Guide · Business IT

Windows 10 after October 2026: what a small business should do

A year ago Windows 10 reached the end of free support, and many businesses bought a year of paid security updates to buy time. That year ended on 13 October 2026. The same day Microsoft fixed a Windows flaw that was already being used in attacks. If there is still a Windows 10 PC in your office, here is what it is now missing, what each option costs, and the order to tackle it in.

By Elliot · Published 26 October 2026 · 9 min read

Where things stand

Paid business updates for Windows 10 are now in year two, to 12 October 2027, at double the price.
Joining now means paying for year one as well. Each PC must be activated every year.
The cheap consumer extension is not allowed on business PCs.
Upgrading eligible PCs to Windows 11 is free, and usually the right answer.

What changed

Year one of paid updates is over

Microsoft stopped supporting Windows 10 for free on 14 October 2025. For businesses that were not ready to move, it sold Extended Security Updates: a licence per PC, one year at a time, for up to three years. Year one ran from 15 October 2025 to 13 October 2026. Year two has now started, and Microsoft's rule is that the price doubles each year.

The timing is pointed. Microsoft's final year-one update, on 13 October, fixed a Windows Shell flaw that attackers were already using, and the US cyber agency CISA added it to its list of exploited flaws the same day. A business PC whose licence covered only year one will not receive the fixes Microsoft ships from November. Home PCs are on a different timetable: Microsoft quietly extended its consumer scheme to 12 October 2027 in June.

The options for a Windows 10 PC, from Microsoft's published terms
Option	Cost	Covered until
Business Extended Security Updates	$61 a PC for year one, doubling each year; late joiners pay for earlier years too	Year two to 12 Oct 2027, year three to 10 Oct 2028
Through Windows 365 or Azure Virtual Desktop	Included with the cloud PC subscription	Up to October 2028
Consumer Extended Security Updates	Free with Windows Backup sync, 1,000 Rewards points, or about $30	12 Oct 2027, and not allowed for business use
Free upgrade to Windows 11	Free on eligible PCs	Supported
Replace the PC	The price of a new PC	Supported
Do nothing	Nothing now	No Windows security fixes for a business PC without a licence

The numbers

Fewer Windows 10 PCs, but not few enough

StatCounter for UK usage, Microsoft and the NCSC for the rest.

15%

of UK desktop Windows web traffic still came from Windows 10 in September 2026

Source: StatCounter

$61

per PC for business updates in year one, with the price doubling every year

Source: Microsoft

14 days

to apply high-risk security fixes under the Cyber Essentials requirements

Source: NCSC

StatCounter's figure has fallen fast, from about 26% in January 2026 to about 15% in September, and it measures web traffic rather than machines. Small businesses tend to hang on to older PCs longest, because they work and there is no IT team nagging about them; we found no reliable UK figure for small firms on their own, so we have not invented one.

The pricing explains why year two is the moment to decide. Microsoft sells the years as separate licences and does not let a business skip one, so a PC joining now pays for year one and year two together. By year three, three years of updates for one old PC cost more than many replacement laptops.

What still works

What a Windows 10 PC keeps, and what it loses

The answers that most often surprise people, from Microsoft's and the NCSC's own pages.

The PC itself keeps working

Nothing switches off. A Windows 10 PC without Extended Security Updates starts, runs and connects as before. What stops is Microsoft fixing security holes in Windows, which is the part attackers rely on businesses forgetting.

Microsoft 365 apps until October 2028

Word, Excel and Outlook from Microsoft 365 keep getting security updates on Windows 10 until 10 October 2028, with no ESU needed, but no new features. Office 2016 and 2019 on Windows 10 are listed as unsupported.

Defender and Edge until at least 2028

Microsoft Defender's virus definitions continue through October 2028, and Edge gets updates on Windows 10 until at least October 2028. Neither patches holes in Windows itself, so they are a seatbelt, not a fix.

The £30 option is for homes only

Microsoft's consumer scheme is cheap or free, but its terms say it cannot be used commercially, and it is not offered at all on PCs joined to a work domain, to Microsoft Entra, or managed by device management. A business PC needs the business scheme.

Cyber Essentials needs supported software

The current Cyber Essentials requirements say software must be licensed and supported, with high-risk fixes applied within 14 days. On our reading, Windows 10 with an active ESU licence meets that, and Windows 10 without one does not unless it is cut off from the internet.

There is already an exploited flaw

Microsoft's 13 October update fixed CVE-2026-96951, a Windows Shell flaw that was already being used in attacks and that affects Windows 10. CISA added it to its exploited list the same day. A Windows 10 PC without updates stays open to it.

What to do

Sorting out the office, PC by PC

The first two steps take a few minutes per machine and decide the rest. Most small offices end up upgrading most PCs for free and replacing one or two.

Find out what each PC is running

On each PC open Settings, System, About, or press Windows+R and type winver. Windows 11 needs nothing more. On Windows 10, note the version (it should be 22H2) and the build: 19045.7807 or higher means the October fix is installed.

Check which PCs can take Windows 11

Run Microsoft's free PC Health Check app. Windows 11 needs a supported processor, 4 GB of memory, 64 GB of storage, Secure Boot and TPM 2.0. If it passes, the upgrade is free and can be rolled back within ten days. For most small businesses this is the cheapest answer by far.

Price the PCs that cannot upgrade

For a PC that fails, compare a replacement with three years of business ESU. Year one was $61 a device and the price doubles each year, and a business joining now must also buy year one, so a year-two start already costs around three times the first year. A new PC often wins on anything older than about five years.

If you buy ESU, activate it on every PC

Business ESU is bought through Microsoft volume licensing or a Microsoft partner, and the key appears in the Microsoft 365 admin centre. Buying it does nothing on its own: each PC needs the key installing and activating for that year. Whoever does it can confirm with slmgr.vbs /dlv, which should list the ESU year as Licensed.

Retire old PCs properly

Before a PC leaves the business, follow the NCSC's guidance on wiping storage. A factory reset of a BitLocker-encrypted drive destroys its keys; solid-state drives are hard to wipe completely, so destroying the drive is the safe choice for anything that held customer or financial data.

Write down the end date

Whatever you choose, put the date it stops in the diary: 12 October 2027 for ESU year two, 10 October 2028 for year three and for Microsoft 365 apps on Windows 10. Most of the trouble with old systems comes from nobody noticing the date passing.

Claims to ignore

Five things you may have read that are wrong

“Consumer updates ended on 13 October 2026.” They were extended to 12 October 2027 in June, with an editor's note rather than an announcement, which is why older articles still give the earlier date. “Office stops working.” Microsoft 365 apps get security updates on Windows 10 until October 2028. “Buying the licence is enough.” Every PC has to be activated, every year.

“Your insurance is void.” We found brokers and IT firms saying an insurer could use outdated software against a claim, but no insurer's or industry body's wording that says so; read your own policy's security conditions. “Year two costs £X.” Microsoft publishes US dollar prices and a doubling rule, not sterling prices, so any pound figure is a reseller's.

One thing we could not confirm: the certification body IASME has not published, that we could read, a statement on how Windows 10 with ESU is treated at a Cyber Essentials assessment. Our reading comes from the requirements document itself. If certification matters to your contracts, ask your assessor before you decide.

FAQ

Windows 10 questions, answered

Does Windows 10 still get security updates after October 2026?

Only with Extended Security Updates. Free support for Windows 10 ended on 14 October 2025. Year one of the paid business scheme covered updates to 13 October 2026; year two runs to 12 October 2027 and year three to 10 October 2028. The consumer scheme for home PCs was extended in June 2026 and now ends on 12 October 2027.

How much does Windows 10 Extended Security Updates cost for a business?

Microsoft priced business ESU at $61 per device for the first year and says the price doubles each year, which makes year two $122 and year three $244 by that rule. Businesses joining late must also pay for the years they missed. Organisations managing PCs through Intune or Windows Autopatch were offered a lower first-year price, and Windows 365 cloud PCs include ESU. Microsoft does not publish a sterling price.

Can a small business use the £30 consumer Windows 10 extension?

No. Microsoft's consumer Extended Security Updates terms say the scheme cannot be used in commercial scenarios, and it is not offered on PCs joined to a work domain or Microsoft Entra, enrolled in device management, or running in kiosk mode. A business PC needs the commercial scheme, bought through volume licensing or a Microsoft partner.

Will Microsoft Office stop working on Windows 10?

No. Microsoft 365 apps keep receiving security updates on Windows 10 until 10 October 2028, though without new features. Office 2016 and 2019 on Windows 10 are listed as not supported, and Office 2021 and 2024 as supported with exceptions.

Does a Windows 10 PC fail Cyber Essentials?

The Cyber Essentials requirements say in-scope software must be licensed and supported, meaning the vendor is still providing security fixes and has published an end date. Windows 10 covered by an active Extended Security Updates licence meets that on our reading; Windows 10 without one does not, unless the PC is moved into a sub-set with no internet access. Check with your certification body before your assessment.

Is it safe to keep using Windows 10 without updates?

It gets less safe every month. Microsoft's October 2026 update fixed CVE-2026-96951, a Windows Shell flaw affecting Windows 10 that was already being exploited, and a PC without updates stays open to that and to every later flaw. The NCSC's guidance on obsolete products says the only fully effective fix is to stop using them.

How many UK computers still run Windows 10?

StatCounter measured Windows 10 at about 15% of UK desktop Windows page views in September 2026, against about 84% for Windows 11, down from about 26% for Windows 10 in January 2026. That counts web traffic rather than devices, and we found no reliable UK figure for small businesses specifically.

References