Windows 10 lost support on 14 October 2025. That was ten months ago, and if your business is still running it, here is the uncomfortable part: nothing has broken. The machines boot, the software opens, the invoices go out. Which is exactly why a Windows 10 upgrade keeps sliding down the list.

Deferring a Windows 10 upgrade feels costless because nothing switches off. Nothing switching off is not the same as nothing changing. What changed that day is that Microsoft stopped fixing Windows 10’s security flaws. Attackers and researchers have kept finding new ones every month since, and every one of them stays open permanently. Ten months of unpatched flaws have accumulated on those machines, and the pile only grows.

What a Windows 10 upgrade actually protects you from now

Since October 2025 there have been no security fixes, no quality updates, no feature updates, and no technical support for Windows 10, which Microsoft set out plainly in its end of support notice.

The risk a Windows 10 upgrade removes is not that something dramatic happens on a particular Tuesday. It is that unsupported machines become the easiest way in. The UK’s National Cyber Security Center notes that flaws in obsolete products stay exploitable indefinitely, often by attackers with fairly limited skill, because the vulnerability is public and the fix never arrives. Running supported, updated software sits on CISA’s short list of basic steps every business should take.

Attackers actively scan for this. An unpatched Windows 10 machine is not a needle in a haystack; it announces itself.

What ten months of drift looks like in practice

The businesses still on Windows 10 in August 2026 are rarely the ones who never heard about it. They are the ones where a Windows 10 upgrade ran into something specific and then stopped.

Around League City and Webster, the same handful of blockers come up. A contractor has field laptops that are rugged, expensive, and five years old, too old for Windows 11, too costly to bin. An engineering firm runs a CAD or plant-monitoring package the vendor has not certified on Windows 11, so IT will not touch it. An accounting practice has one machine tied to a piece of tax software with an annual cycle, and nobody wants to move it in the middle of a filing season. A clinic has a workstation attached to a diagnostic device where the manufacturer controls the whole stack.

None of those are laziness. They are real constraints, and they share a feature: each affects a small number of machines, not the whole fleet. That matters, because it means most businesses do not need a Windows 10 upgrade project. They need to clear the eighty percent that upgrades cleanly, then deal with the awkward remainder deliberately rather than letting it hold up everything else.

The three paths, and what each one really costs

A Windows 10 upgrade is not one decision. There are three options, and most businesses end up using all three across different machines.

• Upgrade to Windows 11. The Windows 10 upgrade is free if the hardware qualifies, and it keeps your files and applications in place. This is the right answer for any machine that can take it. The blocker is hardware: Windows 11 requires a supported processor, TPM 2.0, and Secure Boot, and the system requirements rule out a lot of otherwise healthy machines.
• Extended Security Updates. Microsoft will sell you continued security patches for machines that cannot move yet. For businesses it is $61 per device for the first year, and the price doubles each year for up to three years, roughly $427 per device across the full run. ESU buys time and nothing else: security patches only, no new features, no real support.
• Replace the machine. Where a Windows 10 upgrade is not possible at all, a new PC that ships with Windows 11 usually costs less than three years of escalating ESU fees plus the maintenance an aging machine quietly consumes.

Two things about that pricing are worth sitting with. The doubling is the important part. ESU is designed to be uncomfortable in year two and painful in year three, precisely so it does not become the plan. And the annual tier steps up each October, so a decision made in autumn costs materially more than the same decision made before it.

Run the Windows 10 upgrade arithmetic per machine rather than across the fleet. A device that needs two more years of ESU is competing against the price of a new laptop, and often losing.

Working out which machines can take a Windows 10 upgrade

This is the step that unblocks everything else, and it is mostly mechanical.

• List every machine still needing a Windows 10 upgrade. Including the ones nobody thinks about: the reception PC, the machine in the workshop, the laptop the owner uses at home, the terminal wired to a piece of equipment.
• Check eligibility. Microsoft’s free PC Health Check app answers this per device, and your IT provider can do it across the fleet in a single pass rather than machine by machine.
• Upgrade everything that qualifies. It is free, it preserves files and applications, and it is the largest single reduction in risk available to you.
• Sort the remainder into two piles. Machines worth keeping on ESU for a defined period, and machines to replace. Put a date against each rather than leaving them as “later.”

If a machine is blocked by software rather than hardware, that is a vendor conversation, not an IT one. Ask the software vendor directly for their Windows 11 support position and a date. A surprising number have quietly certified since 2025 and never told anyone.

We covered the upgrade path itself, covering hardware requirements, the migration, and what to expect, in our guide to upgrading business PCs to Windows 11. Once machines land on the new version, a handful of Windows 11 settings worth changing recover most of the friction people complain about after a migration.

The compliance and insurance bill nobody budgets for

This is the part that turns a Windows 10 upgrade from an IT preference into a board-level decision.

Delay a Windows 10 upgrade long enough and it stops being a technical question. If you handle card payments, health records, or client financial data, frameworks like PCI DSS and HIPAA expect supported, patched software. Windows 10 no longer qualifies. For accounting practices and financial advisers the FTC Safeguards Rule carries similar expectations, and an unsupported operating system is difficult to defend in an assessment.

Cyber insurance is the sharper edge. Renewal questionnaires increasingly ask whether your systems are supported and patched, and the answer is attested by you. Running unsupported Windows can raise your premium, narrow your coverage, or hand the insurer an argument at claim time, which is the moment it matters most. Answering that question accurately is much easier when the honest answer is yes.

There is a slower cost too. Browsers, accounting packages, and line-of-business tools progressively drop support for Windows 10. The applications you depend on stop updating, then eventually stop working, usually without much warning.

The machines you retire are a second problem

Every Windows 10 upgrade produces a pile of replaced hardware, and that pile gets handled far more casually than the machines still in service. The old PC goes in a cupboard, or to a member of staff for home use, or to whoever collects electronics.

Those drives still hold everything the machine ever touched. Client files, cached credentials, saved browser passwords, email archives, scans of documents somebody meant to delete. A machine retired during a Windows 10 upgrade is often the oldest device you own, which means it holds the longest history.

Deleting files does not remove them, and neither does a standard Windows reset in every case. Drives need proper wiping or physical destruction, and if the device held regulated data you want a record that it happened. That record is the part people skip, and it is the part an assessor or an insurer asks for. We went through how to handle this properly in our guide to secure IT asset disposition for small businesses.

Build it into the plan rather than treating it as tidying up afterwards. A retired machine sitting in a cupboard for two years is a breach waiting for someone to notice it is there.

A 30-day plan that does not need a project

You do not need to fix everything at once. You do need the drift to stop.

• Week one: inventory. Every machine, its Windows version, whether it needs a Windows 10 upgrade, and whether it passes the Windows 11 check.
• Week two: upgrade everything eligible. This is usually the bulk of the fleet and it is free.
• Week three: decide the remainder machine by machine. ESU with an end date, or replacement with a purchase date. Write both dates down.
• Week four: chase the vendors blocking the awkward machines, and confirm your patching is actually running on everything that moved.

For machines heading for replacement, spreading the cost through hardware as a service is often easier to approve than a capital purchase, and it puts the refresh on a schedule so the same problem does not arrive again in five years.

Frequently Asked Questions

It is ten months later and nothing has happened. Is this actually urgent? Nothing visible happens on a fixed date, which is what makes it easy to defer. What has happened is that ten months of security flaws have been found and left permanently unfixed on those machines. The risk accumulates quietly rather than arriving in one event.

How much does Windows 10 ESU cost a business now? $61 per device for the first year, doubling annually for up to three years, roughly $427 per device across the full period. The tier steps up each October, so the same decision costs more the longer it waits.

Can I still upgrade to Windows 11 for free? Yes, if the hardware qualifies. The free Windows 10 upgrade path has no deadline attached to it. The constraint is the processor, TPM 2.0, and Secure Boot requirement, not a cutoff date.

One machine runs software that will not work on Windows 11. What now? Isolate rather than ignore. Keep that machine on ESU, restrict what it can reach on the network, and put a date on resolving it. Then ask the software vendor directly for their Windows 11 position, because many have certified since 2025 without announcing it.

Will our cyber insurance actually check whether we did the Windows 10 upgrade? They ask, and you attest. Whether they verify at renewal varies; they certainly look at claim time. An inaccurate answer on a questionnaire is a worse problem than an old operating system.

A Windows 10 upgrade is unusual in that most of the work is free and the hard part is just knowing which machines are which. If you are not certain what is still running Windows 10 across your business, or which of those can move today, start with a straightforward look at where your Windows 10 estate actually stands.

Featured Image Credit: Unsplash