- Microsoft stopped all security patches for Windows 10 on 14 October 2025; every CVE found after that date is permanently open on unpatched machines
- Around 28% of Windows machines in the UK and 26% in the Netherlands were still on Windows 10 in early 2026
- Windows 11 requires TPM 2.0, which is the most common blocker for machines from 2016–2018; check BIOS before assuming replacement is needed
- Extended Security Updates (ESU) are available at cost and buy up to three years of patches, but are not a substitute for migration
- Cyber Essentials, ISO 27001 Annex A.8.8, and NIS2 Article 21 all require supported, patched operating systems
What end of life means in practice
End of life does not mean Windows 10 stops working. It means Microsoft stops fixing it. Patch Tuesday updates ceased on 14 October 2025. Any vulnerability discovered after that date, whether a zero-day exploited by ransomware groups or a disclosed CVE published in the National Vulnerability Database, stays open on Windows 10 machines indefinitely. No patch will come.
The comparison with Windows 7 end of life in January 2020 is instructive. Within months, exploit activity targeting unpatched Windows 7 machines rose sharply. Threat actors maintain lists of end-of-life operating systems precisely because the attack surface is known, permanent, and grows with every new CVE disclosure.
Beyond security, Windows 10 progressively loses third-party support. Software vendors update their compatibility matrices when a new version ships. Applications will continue to work in the short term, but vendor-supported configurations, driver updates for new hardware, and browser security improvements will stop being available on Windows 10 over the next one to two years.
The scale of the problem
Statcounter data from early 2026 puts Windows 10's share of Windows machines at approximately 28% in the UK and 26% in the Netherlands. For a 100-machine business estate, that is 26–28 devices that have had no security patches for over six months.
The concentration is higher in businesses that bought hardware in 2017–2019, either because those machines do not meet Windows 11's hardware requirements or because no migration was planned when Windows 11 released in 2021. Many organisations only discovered the problem when Cyber Essentials assessors or ISO 27001 auditors flagged it.
Your three options
Option 1: Upgrade in place (free)
If the machine meets Windows 11 hardware requirements, the upgrade is free through Windows Update or the Windows 11 Installation Assistant. The process takes 45–90 minutes, preserves existing applications and files, and requires no licence purchase. For machines that qualify, this is the lowest-friction path.
The common blocker is TPM 2.0. Windows 11 requires a Trusted Platform Module at version 2.0. Many machines from 2016–2018 shipped with TPM 1.2 or with TPM 2.0 present but disabled in BIOS settings. Before deciding a machine cannot be upgraded, check the BIOS firmware settings. A TPM 2.0 chip that is disabled can be enabled in minutes and makes the machine eligible for a free upgrade. Run the Microsoft PC Health Check application on each device to confirm its eligibility status before planning anything else.
Option 2: Replace hardware
Machines that fail compatibility checks after BIOS inspection are candidates for replacement. A laptop on a 4–5 year refresh cycle would normally be due for replacement around this period anyway. The Windows 10 deadline accelerates a hardware refresh that was already on the horizon.
If replacing, standardise on a hardware specification. Consistent hardware reduces support complexity and makes imaging, deployment, and troubleshooting faster. Document the minimum spec for new purchases going forward so procurement decisions do not recreate the same problem in four years.
Option 3: Extended Security Updates (ESU)
Microsoft sells extended security patches for Windows 10 at £25–45 per device in year one, rising in years two and three. ESU is available until October 2028 through volume licensing agreements or, for Microsoft 365 Business Premium subscribers, at no additional cost for the first year.
ESU keeps machines patched against disclosed vulnerabilities, but does not restore feature updates, driver support for new hardware, or compatibility with future software releases. It is a bridge while planning and executing migration, not a permanent alternative. If your plan is ESU now and migration later, set the migration deadline before the ESU period expires.
Cyber Essentials requires that operating systems are supported and receive security updates from the vendor. Microsoft's published guidance states that ESU provides security updates, but assessors differ on whether ESU-covered machines count as fully supported. Consult your certifying body before relying on ESU as your compliance posture for Cyber Essentials assessments.
Auditing your estate
Before planning any migration, you need an accurate inventory of every device, its OS version, and its Windows 11 compatibility status.
If your organisation uses Microsoft Intune, run a device compliance report filtered by OS version. Intune can also run PC Health Check results at scale through a compliance policy. If you use another RMM platform, generate an OS inventory report from the management console. Where you have no remote management tooling, the Microsoft PC Health Check application can be run locally on each machine.
Export results to a spreadsheet and group devices into three categories: eligible for in-place upgrade, requires hardware replacement, and covered by ESU pending replacement. Create a prioritised remediation order: admin accounts and machines accessing finance systems, privileged data, or VPN-connected resources first.
Windows 11 hardware requirements
Compliance implications
Cyber Essentials requires that all software receives security updates from its vendor and is covered by a supported version. Windows 10 after October 2025 does not receive security updates. Any Cyber Essentials assessment will flag Windows 10 machines in scope as non-compliant with the patching and software requirements.
ISO 27001:2022, Annex A.8.8 (Management of Technical Vulnerabilities) requires that organisations identify vulnerabilities in their information assets and address them within a defined timescale. An operating system that permanently accumulates unpatched CVEs is a documented technical vulnerability that an auditor will require a written remediation plan for.
NIS2 (EU, Article 21) requires essential and important entities to maintain their systems in a secure state, including applying patches and updates. Dutch entities supervised by the NCSC-NL are expected to operate on supported software stacks. Unpatched, unsupported operating systems on in-scope systems are a control failure that supervising authorities will document.
Windows 10 did not become insecure on 14 October 2025. It stopped getting fixed.