The first year of Microsoft’s paid Extended Security Updates (ESU) for Windows 10 ended on 13 October 2026. A business PC still running Windows 10 now receives security fixes only if its organisation has bought Year Two, which Microsoft prices at double Year One and sells cumulatively. Without it, the device is unsupported: it fails Cyber Essentials, and it is the same class of weakness the ICO cited when it fined South Staffordshire in May. For a regulated firm, the remaining Windows 10 estate is now a decision the board should be able to see, not a line in an IT backlog.
Windows 10 reached end of support on 14 October 2025. Extended Security Updates is Microsoft’s paid programme that continues to deliver critical and important security updates, and nothing else, to enrolled Windows 10 version 22H2 devices for up to three years after that date.
What changed on 13 October 2026?
The first annual ESU term closed. Microsoft’s ESU documentation states that commercial ESU is purchased by year, that partial periods cannot be bought, that the price doubles every consecutive year for a maximum of three years, and that ESU is cumulative: an organisation that enrols in Year Two must pay for Year One too.
In practice that leaves three groups of Windows 10 devices in a business estate this month:
- Devices covered by Year Two. These continue to receive security updates until the second term ends in October 2027.
- Devices that had Year One but not Year Two. These stopped receiving security updates this week.
- Devices that never had ESU. These have received no security updates for a year.
The second and third groups are unsupported software in the plain sense. Microsoft’s consumer programme, which has its own terms and dates for individuals’ personal devices, is not a substitute for a managed approach to a business estate.
Why does this matter for Cyber Essentials?
Because unsupported software is one of the clearest ways to fail. Cyber Essentials requires in-scope software to be licensed and supported, and from 27 April 2026, under version 3.3 of the requirements, failing to install high-risk or critical security updates within 14 days of release is an automatic fail. Our March article on the v3.3 changes explains the new questions.
A Windows 10 device with no current ESU receives no security updates at all, so it cannot meet that requirement. A device with current ESU coverage continues to receive critical and important updates; in our reading that allows it to remain in scope while covered, but certification bodies make the final call, and firms should confirm the position before assessment rather than discover it during one.
What has the regulator said about unsupported software?
It has said it plainly, and recently. On 11 May 2026 the ICO announced a fine of £963,900 against South Staffordshire Plc and South Staffordshire Water Plc after the personal data of 633,887 people was extracted and published. Among the four failings it identified was the “use of obsolete, unsupported software on some devices”, including Windows Server 2003, alongside inadequate monitoring and unpatched critical systems.
The regulator has since changed its form: on 30 September 2026 the Information Commissioner’s Office became the Information Commission under the Data (Use and Access) Act 2025, and it continues to use the ICO name. Its expectations on security have not changed. UK GDPR Article 32 requires appropriate technical measures, and running software that no longer receives security fixes is difficult to describe as appropriate for a firm handling client, patient or financial data.
What are the realistic options?
There are five, and most firms will use more than one.
- Upgrade in place. Devices that meet Windows 11’s hardware requirements can be upgraded, typically through the firm’s existing management tooling. This is usually the cheapest route per device.
- Replace. Devices that cannot run Windows 11 need replacing. If replacement is the plan, Year Two ESU may still be the right bridge for a defined number of months.
- Buy Year Two ESU, with an exit date. Appropriate for a small, known set of devices with a dated replacement plan. Not appropriate as a default for the whole estate, given the cumulative pricing.
- Move to Windows 365. Microsoft states that ESU is included at no extra cost for Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop, and that Windows 10 devices connecting to Windows 365 Cloud PCs are entitled to ESU for up to three years with an active subscription. For some firms this is a sound bridge; for others it adds cost without solving the hardware question.
- Isolate the exception. Where a specialist application, often in clinical or laboratory settings, genuinely requires Windows 10, the device can be segregated from the rest of the network and taken out of the certified scope, with the decision documented.
Enterprise architecture is the discipline of deciding which of those options belongs where, across the whole estate, so that each device has an owner, a route and a date. Without that, firms tend to buy ESU for everything and replace nothing.
Is Windows 10 the only end-of-life risk?
No. It is simply the largest and most visible. The same review should list every other operating system, server and application in use and its support end date, because one of the South Staffordshire failings was a server operating system, Windows Server 2003, whose support ended in 2015. A lifecycle register is a list of every significant system with its vendor support end date and the plan for each; it turns end-of-life from a surprise into a budget line.
What to do this quarter
- Count every Windows 10 device and record which of the three groups above it falls into.
- Remove or isolate any Windows 10 device without current ESU coverage.
- For every device kept on Year Two ESU, record a replacement or upgrade date before October 2027.
- Confirm with your Cyber Essentials certification body how ESU-covered devices will be treated at your next assessment.
- Build a lifecycle register covering servers, network devices and key applications, not only desktops.
- Report the remaining Windows 10 exposure, and its cost, to the board.
How Rhentech helps
Our managed IT and cybersecurity service runs device lifecycles as a matter of routine, so that end-of-support dates are planned rather than met. Our enterprise architecture work sets the estate-wide plan, choosing between upgrade, replacement, cloud desktops and isolation, and a cybersecurity audit finds the unsupported systems that are not on anyone’s list. Our May article on the hidden cost of fragmented IT vendors explains why estates with many suppliers are often where these devices hide.
If Windows 10 devices remain in your estate after this month, book a free initial consultation and we will help you decide what to do with each of them.
Frequently asked questions
Do Windows 10 business PCs still get security updates after October 2026?
Only if they are enrolled in Microsoft’s paid Extended Security Updates programme for the current year. Commercial ESU is sold in annual terms for up to three years after Windows 10 support ended on 14 October 2025, and Year One closed on 13 October 2026.
How is Windows 10 ESU priced for businesses?
Microsoft states that the price doubles every consecutive year, for a maximum of three years, and that ESU is cumulative: an organisation joining in Year Two must also pay for Year One. ESU is included at no extra cost for Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop.
Can a Windows 10 device pass Cyber Essentials?
Cyber Essentials requires software in scope to be supported and to receive security updates within 14 days of release. A Windows 10 device without current ESU coverage receives no security updates and cannot meet that requirement. A device with current ESU coverage still receives critical and important updates; confirm its treatment with your certification body before assessment.
What are the alternatives to buying another year of ESU?
Upgrading eligible devices to Windows 11, replacing devices that cannot run it, moving users to Windows 365 Cloud PCs, or isolating a device that must stay on Windows 10 for a specific application and taking it out of the certified scope. Most firms use a combination.
Sources
- Microsoft, Extended Security Updates (ESU) program for Windows 10, Microsoft Learn, updated 17 November 2025.
- Microsoft, Windows 10 Enterprise and Education lifecycle, Microsoft Learn.
- ICO, Fine of nearly £1m issued against South Staffordshire Plc and South Staffordshire Water Plc, 11 May 2026.
- DSIT, Data (Use and Access) Act 2025: plans for commencement, GOV.UK, updated 12 October 2026.
- IASME, Important Update: Changes to Cyber Essentials for April 2026, 12 February 2026.
Reviewed 20 October 2026.