SMB IT Checklist for 2026: Windows 10 ESU Costs, MFA Session Hijacking and AI Rework

For Windows administrators, IT decision-makers, and business owners, these stories are not isolated headlines. Together, they paint a clear picture of the late-2026 IT landscape: vendors are aggressively penalizing legacy holdouts, attackers are bypassing traditional perimeter and login controls at machine speed, and unmonitored AI tools are creating both governance headaches and hidden rework. Let us break down all nine developments, cross-examine the numbers against primary vendor documentation from Microsoft, CloudSEK, and Templafy, and lay out the exact steps your organization needs to take right now.

1. Windows 10 ESU Enters Year Two: The Price of Standing Still Just Doubled​

If you still have a fleet of Windows 10 workstations humming away under desks or controlling equipment in the corner of a warehouse, the calendar just turned against your budget. Standard support for Windows 10 ended on October 14, 2025, meaning devices without an active Extended Security Updates (ESU) subscription no longer receive critical or important security patches, quality updates, or technical support from Microsoft.

As TeamVK highlights, October 2026 marks the commercial renewal window for Year Two of Windows 10 ESU, and Microsoft’s pricing ladder is deliberately designed to make procrastination painful. According to Microsoft Learn’s official ESU documentation and commercial partner schedules, the cost structure progresses aggressively:

(Note: While $61, $122, and $244 represent the documented US dollar commercial Volume Licensing list progression, actual invoice amounts in local currencies or through specific cloud solution providers may vary based on regional pricing and management discounts.)

Why are so many organizations still paying this toll? Industry telemetry shows the migration tail is stubbornly long. TeamVK points to Statcounter figures showing over a quarter of Windows machines globally still running Windows 10, while a July 2026 analysis cited by Teal and Lansweeper found roughly 17% of overall Windows devices—and 21% of SMB Windows machines—remained on Windows 10. Often, the culprit is a specialized line-of-business application, an aging peripheral, or hardware that fails Windows 11’s strict TPM 2.0 and CPU requirements.

However, IT leaders need to remember what ESU actually buys. According to Microsoft Learn, ESU only covers critical and important security updates as defined by the Microsoft Security Response Center. It does not include new features, customer-requested nonsecurity fixes, design changes, or general Windows technical support (which requires a separate active support plan just to troubleshoot ESU activation or patch regressions).

Are There Any Cloud Exceptions?​

Before you write a hefty check for every remaining Windows 10 instance, check how those workloads are hosted. Microsoft provides ESU at no additional cost for Windows 10 virtual machines running in:

• Windows 365
• Azure Virtual Desktop (AVD)
• Azure Virtual Machines and Azure Dedicated Host
• Azure VMware Solution (including Citrix and Omnissa Horizon on AVD)
• Nutanix Cloud Clusters on Azure
• Azure Local (formerly Azure Stack HCI), Azure Stack Hub, and Azure Stack Edge

Furthermore, physical Windows 10 endpoints used to connect to Windows 365 Cloud PCs are entitled to ESU for up to three years at no extra charge, provided they carry an active Windows 365 subscription license. These exceptions do not apply to standard, standalone on-premises PCs.

Action Plan for Windows 10 Holdouts​

1. Audit your remaining inventory: Pull an immediate report from Microsoft Intune, Active Directory, or your RMM tool to count every remaining Windows 10 device and verify its ESU enrollment status.
2. Assign a hard fate and date to every machine: Every remaining PC should be categorized for an immediate Windows 11 upgrade (if hardware-eligible), hardware replacement, retirement, or cloud migration before the Year Three doubling hits.
3. Isolate the immovable objects: If a legacy machine must stay on Windows 10 to run a proprietary controller or lab instrument, work with your IT provider to segment it on a restricted VLAN, strip away internet and email access, and lock down local privileges.

2. Why Basic Two-Factor Authentication Isn't Enough: Inside the BigBear 2.0 Phishing Service​

For years, the golden rule of small-business cybersecurity advice was simple: turn on two-factor authentication (2FA) or multifactor authentication (MFA), and stolen passwords won't matter. While MFA remains non-negotiable for stopping basic credential stuffing, a newly exposed phishing-as-a-service (PhaaS) platform called BigBear 2.0 demonstrates why traditional SMS codes, one-time passwords (OTPs), and push approvals are no longer a silver bullet.

As reported by Computerworld and highlighted in TeamVK’s briefing, cybersecurity firm CloudSEK gained access to the administrative panel of BigBear 2.0 and uncovered a massive haul of compromised Microsoft 365 credentials across more than 40 countries:

• 5,137 stolen credential records tied to 461 targeted organizations.
• 4,148 captured session cookies and 1,032 plaintext passwords.
• 474 confirmed completed logins where attackers successfully hijacked the authenticated session after the victim completed MFA.
• 151 targeted IT services and managed service providers (MSPs)—the single largest sector represented in the data, prized by attackers because compromising one MSP engineer can unlock dozens of downstream client tenants.

How Adversary-in-the-Middle (AiTM) Proxies Beat Standard MFA​

How does a criminal walk right past a two-factor prompt? BigBear 2.0 does not crack your authenticator code; it lets you type it in for them. Built on the Evilginx2 framework, the service operates as an adversary-in-the-middle (AiTM) reverse proxy sitting between the victim and Microsoft’s genuine Entra ID / Microsoft 365 login servers.

When a user clicks a phishing link, they see a pixel-perfect relay of the real Microsoft sign-in page. The user enters their username, password, and 6-digit MFA code or approves an authenticator push. The proxy relays those credentials to Microsoft in real time. Once Microsoft validates the login and issues an authenticated session cookie, BigBear 2.0 intercepts a copy of that cookie. The victim lands in their inbox as normal, completely unaware that an attacker can now replay that session token in another browser to access their Microsoft 365 account without needing a password or MFA prompt again.

Worse still, CloudSEK found that BigBear 2.0 routes its traffic through country-matched residential proxies so the login appears to come from the victim’s local region, dulling basic geographic Conditional Access rules. The phishing pages also included custom scripts designed to disable FIDO2/WebAuthn options on the proxied login screen, forcing targets downward into weaker, phishable MFA methods.

Moving to Phishing-Resistant Identity and Active Alerting​

Both Microsoft’s 2026 Digital Defense Report and identity security analysts interviewed by Computerworld stress that organizations must shift from protecting only the login prompt to securing the entire session lifecycle:

• Enforce FIDO2 Passkeys and Hardware Security Keys: Unlike SMS or app codes, cryptographic passkeys (such as FIDO2 security keys or Windows Hello for Business) bind authentication to the specific domain URL in the browser. Because a reverse proxy sits on a fake domain, a passkey simply refuses to fire. Make sure Conditional Access policies enforce authentication strength for administrators and finance staff rather than allowing fallback to SMS or push codes.
• Check the AI-Driven Security Alerts You Already Pay For: TeamVK makes a crucial operational point for SMBs: many Microsoft 365 Business Premium or Enterprise E3/E5 tenants already include behavioral anomaly detection capable of spotting impossible travel, unusual token replay, or suspicious inbox rule creation—yet nobody is watching the dashboard. Ask your IT provider or internal team to show you the last few sign-in anomaly alerts generated in your tenant and explain how they were investigated.
• Treat Compromises as Session Hijacks, Not Password Leaks: Changing a user's password alone will not kick out an attacker holding an active session cookie. Responders must explicitly revoke active Entra ID sign-in sessions and refresh tokens, audit OAuth app consents, and check Exchange Online for hidden mail-forwarding rules.

3. The "AI Productivity Tax": Is Generative AI Actually Costing You Time?​

We have all heard the vendor pitch: hand every employee an AI assistant, and watch tedious document drafting vanish in seconds. Yet new research suggests that while generating a first draft is faster than ever, turning that draft into an accurate, usable business document is quietly eating up the clock.

TeamVK points to a October 2026 study by document workflow platform Templafy titled The Business-Ready AI Gap 2026, which surveyed 2,000 knowledge workers across the UK and US who use AI to create business documents at least monthly. Looking closely at both the UK-specific figures cited by TeamVK and the combined US/UK benchmark figures published directly by Templafy reveals a striking pattern of heavy adoption paired with heavy rework:

(Note: The slight variance between the 18% figure in TeamVK’s UK-focused breakdown and the 21% figure in Templafy’s overall summary reflects the difference between the UK subset and the combined 2,000-worker US/UK sample.)

Why Workers Are Spending Hours Fixing AI Output​

Why are roughly one in five knowledge workers losing nearly a full workday every week to what Templafy dubs the "AI productivity tax"? The survey breaks down the exact friction points:

1. Hallucinations and Factual Errors: Fully 40% of respondents say their primary editing burden is verifying and fixing facts, numbers, percentages, and specific claims.
2. Generic "AI Slop" Phrasing: Between 34% (US/UK) and 36% (UK) spend their time stripping out formulaic, robotic wording.
3. Formatting Nightmares: Between 31% (US/UK) and 35% (UK) have to manually fix layouts, fonts, and design structures.

The root cause is a lack of organizational context. Across the survey, 42% of workers reported that their AI tools cannot access approved company content, and 51% of UK respondents admitted they skip official company templates altogether because prompting a raw chatbot feels faster in the moment. As Templafy co-founder Christian Lund notes in the report, this creates a workflow that is "fast to ask, but slow to finish"—and introduces real business risk when roughly a third of workers are using AI to generate external-facing pitch decks, presentations, and formal reports.

How to Close the AI Productivity Gap​

• Measure time to finished output, not first draft: Before renewing expensive AI seat licenses, pick one team and one document type (such as client proposals) and measure the total time spent from initial prompt through human fact-checking and formatting.
• Connect AI to approved templates and data: Interestingly, Templafy’s platform telemetry shows that when organizations move from unguided chat prompts to orchestrated AI agents connected directly to approved corporate knowledge and templates, document creation time across 16,000 observed sessions dropped from 5.6 hours to 27 minutes.
• Mandate human verification on numbers and claims: Establish a strict rule that no AI-generated statistic, pricing table, or contractual claim goes to a client without human sign-off against primary company data.

4. Six More Crucial IT and Cybersecurity Developments SMBs Need on Their Radar​

Beyond the three headline grabbers, TeamVK’s October roundup tracks six additional stories spanning infrastructure vulnerabilities, nation-state targeting, and vendor lock-in. Here is what the evidence shows—along with important primary-source context where industry claims require a closer look.

1. UK Businesses Struggle with Basic Cyber Hygiene​

According to TeamVK’s report on a UK government study, 57% of UK businesses say they are not confident performing at least one of nine basic cybersecurity tasks—such as configuring secure device settings, storing data safely, or enabling automatic updates. That represents roughly 808,000 businesses, up from 49% (around 699,000 firms) previously, with malware handling ranking as the biggest weakness at 38%.

• Verification Note: While TeamVK attributes the 57% confidence metric to a recent UK government study, readers should distinguish this skills-confidence measure from the flagship UK Department for Digital, Culture, Media and Sport (DCMS) Cyber Security Breaches Survey 2026/2027, whose official GOV.UK page notes that Ipsos telephone fieldwork runs from August through December 2026. Regardless of the specific government dataset, the operational takeaway for resource-strapped SMBs is universal: when security is only a fraction of one manager's job, basic patching and anti-malware controls slip first.

2. Sovereign AI and the Risk of Single-Provider Lock-In​

TeamVK reports that a coalition of UK technology leaders sent an open letter to UK AI Minister Kaniska Narayan and Andy Burnham calling for £20 billion over five years in sovereign AI investment, warning that critical services should never depend on a single AI model, vendor, or cloud stack. The roundup also cites a reported incident in June where access to two Anthropic AI models was blocked by the US government for roughly three weeks.

• The Takeaway for IT Leaders: While we treat the uncorroborated details of the June access block and open letter purely as reported by TeamVK, the architectural warning is rock-solid IT practice. If you hardwire a single third-party LLM API into your customer portal or core internal workflows, a pricing change, regional outage, or regulatory dispute can halt your operations overnight. Build abstraction layers so you can swap underlying models (for example, failing over between Azure OpenAI, Anthropic, or local open-weight models) when needed.

3. Citrix NetScaler Under Fire Again​

Perimeter security appliances remain one of the most lucrative targets on the internet. TeamVK notes that Citrix NetScaler—widely used for remote access and load balancing—was hit with nine disclosed vulnerabilities in roughly a week, three of which were actively exploited in the wild, including a flaw where a single specially crafted request can knock vulnerable appliances completely offline.

• What to Do: Even if your company is a 50-person shop, ask your MSP or network administrator today whether you run Citrix NetScaler (or any other SSL VPN / remote access gateway), verify that the latest emergency patches are applied, and confirm who is monitoring appliance availability on a Saturday night.

4. Shadow AI Governance vs. Data Privacy Laws​

Are your employees pasting customer spreadsheets or legal contracts into free consumer chatbots? TeamVK cites a KPMG Global AI Pulse survey showing 64% of larger UK firms now place AI accountability at the C-suite level or above, alongside an Informatica report finding that 76% of organizations globally admit their governance rules cannot keep pace with employee AI adoption. Crucially, regulators like the UK Information Commissioner’s Office (ICO) hold businesses legally accountable under GDPR principles for personal data leaks regardless of whether management officially approved the AI tool used.

• What to Do: Designate a single AI owner in your business, run an audit of browser extensions and cloud sign-ups to see which AI tools staff actually use, and publish a clear, one-page policy stating which tools are approved and what company or personal data must never be pasted into a prompt. (Microsoft’s 2026 Digital Defense Report underscores this urgency, revealing that in December 2025 alone, Microsoft discovered a malicious browser extension with over 600,000 installs harvesting ChatGPT and DeepSeek conversation histories across nearly 10,000 organizations.)

5. Nation-State Fallout, Voice Phishing, and Microsoft's 2026 Digital Defense Report​

Drawing on the Microsoft Digital Defense Report 2026 (which analyzes global threat telemetry from July 1, 2025 to June 30, 2026), TeamVK highlights how rapidly AI is accelerating attacker tradecraft. According to the figures reported in the roundup, the UK ranks as the most targeted nation in Europe for state-linked cyberattacks and fifth globally for overall customer targeting. Even more alarming for everyday businesses are the initial-access trends attributed to the report:

• Phishing surged globally from 7% to 23% of intrusions investigated by Microsoft’s incident response teams.
• Voice phishing (vishing)—where attackers call staff by phone or through collaboration tools like Microsoft Teams—skyrocketed by over 500% year-over-year.
• UK ransomware detections jumped 66%.
• Primary Report Corroboration: Microsoft’s published 2026 report overview confirms that human action and identity remain the primary entry points for attackers, adding that Microsoft Defender for Office 365 detected more than 145 million QR-code phishing attacks between July 2025 and June 2026. To combat vishing and AI-assisted impersonation, enforce a strict "double-check rule": staff must verify any request to change bank details, reset passwords, or grant access by calling the requester back on a known, pre-verified phone number.

6. The Chromebook Support Controversy and "Googlebooks"​

Finally, TeamVK relays a report (citing The Register) claiming that Google quietly pared back automatic update support for newly purchased Chromebooks from ten years to eight (ending in 2034), while introducing Gemini-powered "Googlebooks" starting at £999 from OEMs like Acer, Asus, Dell, HP, and Lenovo that would require new enterprise management licenses.

• Important Fact-Check: If you manage ChromeOS fleets alongside Windows, do not panic or rewrite your hardware depreciation schedules without checking your specific device SKUs first. While TeamVK reflects reporting on a support-page discrepancy and a rumored OS transition, Google’s official Chrome Enterprise guidance states that ChromeOS continues to offer 10 years of automatic updates, and that existing fleets remain manageable in the Google Admin console without requiring new licenses. Because hardware support lifecycles are tied to specific platform release dates (Auto Update Expiration dates), always verify the exact AUE date for the specific Chromebook model you are purchasing in Google’s official enterprise product matrix before signing a purchase order.

The Bottom Line for Your IT Checklist This Week​

Whether you are running a 20-seat accounting firm or managing hybrid infrastructure for a 500-person manufacturer, the common thread tying all nine of these stories together is visibility. You cannot budget for Windows 10 ESU renewals if you do not have an accurate device inventory. You cannot stop Adversary-in-the-Middle session hijacking if you rely on legacy MFA and ignore your Microsoft Entra anomaly alerts. And you cannot capture real ROI from workplace AI if your staff are spending six hours a week fixing hallucinated numbers in unapproved chatbots.

Start with a 30-minute review with your internal IT lead or MSP this week: count your remaining Windows 10 machines, check your Microsoft 365 Conditional Access policies for passkey support, and make sure someone is actively watching the security alerts you are already paying for.