Windows 10 ESU Ends October 2026: Your Real Options

If your business is still running Windows 10, you have already used up the grace period. Free support ended on 14 October 2025, and the first year of paid Extended Security Updates (ESU) runs out on 13 October 2026 — a little over three months from now.

That date matters more than the 2025 one did. Last year, most firms shrugged, paid for ESU (or did nothing), and carried on. This October, the price doubles, the risk compounds, and the excuses get thinner — for your insurer, your auditor, and your clients.

Here is where things actually stand, and what we would do in your position.

The Short Version

You have three options for every Windows 10 machine in the business:

Pay for another year of ESU — roughly double last year’s price, per device
Upgrade to Windows 11 — free, if the hardware qualifies
Replace the machine — the right answer more often than people expect

There is no fourth option. Running Windows 10 without ESU after October 2026 means unpatched vulnerabilities on machines that hold your email, your files, and your clients’ data. The government’s latest breach figures show attackers do not need an invitation — an unpatched operating system is one.

What ESU Actually Costs Now

Microsoft’s business ESU pricing was designed to push you off Windows 10, and it works like a ratchet:

Year 1 (Oct 2025 – Oct 2026): around £60 per device
Year 2 (Oct 2026 – Oct 2027): around £120 per device
Year 3 (Oct 2027 – Oct 2028): around £240 per device, and then it ends for good

So a 20-person firm clinging to Windows 10 through Year 2 pays roughly £2,400 for one more year of patches — on machines that are, by definition, at least five years old. That is not an investment. That is rent on a problem.

One nuance worth knowing: Microsoft extended consumer ESU in some regions, which generated a lot of confused headlines. For business devices, the schedule above is the one that matters. Do not plan around a consumer concession.

Will Your Machines Run Windows 11?

Most business laptops and desktops bought from 2019 onwards meet Windows 11’s requirements (8th-gen Intel or equivalent, TPM 2.0, Secure Boot). If your kit qualifies, the upgrade is free and — done properly — a non-event for staff.

“Done properly” is doing some work in that sentence. A fleet upgrade should include:

A compatibility audit before anything is touched (five minutes per machine, saves days of pain)
Verified backups, so a failed upgrade is an inconvenience rather than an incident
Staggered rollout — never everyone on the same morning
A check that your line-of-business software actually runs on Windows 11 (it almost always does; the exceptions are exactly the apps you cannot live without)

This is bread-and-butter work for a managed IT support provider, and for most clients we fold it into the retainer rather than billing it as a project.

When Replacing Is Cheaper Than Keeping

Here is the maths people avoid doing. Take a 2018 laptop that cannot run Windows 11:

Year 2 ESU: ~£120
Slower hardware costing a conservative 15 minutes of productivity a day: £800+ a year at London salaries
Higher failure risk on a 7-year-old battery, drive, and fan: call it £150/year expected cost
A capable business laptop: £450–700, with three years of warranty and native Windows 11

The replacement pays for itself inside twelve months, and you stop paying Microsoft protection money. For small businesses we usually recommend replacing anything that fails the Windows 11 check rather than buying ESU Year 2 — the exception being specialist machines tied to hardware (lab kit, CNC controllers, till systems), which deserve ESU while you plan properly.

The Compliance Angle Nobody Mentions

If you hold Cyber Essentials — or want to — unsupported operating systems are a straightforward fail. The scheme requires supported, patched software, and “we meant to upgrade” has never passed an assessment.

The same logic is spreading through cyber insurance renewals and client due-diligence questionnaires. We have seen suppliers dropped from tenders this year for exactly this. If your firm answers security questionnaires to win work, a Windows 10 estate without ESU is a line item you will have to disclose — and explain.

A Sensible 90-Day Plan

Between now and October:

July — Audit the fleet. Every device, OS version, Windows 11 eligibility, age. (If you cannot produce this list in an afternoon, that is a finding in itself.)

August — Upgrade everything that qualifies, in waves. Order replacements for what does not; lead times on business hardware are fine at the moment but tighten every autumn.

September — Migrate users to new machines, decommission the old ones properly (drive wiping is part of the job, not an optional extra), and buy ESU Year 2 only for the specialist machines you have consciously chosen to keep.

October — Nothing. That is the point.

The Bottom Line

The October 2026 deadline is not really about Microsoft — it is a forcing function for a hardware and security decision you would eventually make anyway. The firms that handle it in July spend less and sleep better than the firms that handle it in a panic in October.

If you would like the audit done for you, book a free 30-minute review — we will tell you exactly which machines can upgrade, which should be replaced, and which genuinely deserve another year of ESU. No drama, just a list.