Windows 10 a year on: what small businesses should do about unsupported PCs

If a PC in your business still runs Windows 10, you are in a grey area. Microsoft ended standard support for Windows 10 on 14 October 2025, so ordinary security fixes stopped. A year on, the question for most small firms is no longer "should we upgrade?" but "what is the cheapest safe way to get every machine sorted, and by when?" This guide sets out what Microsoft says, what the National Cyber Security Centre (NCSC) advises, and a practical plan you can start this week.

What actually happened to Windows 10

Microsoft's support page states that after 14 October 2025 it no longer provides technical assistance, feature updates or security updates for Windows 10. The computers do not stop working. They simply stop receiving the fixes that close newly discovered security holes, and that gap widens every month.

There is also a knock-on effect for software. Microsoft says Office 2016 and 2019 lose support on every operating system. Office 2021 and 2024 keep running on Windows 10 but are no longer supported there, and Microsoft notes that Office 2021 support ends in October 2026. Microsoft 365 Apps continue to receive security updates on Windows 10 for three years after end of support, ending on 10 October 2028. So if you pay for Microsoft 365, your apps stay patched for longer than the operating system underneath them, which is a poor reason to delay.

The paid extension: Extended Security Updates

Microsoft sells a stopgap called Extended Security Updates (ESU). For businesses, its documentation says:

• It is bought through Volume Licensing at $61 USD per device for the first year, and the price doubles each consecutive year, for a maximum of three years.
• It must be bought by the year. You cannot buy six months.
• It is cumulative: if you join in year two, you have to pay for year one as well.
• Devices must be running Windows 10 version 22H2 to qualify.
• It covers security updates only. There are no new features, and technical support is not included beyond problems with the ESU itself.
• Enrolled commercial PCs can receive updates for a maximum of three years after end of support.

Home users get a separate consumer programme, which Microsoft says can keep a device protected until 12 October 2027. The business scheme is different, so check which one applies to you. Prices are quoted in US dollars, so ask your Microsoft reseller for the UK price including VAT.

The doubling price is the key point. ESU is designed to be a bridge, not a destination. If a machine is going to be replaced anyway, paying to patch it for another year can make sense. Paying a second or third year for a PC that could simply be upgraded does not.

Can the PC run Windows 11?

Microsoft says the Windows 11 upgrade is free for Windows 10 PCs running version 22H2 that meet the minimum hardware specification. That specification is:

• A 1 GHz or faster processor with two or more cores, 64-bit.
• 4 GB of RAM.
• 64 GB or more of storage.
• UEFI firmware with Secure Boot.
• A Trusted Platform Module (TPM) version 2.0.

The TPM and processor requirements are what catch older machines out. Microsoft says you can check eligibility under Settings, then Windows Update. Do this on every device, not just a sample. A fifteen-minute check across a ten-person office tells you whether you have a software job or a purchasing job.

What the NCSC says about unsupported software

The NCSC's guidance on obsolete products is blunt. It says all software, including operating systems, will eventually become out of date, and that without updates the likelihood rises that exploitable vulnerabilities become known to attackers. Over time, new vulnerabilities can be exploited by relatively low-skilled attackers. Its position is that the only fully effective way to mitigate the risk is to stop using the obsolete product.

Where you genuinely cannot replace something straight away, the NCSC suggests limiting the damage:

• Keep obsolete devices away from email, web browsing and removable media.
• Treat them as untrusted and separate them from the rest of your network.
• Turn off services you do not need.
• Restrict their access to sensitive data.
• Keep logging and alerting in place, and revisit the decision regularly.

It also points to cloud and software-as-a-service products as a way of moving much of the patching burden to the provider.

A sensible plan for this week

• List every device. Include the till PC in the back, the laptop that only does payroll and the office machine nobody mentions. Record the Windows version and whether it meets the Windows 11 requirements.
• Sort into three piles. Eligible for the free upgrade, too old to upgrade, and cannot be touched yet because specialist software depends on it.
• Upgrade the first pile now. Take a backup first, and test that your accounting package, printers and card terminals still work on one machine before you roll it out.
• Replace the second pile on a schedule. Spread the cost across a few months rather than waiting for a failure. If a machine will be replaced within a year, ESU may be the cheaper bridge.
• Isolate the third pile. Follow the NCSC's advice: no email, no general browsing, separate from the main network, and a firm date for fixing the dependency.
• Check your software versions. Make sure you are not running Office 2016 or 2019, and note the Office 2021 date.

The mood among IT people

Discussion on Hacker News around the end of support has been lively, with threads running to around a hundred comments. Headlines there include a worry that the change could turn millions of PCs into e-waste, and a view that the end of support is uniquely troubling. The mood is concerned rather than angry, and the practical takeaway for a small business is to plan a replacement cycle rather than panic or coast.

What if you get it wrong?

An unpatched PC does not announce itself. It works normally until someone opens a booby-trapped attachment or an exposed service is probed. If that machine holds customer details, a breach brings reporting duties under data protection law and a lot of lost time. The cost of a replacement laptop is usually small next to that.

If your PCs are tied to bespoke software that will not run on Windows 11, that is a bigger conversation. It may be a good moment to look at moving that workflow into a web-based system. Our team can help with cloud and security planning, and with process automation if the old software is mostly doing repetitive jobs.

The short version

Windows 10 is out of standard support, ESU is a costly, time-limited bridge that doubles in price each year, and the free route to Windows 11 only works if the hardware qualifies. Audit your devices, upgrade what you can, replace what you must, and isolate anything you cannot yet touch. A written list and a date for each machine will do more for your security than any single product.