A land surveying firm in Moncton has 20 workstations. In the fall of 2026, nine of them still run Windows 10. They work fine: the drafting software opens, the wide-format printer responds, nobody complains.
That's the problem. Since October 14, 2025, Microsoft no longer releases security updates for Windows 10, except for devices enrolled in a paid program. Nothing changes on screen, but every month new flaws get patched in supported versions of Windows, and some of them affect Windows 10 too. On a device that isn't covered, they stay open.
A year after end of support, here's where the options stand for a small business, and how to choose without wasting your budget.
TL;DR
- Windows 10 support ended on October 14, 2025: without an ESU subscription, a device gets no more security updates.
- For businesses, ESU costs US$61 per device for year one; the price doubles every year, for a maximum of three years, and years are cumulative.
- The consumer ESU program isn't allowed for commercial use.
- ESU buys time, not a solution: use it to plan your move to Windows 11.
What end of support actually changes
Since October 14, 2025, Microsoft no longer provides technical support, new features or quality updates for Windows 10, and that includes security fixes. Devices keep running; they just age without protection.
The risk grows over time. Every patch released for Windows 11 gets studied by attackers looking for the same flaw in Windows 10. An uncovered device becomes a known way in, the kind of entry point ransomware uses to get a foothold in a network.
The side effects matter too. Vendors of accounting software, drivers and antivirus products are dropping Windows 10 support one by one. Microsoft 365 Apps still get security fixes on Windows 10 until October 10, 2028, but no new features after Version 2608, and Microsoft support will ask you to move to Windows 11 for any issue that only occurs on Windows 10. And cyber insurance questionnaires often ask whether you run systems that are no longer supported.
ESU for businesses: pricing and conditions
The Extended Security Updates (ESU) program delivers critical and important security updates to enrolled Windows 10 devices for up to three years after end of support, which takes you to October 2028.
| ESU year | Period | List price per device (Microsoft) |
|---|---|---|
| Year 1 | 2025–2026 | US$61 |
| Year 2 | 2026–2027 | US$122 (price doubles every year) |
| Year 3 | 2027–2028 | US$244 |
The years are cumulative: a business that enrols during year two also has to pay for year one. Enrolling during year two therefore costs US$183 per device at list price, before taxes and reseller margin, and you'll need to renew in the fall of 2027 to get year three.
Other conditions to know:
- Version 22H2 is required, with the prerequisite updates Microsoft lists.
- Sold through volume licensing, with a minimum of one licence; you can't buy part of a year.
- Activated device by device with a Multiple Activation Key (MAK), repeated for each year of coverage.
- Security only: no new features and no general technical support.
- LTSC editions are excluded: they follow their own lifecycles, which often matters for shop-floor PCs.
- Included at no extra cost for Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop, and for Windows 10 devices connecting to a Windows 365 Cloud PC.
The consumer ESU program (free with settings sync, or US$30) runs until October 12, 2027, but Microsoft specifies that it can't be used in commercial scenarios.
Option by option: what to do with each device
| Device situation | Preferred option | Keep in mind |
|---|---|---|
| Windows 11 compatible | Upgrade through Windows Update | Test line-of-business software and peripherals first |
| Not compatible (no TPM 2.0, unsupported processor) | Replace | ESU only if replacement can't happen quickly |
| Line-of-business app not certified for Windows 11 | ESU, with a written plan from the vendor | Demand a compatibility date, or switch software |
| PC running a machine or device | Network isolation, ESU or an LTSC edition | No email or web browsing on that PC |
| Light or temporary use | Windows 365 Cloud PC | ESU is included for the Windows 10 device that connects to it |
Windows 11 requires, among other things, a compatible 64-bit processor, 4 GB of memory, 64 GB of storage, UEFI firmware with Secure Boot and a TPM 2.0 chip. Microsoft's free PC Health Check app tells you whether a device qualifies.
Plan the migration in five steps
- Take inventory. How many devices run Windows 10, which version, which ones are compatible? Your management console or IT provider can produce that list in a day.
- Check your software. Accounting, line-of-business apps, printer drivers, card readers: ask each vendor in writing whether they support Windows 11.
- Budget for replacements. Incompatible devices tend to be the oldest, which makes this a good time to revisit your refresh cycle. Our article on small business cybersecurity budgets helps you prioritize.
- Migrate in waves. A pilot group first, then everyone else, with a verified backup before each wave.
- Dispose of old devices properly. Securely wipe or destroy the drives: they contain personal information.
If you keep some Windows 10 devices anyway
Sometimes there's no other short-term option. A Windows 10 device you keep should be treated as a documented exception under your patch management policy.
- ESU licence activated and verified on the device (
slmgr /dlvshows the ESU licence status) - Monthly updates actually installed, confirmed in the console
- No admin rights for the user
- No email or web browsing if the device isn't covered by ESU
- Device isolated on a separate network segment where possible
- Antivirus or EDR up to date and monitored
- A retirement date set and approved by leadership
- The situation disclosed accurately on your cyber insurance questionnaire
The bottom line
Windows 10 end of support isn't a dramatic emergency. It's a debt that grows every month. ESU is a reasonable answer for a few devices for a few months. For a whole fleet, it's a cost that doubles every year without solving the problem.
If your fleet mixes Windows 10, Windows 11 and a few machines nobody knows the age of, our remediation and hardening service can handle the inventory, the migration and the secure configuration of new devices.
Frequently asked questions
Will our Windows 10 computers stop working?+
No. They start up and run as before. But since October 14, 2025, Microsoft no longer provides security updates, quality fixes or technical support for Windows 10, except for devices enrolled in the paid Extended Security Updates (ESU) program. Every flaw discovered since then stays open on devices that aren't covered.
Can a small business use the US$30 consumer ESU program?+
No. Microsoft states that the consumer ESU program can't be used in commercial scenarios, and it isn't offered for devices joined to Active Directory or Microsoft Entra, or enrolled in mobile device management (MDM). Businesses need the commercial ESU program, sold through volume licensing.
Does upgrading to Windows 11 cost anything?+
For a compatible PC with a valid Windows 10 licence, the upgrade is delivered through Windows Update at no additional licence cost. The real costs are elsewhere: preparation and testing time, and above all replacing machines that don't meet Windows 11's hardware requirements, such as TPM 2.0.
Do Microsoft 365 apps still get updates on Windows 10?+
For now. Microsoft provides security updates for Microsoft 365 Apps on Windows 10 until October 10, 2028, but new features stop at Version 2608. That protects Word and Outlook, not the operating system itself.
Sources
- 1.Microsoft Learn: Extended Security Updates (ESU) program for Windows 10
- 2.Microsoft Learn: Enable Windows 10 Extended Security Updates (ESU)
- 3.Microsoft: Windows 10 Consumer Extended Security Updates (ESU) program
- 4.Microsoft Learn: Windows 10 end of support and Microsoft 365 Apps
- 5.Microsoft: Windows 11 specifications and system requirements
- 6.Microsoft Learn: Windows 10 Enterprise and Education lifecycle