Windows 10 End of Support 2025: Act Now With Telemetry Insights and Migrations

More than half of the world’s personal computers remain on Windows 10 with just weeks to go before Microsoft’s scheduled end-of-support date, according to a dataset Kaspersky shared via a Technology For You write-up — a situation that tightens the window for safe, budgeted migrations and forces IT teams and home users to make concrete choices now. The headline figure — 53% of devices still running Windows 10, with only 33% on Windows 11 and 8.5% lingering on Windows 7 — reflects Kaspersky’s telemetry sample, but it also collides with public market trackers that show a different distribution. That discrepancy is the story beneath the headline: the numbers matter, but so does how they were measured, who they represent, and what organizations do with that intelligence before October 14, 2025, when Microsoft formally stops shipping routine security and quality updates for Windows 10. (support.microsoft.com)

---

Background​

Windows 10’s end-of-support date is firm: October 14, 2025. After that date Microsoft will stop delivering regular security patches and technical support for Windows 10 Home, Pro, Enterprise and Education editions unless systems are covered by an Extended Security Updates (ESU) program or other Microsoft-provided exceptions. Microsoft’s official guidance is to upgrade eligible devices to Windows 11, enroll in consumer ESU options (where available), or replace devices that cannot be updated. The company also laid out enrollment and mitigation options for organizations and consumers facing difficult upgrade choices. (support.microsoft.com, learn.microsoft.com)
This deadline has real consequences. Unsupported operating systems become attractive targets for attackers: any future vulnerability discovered in an EOL OS can remain unpatched and exploitable in perpetuity, unless paid ESU coverage or third‑party mitigations are in place. Empirically, previous EOL events (Windows 7, Windows XP) show attackers actively scanning for and weaponizing unpatched flaws once vendor updates cease, often with costly results for victims.

---

What Kaspersky reported — the topline and the caveat​

Kaspersky’s study — as reported in the Technology For You piece the user shared — uses anonymized operating‑system metadata collected from consenting members of the Kaspersky Security Network (KSN). The key claims in that report are:

• 53% of monitored devices were still running Windows 10.
• 33% had moved to Windows 11.
• 8.5% were on Windows 7, an OS that reached end-of-support in 2020.
• Among business devices, Windows 10 share was higher: 59.5% for corporate devices and 51% for small businesses.
• Kaspersky’s experts warned that the continued use of outdated OS versions in corporate environments increases vulnerability surface and compatibility risk.

Those figures are notable and alarming — especially the double-digit Windows 7 tail — but they come with an important methodological rider: Kaspersky’s data reflects the installed base of systems where Kaspersky products (and KSN telemetry) are active and where users have consented to data collection. In short, it is a large, valuable telemetry set but not a probability‑based global census.
Why that matters: different measurement pools produce different snapshots. Market trackers that sample web traffic and browser user agents (e.g., StatCounter) and vendor telemetry often report different distributions of Windows versions. When you compare Kaspersky’s sample to StatCounter’s August 2025 snapshot, you find Windows 11 edging ahead on pageview-derived market share while Windows 10 lags behind in that specific measurement. Those differences do not invalidate either data source, but they do change how you should interpret them. (gs.statcounter.com, computerworld.com)

---

How the numbers compare: telemetry vs. market trackers​

When a single vendor or researcher reports a specific OS share, two questions should immediately follow:

• What was the data source (telemetry, web-analytics, device inventories)?
• How representative is that source for the population you care about (consumer PCs, enterprise fleets, global installs)?

Kaspersky’s KSN telemetry is rich in endpoint-level details from devices that use Kaspersky products. That makes it excellent for security posture analysis and vulnerability exposure studies within that population. However, KSN will overweight regions, verticals, and user types where Kaspersky historically had strong market presence.
StatCounter’s global “Desktop Windows Version Market Share” takes a different approach: it samples pageviews across a large network of web properties to estimate the versions of Windows visiting the web. Its August 2025 numbers put Windows 11 at ~49% and Windows 10 at ~45.6% of desktop Windows pageviews worldwide — a materially different distribution than the Kaspersky figure. Those StatCounter snapshots are widely used as a barometer for public-facing adoption but are sensitive to sampling biases (region, site mix, user behavior). (gs.statcounter.com)
Other industry reports and vendor comments (from PC makers and enterprise tools vendors) fall between these two poles: many OEM executives and enterprise readiness reports acknowledged that a large share of business PCs remain on Windows 10, and that migrations would continue through 2026 for many organizations — reinforcing Kaspersky’s operational warning even if absolute percentages vary by source. (computerworld.com)

---

Why the discrepancy matters for decision-makers​

• Security posture: If your risk assessment assumes the lower StatCounter Windows 10 population, you may under-prepare for the actual number of Windows 10 endpoints in your estate if your environment resembles Kaspersky’s sample (for example, if you have many devices in regions or industries where Kaspersky deployments are common).
• Procurement and budgeting: Enterprise budgeting that relies exclusively on public market trackers might underfund ESU purchases, hardware refreshes, or migration projects.
• Operational planning: Patch management, vulnerability scanning, and legacy application testing must be sized to the real-world device count you operate — not the global median.

In practice, treat the Kaspersky snapshot as a credible early-warning signal that reinforces the strategic point: significant Windows 10 populations remain in the wild, especially inside business infrastructures, and organizations must act now. But do not rely solely on a single vendor’s telemetry to size your inventory or purchase orders.

---

Technical implications of Windows 10 end of support​

• No routine security patches after October 14, 2025: That means newly discovered vulnerabilities will not receive Microsoft’s standard fixes. Critical vulnerabilities will remain exploitable on unpatched Windows 10 hosts unless covered by ESU program patches. (support.microsoft.com)
• Compatibility drift: Over time, newer versions of productivity and security software will target Windows 11 and modern APIs. Even if software continues to run on Windows 10 initially, compatibility breaks and missing features can increase operational friction for users and IT staff.
• Regulatory and compliance risk: In regulated sectors, running unsupported OS software can expose organizations to compliance violations and higher audit risk, which may translate into fines or insurance issues.
• Attack surface expansion: Unsupported systems become high-value targets for opportunistic and state actors. Historical precedence shows that attackers accelerate campaigns that exploit EOL OSes.
• Limited support for Microsoft 365 apps on Windows 10: Microsoft has signalled phased support changes for its productivity stack; while some security updates will continue for Microsoft 365 components for a limited period, relying on long-term app security on an unsupported OS is not sustainable. (support.microsoft.com)

---

Practical migration options: a hands-on playbook​

Every organization and user will need to choose one of the following, often in combination. Prioritize according to risk, regulatory obligations, and business continuity.

• Upgrade eligible devices to Windows 11
• Advantages: ongoing security updates, improved hardware-backed security (TPM 2.0, VBS), longer support life.
• Steps:
• Run compatibility checks (PC Health Check or in-house inventory).
• Pilot on a representative set of devices and line-of-business apps.
• Validate backups and rollback plans.
• Deploy via phased waves (high-risk endpoints last; high‑risk first in security contexts).
• For organizations, coordinate app compatibility testing and user training.
• Enroll qualified devices in Extended Security Updates (ESU) (short-term bridge)
• Advantages: buys time to plan migrations or replacement cycles.
• Caveats: cost structure escalates for commercial customers; consumer ESU options are limited/one-year unless free enrollment conditions are met. Microsoft’s ESU program also has enrollment and version prerequisites (e.g., Windows 10 22H2). (learn.microsoft.com, gs.statcounter.com)
• Replace hardware (when Windows 11 is not supported by existing devices)
• Advantages: long-term solution, modern security features, improved performance.
• Consider trade-in/recycling programs to reduce e-waste footprint.
• Switch to alternative OS (Linux distributions) for suitable endpoints
• Advantages: longevity for older hardware, reduced licensing cost, active security updates from community LTS releases.
• Caveats: application compatibility, user retraining, and management tooling differences.
• Virtualize legacy workloads (Windows 10 in cloud)
• Advantages: legacy applications can run in controlled cloud images while endpoints migrate; may reduce immediate patch surface.
• Consider Windows 365, Azure Virtual Desktop or other cloud-hosted Windows options as a strategy for gradual migration.
• Network isolation and microsegmentation
• Advantages: reduces lateral movement risk from legacy endpoints.
• Use this as an interim mitigation for endpoints that cannot be upgraded or covered by ESU.

---

A security-first phased migration plan (recommended for IT teams)​

• Inventory and classification
• Identify every Windows 10 and Windows 7 endpoint, including IoT and medical/industrial devices.
• Classify by criticality, data sensitivity, and business impact.
• Compatibility testing
• Run app compatibility tools and test suites for line-of-business software.
• Build a matrix of applications that require remediation or replacement.
• Risk triage and sequencing
• Prioritize patching/migration for externally-facing and high‑privilege devices.
• Mitigate low-priority endpoints with isolation and additional monitoring.
• Budgeting and procurement
• Consider ESU as a stopgap where replacement cost outweighs immediate options.
• Use a phased procurement plan tied to migration waves.
• Pilot, iterate, scale
• Validate processes in a small, cross-functional pilot before broad rollouts.
• Document rollback paths and end-user support scripts.
• Post-migration validation
• Confirm agent health, security posture, backup integrity, and observability.
• Decommissioning
• Securely wipe or recycle replaced hardware to avoid data leakage and reduce e‑waste.

---

Cost, risk and governance — what boards and CISOs should know​

• ESU is not free for most organizations: ESU pricing for commercial customers is tiered and rises each year; it is a budget line item, not a long-term strategy. Microsoft’s ESU program is intended as a remediation window, not a permanent support contract. (learn.microsoft.com)
• The true cost of inaction is higher: Data breaches, regulatory fines, operational downtime, and reputation damage often exceed migration or ESU costs. Historical incidents that exploited unpatched systems demonstrate the asymmetric economics of neglect.
• Governance matters: Boards and risk committees must be briefed on migration timelines, contingency spending (ESU/VM migration), and the environmental and vendor-risk consequences of large-scale hardware refreshes.
• Procurement strategy: Where possible, negotiate ESU pricing as part of broader enterprise agreements or include device refresh in existing capital plans to smooth budget impact.

---

Attack landscape and threat modeling after EOL​

The days and weeks after a vendor stops patching an OS are a notorious attractor for threat actors. The playbook typically follows a predictable pattern:

• Vulnerability disclosure (researchers or accidental disclosures).
• Rapid exploit development targeting unpatched code paths.
• Automated scanning and mass infection campaigns.
• Targeted ransomware and supply-chain attacks against organizations with legacy assets.

Mitigation requires layered controls: robust endpoint detection and response (EDR), network controls, hardened identity, multi‑factor authentication, and heightened logging and incident response readiness. Even when ESU is used, organizations should assume adversaries will aggressively test for gaps and operate accordingly.

---

The role of third-party security tools — useful but not sufficient​

Kaspersky experts rightly emphasize that having an endpoint protection product is not a substitute for OS updates; an EDR or antivirus can reduce risk but cannot fully close vulnerabilities that require OS-level patches. A defense-in-depth model is necessary: modern EDR, application allow‑listing, virtualization‑based isolation, and rapid patching together make up a holistic mitigation strategy. Kaspersky’s warning that unpatched systems are an invitation to attackers remains valid even as you evaluate other vendor telemetry.

---

Strengths and limits of the Kaspersky dataset​

Strengths:

• Granular endpoint-level insights from a security vendor that has deep visibility into device OS versions and patch levels among its installed base.
• Ability to segment by business vs. consumer devices and detect trends relevant to security posture.

Limits:

• Sampling bias — KSN telemetry does not represent a randomized global sample. It reflects users who have Kaspersky products and have consented to telemetry.
• Regional and vertical skew — market share in KSN may overrepresent regions where Kaspersky historically had stronger market penetration.
• Not comparable to web‑analytics market trackers without adjustment.

Because of these caveats, Kaspersky figures should be used as an operational indicator (e.g., “we have a substantial Windows 10 population in our telemetry”) and cross-validated with inventories and other market trackers when estimating totals for budgeting or regulatory reporting.

---

Bottom line and urgent priorities​

• Treat October 14, 2025 as a hard pivot: after that date Windows 10 will no longer receive routine security updates — plan accordingly. (support.microsoft.com)
• Kaspersky’s telemetry is a valuable warning: whether their global percentage precisely matches other trackers or not, their conclusion is unambiguous: large numbers of systems remain on Windows 10 and some still run Windows 7. That matters for security and business continuity.
• Measure your own estate now: the fastest way to eliminate uncertainty is to inventory devices, test compatibility and set a migration timetable aligned to business risk.
• Use ESU only as a bridge: ESU is useful when you must buy time, but it is costly and not a substitute for a structured migration program. (learn.microsoft.com)
• Defend in depth: strengthen perimeter and endpoint controls, enable multi‑factor authentication, segment networks, and monitor aggressively for exploitation attempts.

---

Final assessment​

The Kaspersky snapshot reported in Technology For You is an important, actionable data point: it reinforces a widely shared industry view that many PCs — especially in businesses — will still be on Windows 10 as the October 14, 2025 cutoff arrives. That reality creates a compressed window for migration, elevated cyber risk, and a non-trivial procurement conversation for IT and security leaders. At the same time, public market trackers show different market shares, underlining the need to treat any single dataset as a directional signal rather than an absolute.
For pragmatic organizations, the imperative is simple and immediate: inventory, triage, and act. The cost of measured, phased upgrades plus sound mitigations is almost always lower than the potential cost of a successful attack against unsupported systems. The clock is running; the work that prevents the headline regrets should start — and finish — before the calendar forces the decision. (gs.statcounter.com, computerworld.com)

---

Source: Technology For You Kaspersky: More than half of PCs are still operating Windows 10 OS | Technology For You