Still Running Windows 10? A Year Past End-of-Support, Here’s What That Really Means

Microsoft ended mainstream support for Windows 10 on October 14, 2025. A year later, a surprising share of small and mid-market businesses are still running it — some on purpose, some by inertia, and some because the replacement decision turned out to be harder than it looked. In 2027, the risk, cost, and compliance picture has evolved enough to be worth a fresh look.

What End-of-Support Actually Ended

Three things stopped happening on October 14, 2025:

• Routine security updates for Windows 10 Home, Pro, Enterprise, and Education editions.
• Technical support from Microsoft for Windows 10 installations outside of the Extended Security Updates (ESU) program.
• Non-security fixes, feature updates, or driver-level support from Microsoft.

Three things did not stop:

• Windows 10 continuing to run. Devices did not brick, go dark, or lose functionality on the EOS date.
• Microsoft 365 apps on Windows 10 — though support policies have tightened and compatibility risk is rising.
• Third-party antivirus, EDR, and management tooling in most cases, though vendors are quietly moving minimums forward.

The practical effect of EOS is cumulative, not immediate. A year on, that cumulative effect is now large enough to be measurable.

The Real-World Risk Profile a Year On

Running a mainstream OS past EOS is a known-vulnerable posture that gets measurably worse every month. In the twelve months since Windows 10 EOS:

• Multiple critical and high-severity vulnerabilities have been patched in Windows 11 and Server variants that Windows 10 shares. Non-ESU Windows 10 devices did not receive those patches.
• Several of those vulnerabilities have been observed under active exploitation, including at least one that fed widespread ransomware activity targeting mid-market businesses.
• Cyber insurance underwriters have hardened their posture. Most now require either Windows 11 or active ESU coverage for any Windows endpoint in scope, and are increasingly asking for proof.
• Compliance frameworks have followed. HIPAA, PCI DSS, CMMC, and state privacy regulators all treat unsupported operating systems as a material control gap.
• Vendor minimums have shifted. Several major business applications — EHR platforms, line-of-business ERPs, and remote-access tools — have officially dropped Windows 10 support or flagged it as end-of-life in their own documentation.

An unsupported endpoint is not an unusable endpoint — it is an endpoint that your insurer, your auditors, your regulators, and your clients increasingly treat as a liability. That is a different and often more immediate problem than the raw technical risk.

The Microsoft ESU Program — What’s Changed

Microsoft’s Extended Security Updates program is still an option, and for the first time, business editions can enroll multi-year with pricing that is at least knowable. In broad strokes:

• ESU is available on a per-device basis for a defined number of years past EOS, with pricing escalating each additional year.
• Business ESU is distinct from consumer ESU, with different purchasing paths and management requirements.
• ESU delivers security updates only — not feature updates, non-security fixes, or expanded support.
• Enrollment requires devices to be fully patched to the final supported Windows 10 build before ESU updates can land.
• ESU is a bridge, not a destination. Microsoft has signaled no intention to extend Windows 10 support indefinitely.

For an SMB, ESU makes sense in three narrow situations: devices that are physically impossible to replace in the near term (ruggedized tablets in the field, embedded industrial controllers, specialized medical hardware), a short runway while a planned refresh is in flight, and a specific application dependency that genuinely cannot be moved. For everything else, ESU is usually more expensive than replacement over any reasonable horizon.

Why Some Devices Can’t Just Upgrade to Windows 11

If Windows 11 would install on every Windows 10 machine, the migration conversation would be mostly over. It won’t. Windows 11 enforces hardware requirements that eliminate a meaningful share of the installed base:

• TPM 2.0. Devices without a TPM 2.0 chip or firmware equivalent are not supported.
• CPU generation. Only Intel 8th-gen or newer, AMD Ryzen 2000+ series or newer, and specific Qualcomm Snapdragon lines are officially supported.
• Secure Boot. Required and must be enabled.
• UEFI firmware. Legacy BIOS-mode devices are out.
• Memory and storage minimums that look modest but exclude the older end of the fleet.

Microsoft has held the line on these requirements. The “unofficial” registry bypasses to install Windows 11 on unsupported hardware exist, but they explicitly disclaim driver and update support, don’t survive feature upgrades reliably, and are not a defensible posture in a regulated or insured environment.

The Replace-or-Upgrade Decision

For most SMBs, the right lens is total cost of ownership over a three-year horizon, including the hidden costs of running unsupported endpoints.

• Hardware that supports Windows 11: upgrade in place, in a planned wave, with user communication and backup. Low-cost, high-value.
• Hardware that doesn’t support Windows 11 but is otherwise healthy: ESU is often the wrong answer. A refurbished or new business-class laptop at modest cost beats two years of ESU plus the compliance exposure in nearly every scenario we model.
• Hardware with specific application dependencies: isolate the device on a segmented network, apply full compensating controls (strict allow-listing, no email, no web browsing, no removable media), and ESU it for the shortest possible bridge window while you plan the migration of the application itself.
• Hardware older than five years regardless of OS compatibility: plan replacement on reliability grounds alone. The battery, SSD, and warranty economics usually point the same direction as the OS economics.

A 90-Day Plan

If you’re reading this with Windows 10 still in production, a defensible three-month plan looks like this:

1. Days 1–15 — Inventory. Build an authoritative list of every Windows 10 device, with user, role, hardware model, Windows 11 eligibility, and criticality.
2. Days 16–30 — Classify. Mark each device as upgrade-in-place, replace, or ESU-bridge-with-reason.
3. Days 31–60 — Execute the upgrade-in-place wave. Communicate, back up, upgrade, verify. Most eligible devices should move in this window.
4. Days 61–90 — Begin the replacement wave. Procure and provision replacements for the ineligible fleet, in priority order of risk and user impact.
5. Throughout: enroll any remaining Windows 10 devices that must linger in ESU, document the compensating controls, and set a hard retirement date.

Bottom Line

A year past Windows 10 end-of-support, the technical risk is real and growing, the compliance and insurance posture has hardened, and the ESU program is a short bridge rather than a long-term plan. For most SMBs, the right move is a disciplined three-month plan that upgrades what’s eligible, replaces what isn’t, and uses ESU only where a specific constraint demands it. The organizations that complete that work this quarter will be out of the risk window. The ones that keep deferring it will keep paying for the deferral in insurance premiums, audit findings, and — eventually — incidents.

Brightworks IT helps clients inventory, classify, upgrade, and replace Windows endpoints at scale. Get in touch for a Windows 10 migration assessment.