Windows 10 Is Out of Support: What to Do With the Machines You Still Have

The deadline everyone planned around has been and gone. What is left is the awkward middle: machines still running Windows 10, still working perfectly well, and now approaching the point where the safety net expires too.

What actually changed, and what did not

Nothing broke on 14 October 2025. That is why this has been easy to defer. The machines carried on, the applications carried on, and for a while it genuinely did not matter.

What stopped was security updates. Every vulnerability discovered since then remains open on an unpatched Windows 10 machine, permanently. Attackers pay close attention to end-of-life operating systems precisely because they know the fixes are not coming.

The compliance problem

This is the part that tends to force the decision.

Running unsupported software on an in-scope device is a Cyber Essentials failure. Not a caution — a failure. If you certify, and you have Windows 10 machines without ESU in scope, you will not pass.

Cyber insurers also ask about operating system currency at underwriting and at renewal. An answer that involves unsupported systems affects your terms, and potentially a claim.

The three options, honestly

Upgrade the machine to Windows 11

Free, if the hardware qualifies. The blockers are usually TPM 2.0 and the processor generation, and they are not negotiable in any supported way.

The first thing worth doing is finding out how many of your machines could upgrade. Businesses frequently discover the number is far higher than assumed — often because an earlier audit was done on the oldest machines and the result was applied to everything.

Buy Extended Security Updates

ESU buys time, not a solution. Microsoft’s pricing escalates deliberately: roughly £60 per device for the first year, about £120 for the second, around £240 for the third. You cannot skip years — joining in year two means paying for year one too.

Across three years that is roughly £420 per device to keep a machine that will still be out of support at the end of it. For a handful of devices tied to specific hardware or an application that will not move, it is a legitimate bridge. As a strategy for a whole estate, the arithmetic argues against it.

Replace the machine

For a machine that cannot take Windows 11, this is usually the cheapest option once ESU is counted. A device that fails the Windows 11 check is generally old enough that its remaining life is short anyway.

How to decide, in an afternoon

Produce a list of every Windows 10 machine with its age, whether it passes the Windows 11 readiness check, and what it is actually used for. Then sort into three piles.

Upgrade now — passes the check and is in good order. This is free and should happen first, because it shrinks the problem before you spend anything.

Replace — fails the check and is doing ordinary work. Budget for it, phase it if you need to, but do not spend escalating ESU fees on a machine you will replace anyway.

ESU, deliberately — fails the check but is tied to a machine tool, a lab instrument, or an application the supplier has not updated. Small in number, and worth isolating on the network as well as licensing.

If the answer is “we will look at it later”

That was a defensible position last autumn. It is less defensible now that consumer ESU expires next month, each additional year of business ESU costs double the last, and the compliance consequences are concrete rather than theoretical.

The good news is that the work is mostly administrative. Most businesses find the majority of their estate can upgrade in place, at no cost, once somebody actually checks.

If you would like that audit run across your machines, it is quick, and the answer is usually less alarming than people expect.

ESU pricing is Microsoft’s, and is indicative — confirm current figures before budgeting.