On October 14, 2025, Microsoft stopped releasing free security patches for Windows 10. Many SMBs signed up for the Extended Security Updates (ESU) program to buy time. That first year of reprieve ended on October 13, 2026 — and the bill for year two is twice as high.

The Math Most SMBs Haven't Done

For businesses, ESU is billed per device and the price doubles every year:

  • Year 1 (Oct. 2025 – Oct. 2026): about US$61 per device.
  • Year 2 (Oct. 2026 – Oct. 2027): about US$122 per device.
  • Year 3 (Oct. 2027 – Oct. 2028): about US$244 per device, and that is the last one.

For a 40-device fleet, keeping Windows 10 to the very end means more than US$17,000 in ESU licences alone — with no new features, on hardware that keeps aging. At that price, a large share of those computers could have been replaced.

Three Cases, Three Decisions

In our inventories, remaining Windows 10 devices almost always fall into one of these categories:

  • Windows 11 compatible (TPM 2.0, supported processor) — The upgrade is free. There is no reason to pay for ESU: schedule the migration outside office hours, after backing up the user profile.
  • Incompatible and more than 5 years old — Replacement is almost always cheaper than two years of ESU, especially once you count time lost on a slow machine and hardware failures.
  • Tied to line-of-business software that only runs on Windows 10 — This is the only case where ESU makes sense. Use year two to demand a migration plan from the vendor, or isolate the device on a dedicated network segment.

The Real Risk: Forgotten Devices

The danger is not the director's computer, which everyone knows about. It is the reception PC, the one running a machine on the shop floor, or the old "spare" laptop in a drawer. An unpatched device on your network is an entry point: ransomware primarily exploits known vulnerabilities whose patch was never installed.

Before deciding anything, take a real inventory: every device, its Windows version, its Windows 11 compatibility, and its role. A device management tool like Microsoft Intune does this automatically for enrolled computers.

What We Recommend This Fall

Upgrade everything compatible by year-end, budget the replacement of the rest in your 2027 fiscal year, and only pay for ESU on devices that truly depend on it. Use the opportunity to standardize your models: a uniform fleet is much faster to deploy, repair, and secure.

Our procurement advisors can produce the inventory, compare ESU cost against replacement cost for each device, and plan a migration that does not disrupt your operations.