Managed IT · 5 min read
Windows 10 ESU year one ends 13 October 2026: your options
Windows 10 left mainstream support in October 2025. For businesses paying for Extended Security Updates, the first year ends on 13 October 2026. Here is how to decide what to do next.
· Bhargava Group
Windows 10 reached end of support on 14 October 2025. Since then, the only way to keep receiving security updates for it has been Microsoft’s Extended Security Updates (ESU) program. For commercial customers, year one of ESU ends on 13 October 2026, so every business still running Windows 10 has a decision to make this month.
What ESU costs, and why waiting costs more
Microsoft’s published commercial pricing is US$61 per device for year one, and the price doubles each year after that (US$122 for year two and US$244 for year three). Local pricing through Canadian resellers varies.
Two details catch people out:
- Coverage is cumulative. If you skip year one and join in year two, you pay for year one as well. There is no discount for arriving late.
- ESU is a bridge, not a destination. The program runs for a maximum of three years. It delivers security fixes only, with no new features and no general support.
Your four realistic options
1. Upgrade eligible devices to Windows 11. Devices that meet the hardware requirements (TPM 2.0, a supported processor, Secure Boot) can usually be upgraded in place. This is the cheapest path, and with Intune or another management tool it can be scheduled and tracked centrally.
2. Replace devices that cannot upgrade. Older hardware often costs more to keep secure than to replace. Replacement also brings modern security features, such as virtualization-based security and Windows Hello, that Windows 11 relies on.
3. Buy year two of ESU for a short, documented list. Some machines run line-of-business or shop-floor software that is not yet certified on Windows 11. Buy ESU for those, record why, and set a retirement date.
4. Move specialist workloads to the cloud. Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop receive ESU at no additional cost, which can be a practical home for a legacy application while it is modernised.
What not to do
Running unpatched Windows 10 on devices that handle email, browsing or customer data is the one option we would not recommend. It is the kind of exposure that cyber insurers and auditors now ask about directly.
A two-week plan
- Pull a device inventory with OS version and hardware eligibility.
- Tag every Windows 10 device as upgrade, replace or exception.
- Schedule upgrades in waves, starting with IT and pilot users.
- Buy ESU only for the documented exceptions, each with a retirement date.
Our Managed IT & Cybersecurity practice can run the inventory and the upgrade waves for you, and keep the exception list honest after 13 October.