<img alt="" src="https://secure.smart-business-foresight.com/268390.png" style="display:none;">

Skip to Content

CIC Partner Login

Windows 10 support has ended. What October 2026 actually costs you.

Two colleagues working on laptops side by side at a shared office desk

Windows 10 lost free security updates for business on 14 October 2025. Around 21% of Windows devices are still running it, mostly because the hardware can't take Windows 11, not because nobody's got round to it.

The paid Extended Security Updates (ESU) programme costs roughly £60 per device in Year 1, doubling to £120 in Year 2, then £240 in Year 3, roughly £400 total if you run all three. Skip a year and you pay for it retroactively. Microsoft has extended free consumer ESU to October 2027, but that doesn't apply to business devices. For most SMBs stuck on old hardware, replacing it now costs less than paying to stand still.

It's not that businesses haven't upgraded. It's that many can't.

 

Roughly 21% of Windows devices, about one in six, are still running Windows 10 according to Lansweeper's inventory data, and migration has slowed rather than sped up since the October 2025 deadline passed. That's not simply inertia. The devices left behind are disproportionately the ones that fail Windows 11's hardware checks outright, concentrated in healthcare and pharma (23%), retail (23%), manufacturing (18%), and SMBs generally.

Why your Windows 10 device might not be able to upgrade at all

 

This is the bit most coverage skips, and it's usually the actual reason a business is stuck on Windows 10, not choice. Windows 11 requires three things a lot of otherwise perfectly good business PCs simply don't have:


  • TPM 2.0, a security chip that provides a hardware root of trust. Many devices from before around 2016-2017 don't have it at all, or only have the older TPM 1.2.

  • A supported CPU, specifically Intel 8th Generation or newer, or AMD Ryzen 2000-series or newer. This is the one that catches people out: your processor can be fast and perfectly capable, but if it's not on Microsoft's approved list, Windows 11 blocks the upgrade regardless.

  • Secure Boot capable UEFI firmware, rather than the older legacy BIOS still found on many pre-2017 machines.

Put together, that puts the realistic cutoff at roughly 2018, devices bought before then are the ones most likely to fail the check, and no software fix changes that. You can check any device for free with Microsoft's PC Health Check tool. If it fails, ESU or replacement are genuinely your only two options, upgrading isn't on the table.

Windows 10 ESU cost for business: the three-year breakdown

 

Year

Coverage period

Cost per device

Year 1

 15 Oct 2025 to 13 Oct 2026 

 ~£60 

Year 2

 14 Oct 2026 to 12 Oct 2027 

 ~£120

Year 3

 13 Oct 2027 to 10 Oct 2028 

 ~£240 

 

The price doubles every year by design, to push migration rather than reward staying put. Run all three years on one device and you've spent roughly £400 in subscription fees alone, for a machine that still won't be supported once Year 3 ends.

Is ESU free? Not for business, and the consumer picture just changed

 

Microsoft has quietly extended free consumer ESU enrolment to 12 October 2027, a year later than first announced. That's consumer devices only, via account sync, Rewards points, or a one-off $30 fee. It doesn't touch the business pricing above, and UK businesses were never covered by the EU's separate free consumer offer either.

A second Microsoft deadline lands the same month: Secure Boot certificates

 

Separate from ESU, Microsoft's original 2011 Secure Boot certificates have already started expiring, two of the three key dates passed in late June 2026. The third and most relevant, the Windows Production PCA 2011, expires 19 October 2026, days after the ESU Year 1 deadline. Devices won't stop booting, but any that miss the certificate update lose the ability to receive future boot-level security protections, including protection against newly discovered bootkit threats. Worth checking with your IT provider specifically, since ESU spend alone doesn't cover this, and it's a second deadline landing in the same window.

Why this is now a cyber insurance problem, not just an IT one

 

Cyber insurance renewals increasingly ask directly whether devices run supported operating systems, and some insurers decline or quietly exclude unsupported estates at the point that matters least, claim time. Cyber Essentials and similar compliance frameworks lean on the same assumption. Running unpatched Windows 10 doesn't just raise your risk of an incident, it can undermine cover and certifications you already hold.

Which option actually fits

 

Device passes the Windows 11 check? Upgrade. Fastest, cheapest, no ongoing ESU spend.

 

Device fails the check? You're choosing between ESU on ageing hardware or replacing it. A typical five-year-old desktop that fails on TPM alone costs roughly £400 in ESU fees over three years for a machine that's still unsupported at the end of it. A Grade A refurbished replacement runs at roughly half the cost of new, comes with its own warranty, and carries none of that liability. (Illustrative figures, worth sense-checking against real device counts before quoting to a client.)

 

Not sure which is which? Audit first. That's the actual starting point before any of the above.

Book a no-pressure chat