The UK Department for Environment, Food & Rural Affairs (Defra) quietly disclosed that it has spent approximately £312 million modernising its IT estate — a programme that included removing 31,500 Windows 7 laptops and upgrading them to Windows 10, patching tens of thousands of vulnerabilities, migrating legacy applications, and beginning a programme of datacentre closures — even as Windows 10 reached its vendor-supported end-of-service milestone in October 2025.
Defra sent the figures and a progress update in a letter from interim permanent secretary David Hill to Sir Geoffrey Clifton-Brown, chair of the Public Accounts Committee, responding to the committee’s earlier recommendation that the department produce a stronger business case for IT investment. The letter summarises the work completed during the 2022–23 to 2024–25 spending review period and sets out the next stage of the department’s legacy-modernisation programme. Key elements disclosed include:
If the department pursues the next phase — funded migration to Windows 11 or a move to managed cloud desktops, continued application rationalisation, responsible hardware replacement and transparent governance — the investment will likely pay ongoing dividends and finally reduce the operational fragility critics have warned about for years. If it stops at Windows 10, the public sector may bluntly repeat the cycle: another round of large‑scale refreshes, another spending window, and another moment where technology intended to reduce risk becomes, by dint of vendor policy and procurement timing, the very source of it.
Source: theregister.com UK dept spent £312M moving to Win 10 as support D-day hits
Background / Overview
Defra sent the figures and a progress update in a letter from interim permanent secretary David Hill to Sir Geoffrey Clifton-Brown, chair of the Public Accounts Committee, responding to the committee’s earlier recommendation that the department produce a stronger business case for IT investment. The letter summarises the work completed during the 2022–23 to 2024–25 spending review period and sets out the next stage of the department’s legacy-modernisation programme. Key elements disclosed include:- Removal of 31,500 Windows 7 laptops and upgrade to Windows 10.
- Remediation of over 49,000 critical vulnerabilities across Defra’s network.
- Migration of 137 legacy applications to modern environments and the phased closure of datacentres (one closed, three more planned).
- Planned replacement of a further 24,000 end-of-life devices and 26,000 smartphones, plus network infrastructure refreshes.
Why this matters now: the Microsoft deadline and ESU mechanics
Microsoft set an unambiguous lifecycle cutoff for mainstream Windows 10 editions: October 14, 2025. After that date the company stopped shipping routine security and quality updates to devices not enrolled in an Extended Security Updates (ESU) programme. For consumers Microsoft published a one‑year ESU bridge to 13 October 2026, while commercial customers can purchase multi‑year ESU for eligible devices via volume licensing. The consumer route includes conditional free paths (e.g., syncing PC settings to a Microsoft Account or redeeming Microsoft Rewards) and a paid one‑time option. For organisations, ESU pricing is deliberately back‑loaded and punitive if used as a long‑term strategy: published market reports and industry modelling have quoted a Year‑One list price of roughly $61 per device for commercial ESU, doubling in Year Two and again in Year Three (approx. $122 and $244 respectively). That structure explicitly nudges organisations toward migration rather than perpetual paid maintenance. The policy detail matters for a department the size of Defra. A per‑device commercial ESU bill multiplied across tens of thousands of endpoints becomes material quickly; conversely, the capital cost of a hardware refresh or a cloud migration programme also runs into many millions and often stretches multiple budget cycles. The choice Defra made to move large numbers of users from Windows 7 to Windows 10 was the right security move in 2023–24 — Windows 7 lacked vendor support long before this round — but without a clear, funded follow‑through to Windows 11 or cloud‑native desktops, the Windows 10 rollout risks being a stopgap whose benefits will expire with the end of Microsoft’s support window.What Defra actually bought for £312 million
The department’s letter lists a broad set of technical improvements and outcomes. Examining those items shows real accomplishment, but also highlights lingering complexity.Tangible wins
- Device refresh: Removing 31,500 Windows 7 laptops addresses an immediate, high‑risk population: unsupported endpoints that were unpatchable and likely to be exploited. Updating those machines to a maintained OS reduces immediate attack surface.
- Vulnerability reduction: Remediating more than 49,000 critical vulnerabilities is a measurable security improvement; that work alone mitigates countless high‑risk exposures and supports regulatory compliance.
- Application migration: Moving 137 legacy apps off unsupported infrastructure reduces operational fragility and begins to address the 1,900‑plus applications catalogued in earlier NAO / PAC reviews. Closing datacentres also lowers the department’s infrastructure footprint.
Residual liabilities
- Windows 10 commit: A large chunk of the refresh was implemented on Windows 10 — an operating system that, for mainstream servicing, became unsupported on 14 October 2025. That leaves the department exposed unless it either migrates to Windows 11, enrolls affected devices in ESU, or moves users to cloud desktops where Microsoft’s ESU terms differ. The department did not confirm whether it had purchased commercial ESU at the time of the published letter.
- Hardware compatibility backlog: The programme still lists 24,000 end‑of‑life devices to replace, plus 26,000 smartphones. Some of these older machines will not meet Windows 11 hardware requirements (TPM 2.0, UEFI, recent CPU families), meaning in-place upgrades are impossible and true modernisation will cost more than merely changing the OS image.
- Application and people risk: Defra’s stack includes complex, domain‑specific apps (agri‑trade, animal health, border controls) that may require extended testing and supplier re‑certification before being declared fully modernised — work that stretches budgets and timelines. Past PAC reporting emphasised how tightly business processes and legacy systems are coupled at Defra; that coupling explains why migration is slower and costlier than a desktop swap.
Strengths of Defra’s approach
- Scale and prioritisation: The department clearly prioritised high‑risk items — Windows 7 endpoints and critical vulnerabilities — rather than a scattergun programme. Removing the oldest, unsupported devices first is sound risk‑management.
- Application rationalisation: Migrating 137 applications and shutting datacentres demonstrates an appetite to rationalise infrastructure and decommission fragile platforms — an essential step toward sustainable, cloud‑enabled services.
- Investment in security posture: The remediation of vulnerabilities and investment in “hyper care” for old servers indicates a layered approach: where immediate replacement is impossible, compensating controls and monitored protection were implemented to buy time. That is the pragmatic route for mission‑critical services that cannot be swapped overnight.
Weaknesses, costs and substantial risks
- Buying a generation of obsolescence: Upgrading to Windows 10 in 2024–25 without a funded, time‑boxed migration to Windows 11 or cloud desktops risks creating another unsupported estate in two years. If Defra stops at Windows 10 it will face a repeat of today’s choices in short order.
- Unclear ESU posture: The department did not publicly confirm whether it purchased commercial ESU or intends to use cloud‑hosted Windows (which can absorb ESU costs). Commercial ESU is not cheap at enterprise scale; mis‑estimating this bill would create downstream budget shocks. Industry modelling notes Year‑One list pricing of around $61/device for commercial ESU, escalating thereafter — a pricing cadence that can transform a temporary stopgap into a steady-state bill if relied upon. Where the UK is outside the EEA free‑ESU concession, the financial pressure is higher.
- Procurement and governance lag: The PAC requested follow‑up by May 2024; Defra’s response arrived more than a year late. Delayed governance updates and reporting gaps are red flags when dealing with programmes that touch national resilience and border controls. Timely transparency matters for auditability and parliamentary oversight.
- Environmental and sustainability cost: Mass hardware replacement has e‑waste implications. Public sector programmes can and should be structured around refurbishment, trade‑in and circular procurement to minimise environmental harm and unit cost. The scale — tens of thousands of devices — means these choices have measurable environmental impact if not handled responsibly.
- Hidden integration and change‑management costs: Large OS and hardware programmes often understate the people, testing and supplier‑engagement costs required to avoid service disruption. Past PAC reporting showed how defective tooling and paper‑heavy processes at Defra arise from decades of ad‑hoc change; addressing those organisational issues is as important as buying new kit.
What the numbers mean in context: simple maths, complex choices
Two back‑of‑envelope comparisons explain why the choice matters.- ESU provisioning at scale:
- If Defra had to buy commercial ESU for 31,500 upgraded devices at a Year‑One list price of $61/device, that would be roughly $1.92 million for Year One — small relative to a £312 million spend, but Year Two pricing doubles and Year Three doubles again, and it doesn’t cover devices outside the enrolled cohort (for example, the 24,000 EOL devices not yet replaced). Prices and discounts vary; this is illustrative.
- Hardware replacement economics:
- Replacing a single enterprise laptop (procurement, imaging, accessories, disposal) in public-sector procurement often ranges from a few hundred to a thousand pounds per device depending on total volume and service levels. Multiplying an average replacement cost across tens of thousands of devices pushes fully modernising hardware into many tens of millions — the same order of magnitude as Defra’s programme. That explains why departments stage modernisation across spending review periods.
Practical recommendations for Defra (and similarly placed public bodies)
The following recommendations synthesise good practice for large public-sector estates facing a similar situation.- Publish a time‑boxed migration plan to Windows 11 or cloud desktops, with clear milestones for the next spending review period and associated funding requests. Tie outcomes to business KPIs (reduction in vuln count, mean time to restore, downtime).
- If migration will slip, formally document which devices will be covered by ESU, what type (commercial vs cloud) and how activation/renewal will be managed to avoid surprise costs. Quantify alternate cloud PC entitlements that may include ESU as part of a subscription.
- Prioritise application modernisation for the highest‑impact, high‑risk services (border/agri controls, flood management). Where replatforming is slow, isolate and harden those services with microsegmentation, dedicated monitoring, and immutable backups.
- Adopt circular procurement: mandate refurbishment and secure data‑erasure plus certified recycling to limit e‑waste and reduce net capital cost. Require suppliers to provide clear end‑of‑life pathways.
- Improve governance cadence: commit to quarterly progress reporting against a published transformation roadmap so PAC, NAO and Parliament can exercise timely oversight. Faster transparency helps manage public expectations and reduces reputational risk.
Wider lessons for public-sector IT programmes
Defra’s experience crystallises a set of generalised lessons any public CIO should internalise.- Modernisation is not a single purchase. Hardware, OS, application refactoring, and organisational change must be funded and scheduled together. Stopping mid‑stream (for example, upgrading an OS without a migration plan to the vendor’s current mainstream platform) risks buying transient benefits only.
- Vendor lifecycle events (like Windows 10’s end‑of‑support) are fixed calendar constraints; systems that rely on long vendor timelines must be inventoried and prioritised long before a spending review window opens. Public-sector procurement cycles and fiscal calendars must be aligned with vendor lifecycles.
- ESU is a bridge, not a strategy. Its pricing and terms make ESU suitable for buying time for risk‑critical endpoints, not as a substitute for migration. Public bodies should budget ESU as a one‑time contingency to be applied in targeted scenarios only.
- Transparency and measurable outcomes are essential for parliamentary oversight. Defra’s delayed response to the PAC request detracted from otherwise substantive technical progress; clear, timely reporting builds trust and helps secure further funding when required.
Conclusion
Defra’s disclosure that it invested roughly £312 million to tackle urgent legacy IT problems shows a department attempting to correct years of deferred maintenance and brittle systems. The removal of 31,500 Windows 7 laptops and the remediation of tens of thousands of vulnerabilities are genuine, material security wins. However, the reliance on Windows 10 as the target platform in the last tranche of that refresh — precisely as Microsoft’s lifecycle clock ran down — exposes a strategic mismatch between tactical remediation and medium‑term resilience.If the department pursues the next phase — funded migration to Windows 11 or a move to managed cloud desktops, continued application rationalisation, responsible hardware replacement and transparent governance — the investment will likely pay ongoing dividends and finally reduce the operational fragility critics have warned about for years. If it stops at Windows 10, the public sector may bluntly repeat the cycle: another round of large‑scale refreshes, another spending window, and another moment where technology intended to reduce risk becomes, by dint of vendor policy and procurement timing, the very source of it.
Source: theregister.com UK dept spent £312M moving to Win 10 as support D-day hits
