Microsoft ended support for Windows 10 one year ago today, on October 14, 2025. If every machine in your business moved to Windows 11 before then, you can skip this one.
For everyone else, and I'd guess there are more of you than last fall's news coverage suggested, the useful question now is which of your remaining machines matter. After that, it's what each option really costs a year after the deadline.
What end of support means
It doesn't mean the machines stopped working. That is why the problem lingers. Nothing visible happened on the day, and the computers booted the next morning like any other.
What it means is that Microsoft no longer releases security updates for Windows 10. New vulnerabilities (security flaws attackers can use) keep being found in Windows 10, as they are in any operating system, and since that date they don't get fixed. The gap gets wider every month the machine stays in service.
That is the whole risk. It often gets blown up into panic or waved away, so I want to say it plainly. Nothing happens on a set date. The machine just becomes an easier target, month by month, for attacks that already work.
Extended Security Updates, one year in
Microsoft offered Extended Security Updates (ESU) as a paid option for organizations that couldn't move in time. It was always meant to be temporary. For businesses it runs for up to three years, and the price doubles each year you renew. The consumer version covered one year and ended yesterday, October 13, 2026.
If your business bought ESU last year, I'd use this month to confirm exactly what you bought and when it ends. Then check what renewing will cost. If any office machines were enrolled through the consumer option, they stopped getting updates yesterday.
The businesses that treated ESU as a fix instead of a delay are the ones most likely to be surprised, because year two costs twice what year one did. If you didn't buy it at all, those machines have gone a full year without security updates.
What your cyber insurer cares about
This is the reason I'd deal with it even if the security argument hasn't moved you.
Cyber insurance applications ask, in one form or another, whether you run supported and patched systems. It has been a standard question for years. Nobody expects an underwriter to audit you at renewal, but your coverage is written against the answers on that form, and a claim is when someone reads them carefully.
The awkward case is the business that answered honestly last year based on a plan to upgrade, and then the plan slipped. Now the form says one thing and the environment says another. If that's you, my advice is to find out your real position before the next renewal.
Our walkthrough of what a cyber insurance application is really asking covers how these questions get read.
Deciding which machines to deal with first
Not every remaining Windows 10 machine is equally urgent. I'd sort them into two groups, which usually takes about an hour.
The first group is the machines people use every day for email and the internet. These are the ones I'd do first, because they're the ones a phishing message reaches. If the budget only covers part of the fleet, it covers these.
Within that group, I'd check each machine before assuming it needs replacing. A good share of Windows 10 hardware can run Windows 11, which needs a TPM 2.0 security chip and a supported processor (roughly Intel 8th generation or AMD Ryzen 2000 series and newer). Some businesses decided a year ago that they had to replace everything, and some of them decided too quickly. The difference between an upgrade and a replacement is most of the cost.
The second group is machines attached to something that can't move. That includes the computer that drives a piece of equipment or talks to one instrument, and the terminal running software whose vendor never certified anything newer. These are the hard cases, and buying a new computer usually doesn't solve them.
For that group, I'd usually isolate the machine on the network instead of replacing it. Take it off general network access and remove email and web browsing. Then restrict what can reach it and what it can reach, and treat it as a piece of equipment. That's a legitimate long-term position, and it costs far less than replacing a machine tool because the computer attached to it is old.
The budget conversation, one year on
The case for moving is easier to make now. At this point, most of the cost comes from the age of the hardware underneath the operating system.
Machines that were already several years old at the deadline are now a year older. They fail more often, and they slow people down every day in ways nobody reports. They will need replacing regardless of the support question. A planned refresh over a couple of budget cycles, set out in a technology roadmap, costs less and disrupts less than a replacement the week one dies in your busiest month.
If you're planning next year's spending, put this on the list with real numbers beside it. Our Q4 planning checklist covers the wider version of that exercise.
What to do this week
Get a list of every machine you own, with its operating system and its age.
Most businesses can't produce it, and that's a finding on its own. You can't decide which machines to keep, upgrade, isolate, or replace without knowing what you have. In my experience, a missing list is usually why a deadline like this one slid in the first place.
That inventory is the first thing we produce in an assessment, and you keep it whatever you decide next. If it turns out you have four machines left and two can be upgraded in place, that's a much smaller problem than the one you've been putting off. If you'd like to talk it through first, book a free 15-minute call.