESU Year Two
Commercial ESU runs $61 per device for Year One, $122 for Year Two, and $244 for Year Three, ending for good in October 2028. It buys time, not a solution, and the meter runs faster every year.
Replace the Machine
For hardware already four or five years old, a new PC frequently costs less than two more years of ESU plus the productivity tax of a slow machine. If the capital outlay is the obstacle rather than the decision, a subscription hardware program spreads it monthly. Run that comparison per device rather than as a blanket policy — the answer genuinely differs across an office.
Isolate It
For the machine bolted to a $200,000 piece of equipment whose vendor has no Windows 11 driver, the answer is network segmentation: no internet, no email, no general file share access, strictly controlled inbound paths. This is a legitimate engineering answer, not a cop-out, but it has to be built deliberately rather than assumed.
The ESU Meter Only Runs One Way
This is the part that catches people, and it is the reason the next three weeks matter more than the three weeks after them.
Commercial ESU pricing is cumulative. You cannot skip Year One and buy Year Two on its own. An organisation enrolling in Year Two pays for both years. Waiting until Year Three means paying for all three, for coverage that expires in October 2028 regardless.
| When you enrol | What you pay per device | 100 machines |
|---|---|---|
| Before 13 Oct 2026 | $61 | $6,100 |
| Year Two (from 14 Oct 2026) | $183 | $18,300 |
| Year Three (from Oct 2027) | $427 | $42,700 |
Two eligibility details to check before you budget anything. ESU requires Windows 10 version 22H2 — earlier builds are not covered no matter what you pay. And the cheap consumer enrolment paths are not available to business machines that are domain-joined, Entra-joined, or enrolled in mobile management, which is to say almost every machine in a managed environment.
The Machines That Genuinely Cannot Take Windows 11
When you run the compatibility check, the failures cluster into three groups, and only one of them is a real wall.
Firmware, not hardware. The first group fails on TPM 2.0 or Secure Boot and is not actually incompatible — the chip is present but disabled in firmware. Enabling it takes a few minutes per machine. It is worth checking before writing a purchase order, because this group is usually larger than anyone expects.
Processor age. The second group fails on the processor generation list. These machines are old enough that Microsoft will not support them, and while workarounds circulate, running an unsupported upgrade on business hardware means you own every driver problem forever, with no vendor to escalate to. We do not recommend it.
A blocking application. The third group is the real constraint: machines tied to software or equipment that has no Windows 11 version. Medical devices, manufacturing controls, legacy accounting systems, laboratory instruments. These are the ones that need either a vendor conversation or an isolation plan, and they are the ones to identify first because they take the longest to resolve.
What We Would Do in the Next Three Weeks
- Get an accurate count. Almost nobody has one. How many Windows 10 machines are actually running, what version are they on, and which of them pass the Windows 11 check? A properly configured Intune environment answers all three in an afternoon; without one it is a walk around the building. That number is usually a surprise in both directions — there are forgotten machines nobody listed, and there are machines everyone assumed were too old that upgrade fine.
- Sort them into the four buckets. Machines that pass the check get scheduled for upgrade. Machines that fail on firmware settings get corrected and re-checked. Machines that fail on age get a replace-or-ESU decision based on what they cost to keep. Machines with a blocking application get a vendor call this week, because that conversation is never fast.
- Make the ESU decision before 13 October. Even if the plan is to upgrade everything by spring, enrolling the stragglers at Year One pricing is cheap insurance against a project that slips — and projects like this slip. Buying that option now costs a third of buying it in November.
Windows 10 Questions, Answered
Related reading: What Is EDR? · iPad and Jamf at Scale
Want the Count Done for You?
We run this inventory for businesses across Los Angeles, Orange County, and the Bay Area — every machine, its version, its upgrade eligibility, and a per-device recommendation with the cost attached. It takes a few days and it turns a vague worry into a spreadsheet you can budget from.