Windows 10 Support Has Ended: ESU, Windows 11 Migration or New Hardware?

14 October 2025 was the long-announced date that still caught many businesses unprepared: free security updates for Windows 10 ended that day. The system keeps running — it boots, applications open, nothing looks "broken". That is precisely the danger: every vulnerability discovered from now on stays permanently open on unpatched Windows 10 machines. This article lays out the three realistic options for estates that still contain Windows 10, and the order in which to decide.

Why "It Still Works" Is Not Enough

An out-of-support operating system is like a car whose insurance has lapsed: no difference until the accident. Attackers know end-of-support dates as well as anyone, and the unpatched vulnerabilities accumulating on old systems are ransomware operators' favourite entry point. There is also a compliance dimension: running an OS that cannot receive updates on computers that process personal data is an increasingly difficult position to defend under data-protection rules on technical safeguards — and in regulated sectors it hardens into an audit finding.

Option 1: ESU — Buying Time

Microsoft's Extended Security Updates programme delivers critical security patches for a fee for a few more years. For businesses it is licensed per device per year, and the price roughly doubles each year — by design: ESU is not a destination, it is extra time purchased to finish the migration.

• What it provides: security patches only. No new features, no performance work, no general support.
• Who it fits: machines pinned to a legacy application, devices already scheduled for replacement within the year, estates that need a few more months to complete the migration.
• The trap: recording ESU as "problem solved". It is not solved; it is postponed, and the postponement gets pricier every year.

Option 2: the Windows 11 Upgrade

Licence-wise the upgrade is free; the obstacle is hardware. Windows 11 requires the TPM 2.0 security chip and relatively recent processor generations. The practical rule: most business PCs bought in 2018 or later qualify, older ones mostly do not — but the basis is a scan, not a guess; compatibility is reported per device.

Even on compatible devices, migration is not "click update". The healthy sequence: verify each device's backup first, confirm Windows 11 support for the business applications in use (accounting, ERP, e-signature, sector tools), live with a pilot group for a week or two, then move the remaining estate in waves during off-hours. As device count grows, the waves need central tooling rather than hand-holding — this is where device-management and patch-management platforms earn their place.

Option 3: Hardware Refresh

For devices with no TPM, unsupported processors, or simply at the end of their economic life, forcing Windows 11 is the wrong investment; the right move is planned replacement. The decision looks beyond compatibility to the device's age, fault history and the user's role: the machine where accounting closes the books and the warehouse barcode station do not share the same urgency. Standardising new purchases on Windows 11 Pro with TPM enabled prevents a rerun of this same problem in five years.

The Decision Matrix

Device situation	Recommended path	Timing
Win11-compatible, recent device	Direct Windows 11 upgrade	Now, with pilot + waves
Compatible but critical software unverified	Application testing first, then upgrade	Within weeks
Incompatible, device under 5 years old	Protect with ESU, budget the replacement	Planned swap within the ESU window
Incompatible and ageing	Hardware refresh	First budget cycle
Machine locked to legacy software	ESU + network isolation + vendor migration plan	Until software support clarifies

The Forgotten Fronts

The machines most often missed in migration plans are the ones on nobody's desk: the meeting-room PC, the camera recording station, the shop-floor machine, the mini PC behind the till. They belong in the inventory — to an attacker, a desktop and a shop-floor PC are the same thing. And note that Windows 10 was not alone on that date: Office 2016 and 2019 fell out of support at the same time, and merging the two migrations into one project is usually the economical route.

Planning This Migration with Yamanlar Bilişim

Our first step is always the same: a full compatibility-and-age inventory of the estate — which device can upgrade, which needs ESU, which should be replaced, all visible in one table. Migration waves are scheduled off-hours, critical business software is verified in the pilot, and ESU licensing plus new-device procurement run through a single hand. For maintenance-agreement customers this inventory is already current — the decision meeting takes minutes, not hours, because the table is ready.

FAQ