If your business is still running Windows 10 on even a handful of machines, the clock is louder than you think. Standard support ended on October 14, 2025. The paid Extended Security Updates program that has been keeping those machines patched since then stops on October 13, 2026. After that date, a new vulnerability in Windows 10 stays open forever.
That gives you a real decision to make this year, not next. Here is where things stand, the risk that is easy to miss, and the three options in front of you.
Where Windows 10 stands right now
Windows 10 did not stop working when support ended. The PCs still boot, the apps still run, and your files are right where you left them. What changed is that Microsoft stopped shipping free security patches.
The bridge Microsoft offered is Extended Security Updates, or ESU. It is a paid program that delivers only critical and important security updates. It does not include feature updates, bug fixes, or technical support, and it requires Windows 10 version 22H2. Since end of support, Microsoft has already shipped several rounds of ESU patches. Any device not enrolled has missed every single one of them.
The key point: ESU is a countdown, not a fix. For consumers it ends in October 2026. Businesses can stretch commercial ESU for up to three years, through October 2028, but the price climbs every year and it was always designed to buy migration time, not to keep Windows 10 alive indefinitely.
The risk most businesses are not thinking about
Everyone understands the obvious risk: unpatched machines are easier to attack, and attackers go after unsupported operating systems on purpose because they know the holes will never be closed. There are two angles that get less attention and matter just as much.
First, compliance and insurance. Running an unsupported operating system can quietly put you offside with regulatory requirements and with the conditions in your cyber-insurance policy. If you ever have to file a claim, “we were running an OS with no security support” is the kind of detail a carrier looks for to reduce or deny a payout.
Second, a 2026-specific problem: certificate expirations. Older root and Secure Boot certificates baked into Windows are reaching their expiry dates, and devices that are not receiving updates can run into trust and even boot issues over time. This is the kind of thing that turns a “we will deal with it later” machine into a “it will not start this morning” emergency.
Your three options
There is no fourth option that involves doing nothing safely. Here are the real ones.
Option 1: Upgrade eligible PCs to Windows 11. This is the best path for any machine that qualifies. The upgrade is free, and Windows 11 is where security, support, and new features now live. The catch is that Windows 11 has stricter hardware requirements, including TPM 2.0 and a supported processor, so a good share of older Windows 10 machines will not be eligible. You need to know which ones qualify before you can plan anything else.
Option 2: Buy ESU as a temporary bridge. If you have machines that cannot move to Windows 11 yet, whether because of hardware, a legacy application, or budget timing, commercial ESU keeps them patched while you plan. Treat it as a runway, not a runway extension you keep renewing. Microsoft’s commercial ESU pricing starts around $61 per device for the first year and roughly doubles each year after that, so it gets expensive fast across a fleet. Confirm current pricing for your situation before you budget.
Option 3: Replace hardware that cannot make the jump. Machines that fail Windows 11 requirements and are not worth bridging with ESU should be replaced. This is often the right call for aging devices that were already due for a refresh, and planning it now beats scrambling for hardware on a deadline.
The cost trap that rewards acting early
Here is the detail that catches people who wait. Commercial ESU is cumulative. If you skip the first year and try to enroll in the second, you have to buy the earlier year too before you can get current coverage. Delaying does not save money, it stacks the cost. The cheapest version of every option here is the one you plan in advance instead of buying in a panic in September.
What to do now
You do not need to migrate everything this week. You need a clear picture and a plan. The order we work in:
- Inventory every device still on Windows 10 and confirm which build they are on.
- Check each one for Windows 11 eligibility, so you know what can upgrade for free.
- Identify the machines that genuinely need an ESU bridge versus the ones that should be replaced.
- Budget the migration across the year rather than as one painful lump.
- Schedule upgrades and replacements in waves so nothing critical gets disrupted.
If you would rather not hand-build a device inventory and eligibility matrix yourself, this is routine work for a managed IT provider. We handle Windows 11 migrations and fleet planning as part of our managed IT services, and we treat the security side of an aging OS the way it deserves to be treated.
Get a migration plan before the deadline does
The businesses that handle this well are the ones that start with a plan and a calendar instead of a deadline and a crisis. If your team works out of offices in Orange County and you want a straight answer on which machines to upgrade, which to bridge with ESU, and which to replace, reach out. We will inventory your fleet, map out the cost, and give you a migration schedule that fits your budget and your October timeline.