Still on Windows 10 in 2026? Your options before the ESU price doubles

Short answer. Windows 10 stopped getting security updates on 14 October 2025. Microsoft’s paid Extended Security Updates cover it for another year at a time, and the first of those years ends on 13 October 2026, after which the price doubles. If you still have Windows 10 machines in the business, the realistic options are: upgrade them to Windows 11 where the hardware allows, replace the ones that can’t, and use ESU only as a short bridge for anything genuinely stuck.

I am writing this in September 2026 because I am still finding Windows 10 laptops in businesses that switch to me, usually because nobody checked. This is the plan I use with them.

What “end of support” actually means

Windows 10 still boots. Office still opens. Nothing visibly changes on the day, which is exactly why businesses drift past it. What stops is the monthly stream of security fixes. Every vulnerability discovered from October 2025 onwards gets fixed in Windows 11 and, unless you pay for ESU, left open in Windows 10.

Attackers read the same patch notes as everyone else. A fix released for Windows 11 tells them precisely where to look on Windows 10. That is not theoretical; it is how the WannaCry outbreak spread through unpatched Windows 7 machines years after their support ended.

Two knock-on effects matter more for a small business than the abstract risk:

• Cyber Essentials. The scheme requires supported software receiving security updates. A Windows 10 machine without ESU fails the assessment, and if you need Cyber Essentials for a contract or a tender, that is a hard stop.
• Insurance. Cyber insurance proposal forms now ask directly about unsupported operating systems. Answering “yes” affects the premium at best and the claim at worst.

The ESU timeline and prices

Extended Security Updates buy time, not a solution. For commercial devices Microsoft prices them per device, per year, and the years stack:

Two details catch people out. First, the years are cumulative: enrol in year two and you pay for year one as well. Second, the free consumer route (signing in with a Microsoft account) was a one-year offer ending in October 2026 and was never licensed for business use. Machines running under Windows 365 or in Azure get ESU included, which is one reason cloud PCs are worth a look for stubborn cases.

Step one: find out what you actually have

Before any decisions, get a list. For each PC: model, age, Windows version, and whether it passes the Windows 11 hardware check. Any managed IT provider with remote monitoring can produce this in minutes; if you are doing it yourself, Microsoft’s PC Health Check app does one machine at a time.

In my experience the result is usually better than feared. A typical 20-person business finds three or four machines that can’t move, not fifteen.

Option one: upgrade in place

If the hardware qualifies (TPM 2.0, Secure Boot, a supported CPU, which broadly means 8th-generation Intel or Ryzen 2000 and newer), the Windows 11 upgrade is free and takes about an hour per machine. It keeps files and applications. It is the right answer for most of the fleet.

Do it properly: back up first, check any line-of-business software is supported on Windows 11, and schedule the upgrades so the whole office is not rebooting on the same Tuesday morning.

Option two: replace

Machines that fail the hardware check are, by definition, at least six or seven years old. A business laptop at that age is slow, its battery is tired and its warranty is long gone. Replacing it is not really a Windows 11 cost; it is a decision you were going to make anyway, brought forward.

Sensible business laptops sit between £600 and £1,000. Buy from a business range rather than a retail one: better warranties, TPM and Secure Boot as standard, and a Pro edition of Windows rather than Home.

Option three: a bridge for the genuinely stuck

Sometimes a machine can’t move. A CNC controller running vendor software that only works on Windows 10. A lab instrument. A finance package the supplier has not updated. For those:

• ESU for a year while you plan the replacement.
• Isolate it. Take it off the general network, remove email and web browsing from it, and treat it as an appliance.
• A cloud PC. Windows 365 gives the user a Windows 11 desktop in the cloud, accessed from the old machine, with ESU thrown in for the old operating system underneath.

What you should not do is leave a Windows 10 machine with a mailbox and internet access on the same network as everything else and hope.

A realistic timeline

For a business of 10 to 40 staff, I would plan it like this:

1. Week one: inventory and hardware check.
2. Weeks two to three: in-place upgrades, a few machines a day, starting with the least critical.
3. Weeks three to five: replacements ordered, built and swapped.
4. Anything left: ESU purchased, isolated, with a dated plan to retire it.

That gets most businesses done inside a month, with no big-bang weekend.

Key dates to remember

• 14 October 2025: Windows 10 support ended.
• 13 October 2026: ESU year one ends, the consumer free year ends.
• 13 October 2027: ESU year two ends.
• 13 October 2028: ESU ends completely.

If any of your machines are still on Windows 10 and you are not sure where you stand, that inventory is a 30-minute job for me, and every managed IT engagement starts with one anyway. Book a call and we can do it on the call.