Windows 10 End of Life: What Your Business Must Do Now

On October 14, 2025, Microsoft formally ended support for Windows 10, the operating system still running on the majority of business desktops at the time. We are now more than six months past that date, and every Windows 10 device that has not been migrated, replaced, or enrolled in Microsoft's paid Extended Security Updates program is operating without security patches. New CVEs disclosed since the cutoff are not being fixed. Attackers know this. The exploitation curve is exactly what you would expect.

If your business is still running Windows 10 in May 2026, this post is for you. Not as a sales pitch, as a clear-eyed status report on what end of life actually means, what it is costing you in risk and compliance terms, and the three realistic migration paths your IT partner should be helping you cost out.

What 'End of Life' Actually Means. End of Life is not Microsoft retiring a logo. It means three concrete things: no more monthly security updates, no more bug fixes, no support if you call them. Software that stops getting patched is not the same software it was the day support ended, every previously private vulnerability that a researcher or attacker discovers from now on is a permanent unfixable hole. Six months in, several wormable Windows vulnerabilities have already shipped exclusively to Windows 11, leaving Windows 10 fleets exposed indefinitely.

The Compliance and Cyber-Insurance Fallout. The harder problem for most businesses is not the malware, it is the paperwork. Most cyber-insurance policies underwritten in the last two years contain language requiring vendor-supported operating systems on all production endpoints. When you renewed your policy you signed an attestation. The day Windows 10 hit EOL, every machine still running it became a potential exclusion clause. We have already seen renewals declined and claims questioned where the only meaningful change between policy term and incident was the fleet drifting onto an unsupported OS. The same logic applies to SOC 2, PCI DSS, HIPAA, and most provincial privacy frameworks: 'unsupported OS' is no longer a footnote, it is a finding. Our cybersecurity services are built around this exact problem, keeping the answer on every audit checklist a clean yes.

Path 1: In-Place Upgrade to Windows 11. If a device meets Windows 11's hardware requirements, TPM 2.0, Secure Boot, supported CPU generation, the cleanest fix is the in-place upgrade. Apps come along, user profiles come along, and modern endpoints handle the upgrade cleanly. The catch is that an audit of any real-world fleet typically finds that 20–40% of machines fail the CPU compatibility check, especially desktops bought before 2019. Those devices need a different plan.

Path 2: Hardware Refresh. For machines that fail the Windows 11 compatibility check, the honest answer is replacement. We know that is not the answer business owners want to hear, but the math usually works out: a five-year-old desktop that would need a CPU and motherboard swap to run Windows 11 has already depreciated past the point where the labour and risk of an upgrade make sense. Roll those replacements into your normal capex cycle, prioritize the highest-risk users (anyone with finance or admin access), and pair the rollout with a switch to a managed IT posture so the new fleet stays patched, encrypted and inventoried automatically.

Path 3: Extended Security Updates (ESU). Microsoft is selling Windows 10 ESU at a per-device fee that doubles each year for up to three years. ESU is a stopgap, not a strategy. It buys you patches but not new features, not Microsoft 365 app support beyond the existing window, and not relief from the compliance language above (insurers and auditors look at vendor-supported, not paid life-support). It is the right answer for a small handful of legacy machines running production-critical line-of-business software that cannot be moved yet, and the wrong answer as a fleet-wide policy.

What to Do This Quarter. The first step is a fleet audit: every endpoint, OS version, hardware compatibility status, and the role of the user it is assigned to. From there a realistic plan looks like: in-place upgrade everything that qualifies, refresh the machines that don't, ESU only the few you genuinely cannot move yet, and document the whole thing for your insurer and any compliance audits. If your IT is currently running on a break-fix model, this is also the natural moment to move to a managed posture, the cost of carrying out the migration in a coordinated rollout is meaningfully lower than running it as a series of one-off panics over the next eighteen months.

The risk window is not closing on its own. Every month you stay on Windows 10 is another month of unpatched CVEs accumulating in your fleet, another month your insurer can point at if you need to file a claim, and another month closer to a vendor or auditor noticing on your behalf. If you would like a no-pressure assessment of what your actual fleet looks like and what the cleanest migration plan would cost, our team has that conversation every day. The sooner the audit, the more options you have.