What happened in October 2025
Microsoft ended mainstream and extended support for Windows 10 on 14 October 2025. Since that date, no further security patches, bug fixes, or feature updates are being released for any edition of Windows 10.
For businesses, this is not an abstract risk. Unpatched operating systems are a primary attack vector — ransomware campaigns routinely scan for known vulnerabilities in unsupported OS versions. Running Windows 10 today is similar to running Windows 7 after its 2020 end-of-life: you're a soft target.
How many UK businesses are still affected?
Industry estimates suggest that by mid-2026, roughly 20–25% of business PCs in the UK are still running Windows 10. The reasons vary:
- Legacy line-of-business software that won't run on Windows 11
- Hardware that doesn't meet Windows 11's TPM 2.0 or Secure Boot requirements
- Delayed procurement cycles or budget constraints
- Simply not having got round to it
If any of these apply to your organisation, this guide is for you.
Your three options
Option 1: Upgrade to Windows 11 (preferred)
Most PCs purchased after 2019 meet the hardware requirements for Windows 11:
- Processor: 1 GHz or faster, 2 or more cores, compatible 64-bit processor
- RAM: 4 GB minimum (8 GB recommended)
- Storage: 64 GB minimum
- TPM: Version 2.0 (often already present but may need enabling in BIOS)
- Secure Boot: Capable (may need enabling in BIOS)
Check compatibility: Run the PC Health Check app from Microsoft. In a managed environment, your IT team can run this across all devices centrally.
If the hardware passes: upgrading from Windows 10 to Windows 11 is a straightforward in-place upgrade. Most organisations complete it without reinstalling applications.
Option 2: Replace incompatible hardware
For older devices that fail the Windows 11 check, the calculus often favours replacement over mitigation:
- A business laptop or desktop in 2026 starts around £350–£600
- Keeping an unpatched device on your network for another 2–3 years costs significantly more in risk exposure and potential incident response
When replacing, consider:
- Standardise on Windows 11 Pro (not Home — you need domain join, BitLocker, and Group Policy)
- Minimum specs: 16 GB RAM, 256 GB SSD, Intel 12th gen or AMD Ryzen 5000 series or newer
- Factor in imaging time: Build a standard image before rolling out to minimise per-device setup
Option 3: Extended Security Updates (ESU) — as a bridge only
Microsoft offers paid Extended Security Updates for Windows 10 at £25–£50 per device per year (pricing varies by volume licensing). ESU provides critical and important security patches only — no new features, no bug fixes beyond security.
ESU is a legitimate short-term bridge if:
- You have a migration plan that genuinely completes within 12 months
- You have specific legacy software dependencies being resolved in that window
- You've formally risk-assessed and accepted the remaining exposure
ESU is not a long-term strategy. It's an expensive sticking plaster.
The hidden costs of doing nothing
Beyond the licensing angle, running unsupported Windows 10 carries:
Cyber insurance implications: Many cyber liability policies include clauses around patching and supported OS versions. A claim arising from an exploit on an unsupported system may be disputed.
GDPR exposure: If personal data is compromised on an unpatched machine, the ICO will scrutinise whether the organisation had taken "appropriate technical measures" — running an OS with known, unfixed vulnerabilities is difficult to defend.
Compliance frameworks: If you're pursuing Cyber Essentials certification (increasingly required for government contracts), running unsupported software will result in an automatic fail.
Productivity drag: Windows 11 brings meaningful improvements to Teams integration, multi-monitor support, and security tooling that reduce friction for staff.
Migration checklist
Before you upgrade or replace:
- Run PC Health Check or equivalent across your estate to identify compatible vs incompatible devices
- Audit which devices hold sensitive data (prioritise these for fastest migration)
- Check application compatibility — test your line-of-business software on a Windows 11 test machine first
- Update BIOS firmware on devices before enabling TPM 2.0 / Secure Boot
- Backup all devices before upgrading
- Plan for a phased rollout: IT → management → general staff
- Update your asset register once migration is complete
- Review and retire ESU agreements once all devices are migrated
How SmartPath IT can help
We've managed Windows 10-to-11 migrations for SMEs across West Yorkshire and across the UK. Our approach:
- Estate audit: We identify every Windows 10 device on your network and flag which are upgrade-ready vs replacement-required
- Compatibility testing: We test your critical applications on Windows 11 before touching production machines
- Managed rollout: Phased migration with minimal disruption — typically 1–2 days for a 20-device office
- BIOS/TPM remediation: We unlock TPM 2.0 and Secure Boot on compatible hardware that just needs configuration
- Post-migration support: We stay on call for 48 hours post-rollout to resolve any application issues
If you're still running Windows 10 on any business devices, schedule a free audit and we'll give you a clear picture of what needs doing and what it'll cost.