Get off Windows 10 on your schedule

Windows 10 reached end of support on 14 October 2025. The operating system keeps booting, your applications keep running, and nothing on the screen changes. What stops is the flow of monthly security updates that fixes newly discovered vulnerabilities in the kernel, the network stack, the browser engine and everything else attackers target. Each month that passes, the gap between a patched machine and an unpatched one widens permanently. This is not a cliff, it is an erosion, and it is the reason so many businesses drift into a bad position without ever making a decision.

What that means in practice

The practical risks are concrete rather than theoretical. Unpatched machines fail cyber insurance questionnaires and can complicate a claim. They fail client and vendor security reviews. For anyone handling protected health information or financial data, running an unsupported OS is difficult to defend as reasonable safeguarding. And as third-party vendors align with Microsoft's lifecycle, browsers, EDR agents, VPN clients and line-of-business applications gradually stop certifying against Windows 10 too, so the practical breakage arrives long after Microsoft's date.

• Security updates for new vulnerabilities are no longer delivered on the consumer track
• Cyber insurance and client security questionnaires increasingly ask about it directly
• Third-party software support for Windows 10 declines steadily after the deadline
• Machines that cannot upgrade in place still have several useful years as a different kind of asset

Extended Security Updates and LTSC, without the marketing

There are paid ways to keep receiving security fixes for a period. Microsoft offers Extended Security Updates for Windows 10, structured differently for consumers and for organizations, with organizational coverage available in annual increments for a limited number of years and a price that typically escalates each year by design. ESU delivers security patches only. No features, no new functionality, and no general technical support. It is a bridge, priced to make sure you cross it rather than camp on it.

LTSC is the other thing people ask about, usually after reading a forum post. Windows 10 Enterprise LTSC and IoT Enterprise LTSC are separate, specially licensed editions with much longer support windows, aimed at fixed-function devices such as medical imaging consoles, kiosks, industrial controllers and point-of-sale terminals. They are not a general-purpose escape hatch for office PCs, they do not include the Store or Edge in the usual way, and licensing them requires the right agreement. Where a client genuinely has fixed-function hardware whose vendor certifies only Windows 10, LTSC is a legitimate answer. For thirty desktops running Office, it is not.

So the real work is inventory and triage. Every machine falls into one of three buckets. Bucket one: eligible for an in-place upgrade to Windows 11, meaning it has TPM 2.0 available, Secure Boot capable UEFI firmware and a supported processor generation. A surprising number of machines land here after simply enabling firmware TPM and Secure Boot in BIOS, because both shipped disabled from the factory. Bucket two: capable hardware in every practical sense but on the wrong side of the processor support list. Bucket three: genuinely old, and due for replacement anyway on age and drive health alone. Our free Windows 11 readiness checker gives you a first pass in a couple of minutes, and our Windows 11 support page covers what happens next.

Bucket three machines are also an opportunity. A 2018 desktop with 8GB of RAM and a spinning disk feels dead, but an SSD upgrade and a memory bump can make it a perfectly good machine for a role that does not need Windows 11, a shop-floor terminal on an isolated VLAN, a signage PC, a spare. Where a machine truly is retiring, it should leave properly, with the drive wiped or destroyed to a documented standard rather than dropped in a dumpster. That is covered on our recycling and data destruction page.

Sequencing is the part clients value most. We phase migration by department and by risk: anything touching regulated data or facing the internet moves first, general office machines follow in waves timed around your quiet periods, and the awkward stragglers with old peripherals or a vendor-locked application get individual attention. Each wave gets an application compatibility check, a driver check against the manufacturer's Windows 11 catalog, and a rollback plan. Done this way it is a series of quiet Tuesdays rather than a project everyone remembers for the wrong reasons.