InsightsPlanning Notice

Windows 10 after end of support: what ESU covers and what Cyber Essentials allows

Microsoft stopped supporting Windows 10 on 14 October 2025. If your organisation still runs it, you need a plan for each device that covers both ESU and your Cyber Essentials certificate.

31 January 2025Updated 23 September 20266-minute read

Microsoft ended support for Windows 10 on 14 October 2025. PCs still running it get no security fixes unless they're enrolled in Microsoft's paid Extended Security Updates (ESU) programme.

That matters for Cyber Essentials certification as much as for security. Cyber Essentials only accepts software that's licensed and supported, so every Windows 10 device in scope needs a plan.

Where things stand

14 October 2025: Windows 10 reached end of support. PCs keep working, but they don't get security fixes without ESU.
13 October 2026: year one of business ESU ends, and year two starts the next day. Windows 11 version 24H2 Home and Pro stops getting updates on the same date.
12 October 2027: year two of business ESU ends.
10 October 2028: year three of business ESU ends, and Microsoft doesn't offer a fourth.

What ESU covers

ESU delivers critical and important security updates for Windows 10 devices running version 22H2. It doesn't add features, and it doesn't fix bugs that aren't security issues.

Technical support isn't included either, beyond help with the ESU itself. Microsoft describes ESU as a temporary bridge while you move to a supported version of Windows.

What business ESU costs

Microsoft's published price for organisations is US$61 per device for year one, and the price doubles each year after that. You buy it a year at a time, with no option to buy part of a year.

ESU is cumulative. If you join in year two, you pay for year one as well.

Microsoft quotes the price in US dollars. Ask your licensing provider for a current sterling price before you budget.

Will Windows 10 fail Cyber Essentials?

Cyber Essentials requires all software on in-scope devices to be licensed and supported. IASME's guidance says Windows 10 machines haven't met that requirement since 14 October 2025, and that Cyber Essentials allows ESU as a way to stay compliant.

Enrolment has to be complete on every device you're relying on it for. IASME expects each one to be activated, with its prerequisite updates installed.

ESU patches count towards the 14-day rule like any other security update. Since the April 2026 changes, not installing high-risk or critical updates within 14 days of release is an automatic fail.

Your certificate is assessed at the date it's issued, so devices have to be supported on that day. If you're unsure how a particular device will be treated, check with your Certification Body before you submit.

Windows 11 versions have end dates too

Moving to Windows 11 doesn't settle it for good. Each Windows 11 version gets updates for a fixed period, and a device left on an old version stops getting security fixes.

Windows 11 Home and Pro version 24H2 stops getting updates on 13 October 2026, and the Enterprise and Education editions of 24H2 carry on until 12 October 2027. After those dates, a device still on 24H2 counts as unsupported for Cyber Essentials.

Upgrade, replace, pay for ESU or take it out of scope

Work through your Windows 10 devices one at a time. The right answer depends on the hardware and what each device is used for.

Upgrade it if the hardware meets the Windows 11 requirements, which are listed in the questions below.
Replace it if the hardware can't run Windows 11, and plan replacing devices in batches where you can.
Pay for ESU if a device can't move yet, for example because an application it runs doesn't support Windows 11. Use the time to finish the move.
Take it out of scope if it has to stay on Windows 10 for one job. The requirements allow unsupported software in a defined sub-set that blocks all traffic to and from the internet.

Microsoft recommends upgrading eligible PCs with Windows Autopatch or Microsoft Intune, so start there if you already manage devices through Microsoft 365. Windows 365 Cloud PCs are another route, since they make Windows 11 available on the devices staff already have.

Finding the Windows 10 devices you've got

If your devices are managed in Microsoft Intune, its device list shows the operating system and version of each one. On a single PC, Settings > System > About shows the edition and version.

Check the version as well as the edition, because anything older than 22H2 has to be updated before it can receive ESU. Include laptops that rarely come into the office, since home and remote working devices are in scope for Cyber Essentials.

Migrating to Windows 11 with minimal disruption

A planned upgrade avoids downtime. We run it in stages:

Readiness check: we find which devices can run Windows 11 and plan upgrades or replacements for the rest.
Backup: we take full backups before any changes, so your data can be recovered.
Staged deployment: we roll out upgrades in phases, with testing at each stage, often outside business hours.
Training and support: we train your staff on Windows 11 and support them through the helpdesk after the move.

The risks of staying on Windows 10 without ESU

Open vulnerabilities: attackers look for unpatched systems because the flaws stay open. The 2017 WannaCry attack spread through unpatched Windows systems and disrupted parts of the NHS.
Data protection: UK GDPR expects appropriate technical and organisational measures to protect personal data, and an unpatched operating system is hard to defend.
Software support: vendors are dropping Windows 10, so expect applications that stop updating or stop working.
Insurance: check your cyber insurance policy for conditions about supported software before you rely on it.

Common questions

Is Windows 10 still safe to use in 2026?

Only on devices enrolled in ESU and kept up to date. Without ESU, a Windows 10 PC gets no fixes for flaws found since October 2025.

Can I get Windows 10 ESU for free?

Microsoft includes ESU at no extra cost for Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop. Windows 10 PCs that connect to Windows 365 Cloud PCs are also covered for up to three years while the Windows 365 licence is active.

Microsoft's consumer ESU programme, which runs to 12 October 2027, is for home users. Organisations buy ESU through volume licensing or a Cloud Solution Provider.

Can I still upgrade to Windows 11 for free?

Yes, if the hardware meets the requirements. Microsoft says the upgrade from Windows 10 Home or Pro to the same edition of Windows 11 is free.

Windows 11 needs a compatible 64-bit processor, 4GB of RAM, 64GB of storage and TPM 2.0, on UEFI firmware with Secure Boot. Microsoft's PC Health Check app tells you whether a device qualifies.

Does ESU count as supported for Cyber Essentials?

Yes, according to IASME, as long as each device is enrolled and activated. High-risk and critical ESU updates still have to go on within 14 days of release.