Still Running Windows 10? Here's What It's Costing You
There's a specific reason so many small businesses are still running Windows 10 nearly a year after support ended, and it isn't negligence. It's that nothing appeared to break.
Outlook still opens. Excel still works. The machines still boot. Microsoft's deadline came and went in October 2025, and the office kept running exactly as it had the week before. When nothing visibly fails, "we'll deal with it next quarter" becomes the default, and next quarter keeps arriving.
But there's a date coming that will cost you actual money, and it's close: October 13, 2026. That's when Year 1 of the Extended Security Updates program ends and the price doubles.
This article covers what you're actually exposed to right now, what the extension program costs, when your hardware genuinely can't make the jump, and one consequence most business owners haven't connected yet.
What actually ended, and what didn't
Part of the confusion here is that Microsoft's messaging changed after the original announcement, and the current situation is more layered than most explainers suggest.
What ended on October 14, 2025: Security updates for the Windows 10 operating system itself. No more monthly patches for vulnerabilities in the OS, unless you're enrolled in Extended Security Updates.
What didn't end: Microsoft 365 Apps keep working, and Microsoft is continuing to ship security updates for them on Windows 10 through October 10, 2028, delivered through standard update channels. Devices running Microsoft 365 Apps on Windows 10 receive feature updates until Version 2608 is released, then remain on that version receiving security updates only through October 2028. The OneDrive desktop app on Windows 10 22H2 also continues receiving updates through the same date. Microsoft is likewise continuing Security Intelligence Updates for Microsoft Defender Antivirus on Windows 10 through October 2028.
This is exactly why so many businesses believe they're fine. Their Office apps still get updates. Their antivirus definitions still refresh. Nothing on screen says "unsupported."
Here's the problem with that reasoning. Patched applications running on an unpatched operating system don't give you a patched environment. Every OS-level vulnerability disclosed since October 2025 remains open on a non-enrolled Windows 10 machine, and attackers move on newly disclosed vulnerabilities within days. Microsoft's own language on this has been unusually direct — its support guidance warns that Microsoft 365 Apps will keep working on Windows 10 but that you may hit performance and reliability problems over time, since the combination is no longer integration tested.
A secure application on an insecure OS is a good deadbolt on a hollow door.
What Extended Security Updates actually cost
Microsoft's ESU program lets organizations keep receiving critical and important security updates for Windows 10 for up to three years past end of support. It's sold per device, per year, and the pricing structure is deliberately uncomfortable.
Team size Standard ($14) Premium ($22) Annual difference
5 users $840 $1,320 $480
10 users $1,680 $2,640 $960
25 users $4,200 $6,600 $2,400
50 users $8,400 $13,200 $4,800
Three full years of ESU comes to $427 per device. For a 20-machine office, that's roughly $8,500 to keep hardware you already own running software that gets no new features and no technical support.
Two details that catch people out:
The program is cumulative, and you can't skip years. If you didn't enroll in Year 1 and you try to buy Year 2 coverage this October, you generally have to purchase Year 1 retroactively as well — $61 plus $122, or $183 per device minimum, to get current. Confirm the specifics with your licensing partner, because purchasing mechanics vary by channel, but plan on the assumption that waiting doesn't save you the earlier year.
ESU buys patches, not support. The program covers critical and important security updates only. No new features, no non-security fixes, and no technical support unless you hold a separate Microsoft support agreement.
There's also a consumer-facing version of ESU that some very small businesses ended up on, and it matters that it works differently: the consumer path was a single year only. It ends October 13, 2026, and there is no Year 2 or Year 3 for it. If your machines were enrolled that way, your coverage is expiring in weeks with nothing to renew into.
When your hardware genuinely can't upgrade
Sometimes the honest answer is that a machine can't make the jump, and it's worth knowing which category each of your devices falls into before you spend anything.
Windows 11's requirements — TPM 2.0, Secure Boot, UEFI firmware, and a CPU on Microsoft's supported list — left a large number of otherwise usable PCs outside the official upgrade fence. The CPU generation requirement is usually the hard stop. A machine with plenty of RAM and a healthy SSD can still be ineligible purely because its processor predates the supported list.
Three situations worth distinguishing:
Eligible but not upgraded. The machine meets requirements and nobody has run the upgrade. This is the largest category in most small offices, and it costs nothing but scheduling. Run Microsoft's PC Health Check, or check Settings → Update & Security → Windows Update, which will tell you directly whether the device qualifies.
Fixable in firmware. TPM 2.0 is present but disabled in BIOS, or the disk is partitioned as MBR rather than GPT and the system is booting in legacy mode. Both are common, both are correctable, and both make a machine that reported as ineligible suddenly eligible. It's worth having someone check before writing a device off.
Genuinely ineligible. Unsupported CPU generation with no firmware path. Here the decision is ESU versus replacement, and the math usually favors replacement faster than people expect — $427 over three years is a meaningful fraction of a new business-class desktop, and at the end of it you still have the old machine.
A note on the unofficial registry bypasses that let Windows 11 install on unsupported hardware: they exist, they sometimes work, and they're a poor idea in a business environment. Microsoft doesn't guarantee updates on those installs, and "our production fleet runs an unsupported configuration" is not a sentence you want in your environment documentation.
The real reason most businesses are stuck
In our experience, the blocker usually isn't hardware and it isn't budget. It's one application.
A practice management system. A CAD package tied to a dongle. Accounting software from a vendor who went quiet in 2019. A machine controller with a driver that was never updated. Somebody tested it on Windows 11 once, something misbehaved, and the entire migration stopped there.
This is a solvable problem, but it needs to be treated as its own project rather than as a footnote to the OS upgrade:
Name the application and get a written answer from the vendor about Windows 11 support. Many vendors quietly shipped compatible versions and never told existing customers.
If the vendor is gone or unresponsive, the options are usually replacement, running it in a virtual machine, or isolating it. Each has real cost, and the point is to price them rather than defer them.
If the machine must stay on Windows 10, isolate it. Segment it off the main network, remove internet access if the application doesn't need it, restrict which accounts can log into it, and keep it enrolled in ESU. One controlled legacy machine is a manageable risk. A whole fleet on an unsupported OS is not.
That third option — segment and contain one stubborn machine, migrate everything else — is the outcome most small businesses actually need, and almost nobody arrives at it without someone walking the fleet device by device.
The consequence most businesses haven't connected
Here's the part that turns a deferred IT project into a financial exposure.
Cyber insurance applications now ask directly about patch management and unsupported operating systems. If you attested that your systems are patched and supported, and a forensic review after an incident finds unsupported Windows 10 machines on your network, you have a gap between what you told your carrier and what was actually true.
That's the definition of a misrepresentation problem, and material misrepresentation on a cyber application can support denial of a claim or rescission of the policy — coverage voided retroactively, as though it was never issued. Some courts have not required carriers to demonstrate that the misrepresented control caused the specific loss.
So the real cost of staying on Windows 10 isn't $61 a device. It's $61 a device plus the possibility that your cyber policy doesn't respond when you need it.
Running the numbers for your office
Here's the comparison as it typically shapes up. Assume a business-class desktop or laptop at roughly $700–$1,100 depending on specification, and note that eligible machines upgrade to Windows 11 at no licensing cost.
Scenario A — 15 machines, 12 eligible, 3 ineligible Upgrade the 12 in place: no license cost, roughly 1–2 hours of labor each. Replace or ESU the remaining 3. If the 3 are five years old anyway, replace them — three years of ESU on those devices runs about $1,280, against roughly $2,400–$3,300 to replace with hardware that's current and under warranty.
Scenario B — 25 machines, 18 eligible, 7 ineligible, one legacy application Migrate the 18. Replace 6 of the ineligible machines on a staggered schedule across two budget cycles. Keep 1 on Windows 10 with ESU, segmented, running the legacy application. Total ESU exposure drops from roughly $10,700 across the fleet to $427 for one device.
Scenario C — 8 machines, all ineligible, older office This is a replacement conversation, not an ESU conversation. Three years of ESU across 8 devices is about $3,400 with nothing to show at the end. That money is a meaningful down payment on hardware that will still be supported in 2030.
The pattern across all three: ESU is worth buying when it's a scheduled bridge to a specific replacement date. It's worth much less when it's a way to avoid making a decision, because the price is designed to punish exactly that.
What to do in the next ten weeks
Working backward from October 13:
This month — inventory. Get an actual list of every Windows device, its OS version, and its Windows 11 eligibility. Not an estimate. Include the machine in the back office, the one at reception, and any laptop belonging to someone who works remotely. Flag anything on Windows 10 that isn't on version 22H2, since that's a prerequisite for ESU enrollment.
Next month — decide per device. Every machine goes into one of four buckets: upgrade now, replace this cycle, replace next cycle, or stay on Windows 10 with ESU and network segmentation. Write the decision down with a date attached.
Before October 13 — execute the easy majority. Eligible machines get upgraded. This is the bulk of most fleets and it costs licensing nothing.
Before October 13 — sort out ESU for the remainder. Enrollment for anything staying behind, handled before the Year 2 pricing takes effect.
Ongoing — update your insurance answers. If your application says your systems are supported and patched, make sure that's true, or tell your broker what the exceptions are and how they're contained.
Frequently asked questions
Is Windows 10 still safe to use in 2026? Not without Extended Security Updates. The operating system stopped receiving security patches in October 2025, so any OS-level vulnerability disclosed since then remains unaddressed on a non-enrolled machine.
Do my Microsoft 365 apps still work on Windows 10? Yes. Microsoft is providing security updates for Microsoft 365 Apps on Windows 10 through October 10, 2028. But application patches don't protect an unpatched operating system underneath them.
How much does Windows 10 ESU cost for a business? $61 per device for Year 1, $122 for Year 2, and $244 for Year 3 — $427 per device across the full program.
Can I skip Year 1 and just buy Year 2? Generally no. The program is cumulative, so late enrollment typically requires purchasing the earlier year as well. Confirm the specifics with your licensing provider.
My PC says it can't run Windows 11. Is that final? Not always. TPM 2.0 disabled in BIOS and legacy boot mode are common, fixable causes of a false negative. An unsupported CPU generation is the genuine hard stop.
Does upgrading to Windows 11 cost anything for eligible machines? No licensing cost for eligible Windows 10 devices. The cost is the labor to perform and validate the upgrade.
Where this leaves you
The businesses that handle this well share one trait: they know exactly how many machines they have and which bucket each one is in. The businesses that struggle are the ones still guessing, which is most of them, because nobody has walked the fleet.
That inventory is a few hours of work, and it converts a vague deadline into a specific, budgetable decision.
Zien Solutions helps businesses across Washington DC, Northern Virginia, and Maryland inventory their fleets, sort eligible from ineligible hardware, and plan migrations that fit a real budget cycle. If October is starting to feel close, let's talk.
Last updated: Aug 5th, 2026
Sources
Microsoft Learn — Windows 10 end of support and Microsoft 365 Apps: https://learn.microsoft.com/en-us/microsoft-365-apps/end-of-support/windows-10-support
Windows Experience Blog — Stay secure with Windows 11 before support ends for Windows 10: https://blogs.windows.com/windowsexperience/2025/06/24/stay-secure-with-windows-11-copilot-pcs-and-windows-365-before-support-ends-for-windows-10/
Microsoft Learn — Windows 10 Extended Security Updates program documentation and pricing
Microsoft — Windows 11 minimum system requirements and PC Health Check
There's a specific reason so many small businesses are still running Windows 10 nearly a year after support ended, and it isn't negligence. It's that nothing appeared to break.