Windows 10 End of Support 2025: Migration Playbook & Security Risks

More than half of the world’s personal computers remain on Windows 10 even as Microsoft’s official support deadline looms, creating a wide and growing security gap that affects consumers, small businesses, and enterprise networks alike. New telemetry shared publicly via cybersecurity vendor reporting shows Windows 10 is still installed on roughly 53% of monitored devices, with only about 33% on Windows 11 and a non‑trivial share — roughly 8–9% in some datasets — still running Windows 7, an OS that stopped receiving patches in 2020. Those figures come with methodological caveats, but they nevertheless underline a clear reality: millions of systems will be exposed to unpatched vulnerabilities after Microsoft ends mainstream updates on October 14, 2025. (support.microsoft.com) (it-online.co.za)

---

Background / Overview​

Windows 10’s end of support is a fixed calendar event: on October 14, 2025, Microsoft will stop shipping free security updates, feature updates, and standard technical assistance for Windows 10 editions. Devices will continue to boot and run, but new vulnerabilities discovered after that date will no longer receive official patches unless the device is covered by Microsoft’s Extended Security Updates (ESU) program or is moved to a supported platform. This is not theoretical — the change flips devices from “supported” to “unsupported” overnight for the purposes of vendor patches and many compliance regimes. (support.microsoft.com)
At the same time, different measurement systems present different snapshots. Kaspersky’s telemetry-based analysis (KSN) has been cited across a number of outlets showing a dominant Windows 10 installed base (about 53%) and an ongoing Windows 7 tail (≈8.5% in that sample). By contrast, web‑traffic market trackers such as StatCounter report monthly pageview-derived market shares that recently placed Windows 11 at or near parity with — and in some months ahead of — Windows 10. Differences in methodology (installed‑base telemetry vs. pageview samples vs. vendor telemetry) explain much of the mismatch. Both views are useful; neither is a perfect global census. Readers should treat each figure as a snapshot shaped by the underlying data pool. (it-online.co.za) (gs.statcounter.com)

---

The headline numbers: what the data actually says​

Kaspersky‑derived snapshot (telemetry sample)​

• Windows 10: ~53% of devices in the monitored sample.
• Windows 11: ~33% in the same sample.
• Windows 7: ~8.5% globally in that data slice.
• Business devices: Windows 10 share is higher — close to 60% among corporate endpoints and about 51% among small businesses in the sample.
  These figures were derived from anonymized OS metadata reported via Kaspersky Security Network, which reflects consenting users of Kaspersky products and therefore represents a large but non‑random telemetry pool. (it-online.co.za)

StatCounter / pageview snapshot (web traffic)​

• StatCounter’s desktop Windows version chart for August 2025 showed Windows 11 around 49.02% and Windows 10 around 45.65% in global pageviews — numbers that differ materially from Kaspersky’s installed‑base telemetry because of the nature of pageview sampling. StatCounter’s data has been widely quoted in late‑summer 2025 coverage. (gs.statcounter.com)

Why the difference matters: telemetry from endpoint products (Kaspersky) measures what’s actually installed on those endpoints, while pageview trackers measure which devices are browsing the web and how often. Heavily active users, corporate proxies, or geographic sampling biases can tilt one dataset relative to the other. The core takeaway is consistent across sources: a large installed base remains on Windows 10 heading into October, and sizeable numbers of devices are on end‑of‑life systems.

---

Why organizations and users are staying on Windows 10​

• Hardware and compatibility limits. Windows 11 has stricter hardware requirements (e.g., TPM 2.0 on many models), so a substantial installed fleet is simply ineligible for a direct upgrade without hardware changes or replacements.
• Operational risk and testing. Businesses with mission‑critical software, bespoke device images, or regulatory constraints delay migrations until they can test and validate Windows 11 across their stacks.
• Perceived user disruption. Many users — especially in SMBs — view Windows 11’s UI and workflow changes as unnecessary friction, and prefer the stability and familiarity of Windows 10. Kaspersky experts specifically name such perception as a contributor to slow uptake. (it-online.co.za)

Those are legitimate operational concerns, but they must be balanced against the real security and compliance costs of running unsupported software.

---

The security impact: scarier than the inconvenience​

When Microsoft stops providing security updates for Windows 10 on October 14, 2025:

• New vulnerabilities discovered after that date will remain unpatched by Microsoft for non‑ESU devices.
• Threat actors know and plan around vendor timelines: unsupported platforms become lucrative low‑effort targets. Past EOL cycles (e.g., Windows XP, Windows 7) show that exploits proliferate rapidly once vendor patching stops.
• Organizations that continue to run unsupported Windows 10 machines face increased exposure to ransomware, credential theft, and supply‑chain intrusion. That risk is amplified where Windows 10 devices remain networked with supported infrastructure.

Security software (antivirus, EDR, firewalls) helps, but cannot replace vendor patches that fix fundamental OS vulnerabilities. The only durable mitigation is to move to a supported platform or enroll in an ESU program as a controlled stopgap.

---

Microsoft’s Extended Security Updates (ESU) options — what you need to know​

Microsoft offers a limited set of ESU options to extend security updates for Windows 10 beyond the Oct. 14, 2025 cutoff:

• Consumer ESU (one‑year extension through October 13, 2026): enrollment options include syncing PC settings via Windows Backup (no charge), redeeming 1,000 Microsoft Rewards points, or paying a one‑time $30 fee (covers up to 10 devices per Microsoft account). Enrollment is available via Settings > Update & Security > Windows Update when eligible. Consumer ESU is explicitly a time‑limited bridge, not a long‑term security strategy. (support.microsoft.com)
• Commercial / enterprise ESU: organizations can purchase ESU coverage per device (pricing and renewal terms differ; Microsoft documented enterprise enrollment via volume licensing and cloud partners). Enterprise ESU can be purchased in annual increments and typically becomes more expensive in subsequent years. (blogs.windows.com)

Important operational caveat: ESU enrollment for consumer and many other options requires a Microsoft account; local accounts that have historically been common on Windows 10 consumer devices may not qualify without conversion. That has provoked pushback among privacy‑conscious users. ESU also covers only critical and important security updates — it is not equivalent to ongoing feature updates or full vendor support. (support.microsoft.com)

---

Regional snapshots and surprising legacy tails​

Kaspersky’s analysis included regional breakdowns showing persistence of older OS versions in specific markets:

• Middle East: roughly 31% on Windows 11, 54% on Windows 10, and nearly 8% on Windows 7 in that telemetry slice.
• Africa: about 36% on Windows 11, 53% on Windows 10, and 4.5% on Windows 7.

These numbers illustrate how adoption can vary widely by region and by the installed hardware base; emerging markets and public‑sector deployments often contain larger shares of older hardware that cannot be easily upgraded. Note, again, that these are telemetry‑sample figures and will differ from pageview‑based trackers. (it-online.co.za)

---

Risks specific to businesses and regulated industries​

• Compliance exposure. Many regulatory frameworks and cyber insurance policies require supported software and timely patching. Running unsupported Windows 10 systems may be incompatible with contractual, regulatory, or insurance obligations.
• Operational continuity. Unsupported drivers, printer firmware, or vendor tools may stop working with newer cloud services; conversely, older peripherals may not get driver fixes for issues discovered after EOL.
• Cost volatility. Relying on ESU for large fleets can become exponentially expensive: consumer ESU is inexpensive, but enterprise ESU costs multiply per device and can rise sharply on renewal. One analysis estimated large potential costs if many devices remain on Windows 10 into subsequent years. (blogs.windows.com)

---

Practical migration and mitigation playbook​

The following step‑by‑step plan is geared to IT teams and informed consumers who need to move from risk posture to action.

• Inventory and classify devices now.
• List device models, Windows build (must be 22H2 for ESU eligibility), TPM and CPU details, and what each machine is used for. Prioritize systems with admin access, critical data, or external connectivity.
• Determine upgrade eligibility and options.
• For devices meeting Windows 11 requirements: test and pilot Windows 11 upgrades on representative machines.
• For ineligible devices: evaluate BIOS/firmware updates, CPU/TPM upgrades where feasible, or plan hardware replacement.
• Adopt a phased migration schedule.
• Prioritize high‑risk endpoints (internet‑facing servers, finance and HR machines) first. Use pilot groups and rollback plans.
• Use ESU only as a controlled bridge.
• Enroll critical consumer devices or non‑replaceable assets in ESU to buy time — but document a firm timeline to retire or upgrade those devices. ESU is not a permanent substitute. (support.microsoft.com)
• Harden legacy endpoints immediately.
• Apply network segmentation, limit internet access for unsupported devices, enforce least privilege, and ensure up‑to‑date EDR/antivirus and multifactor authentication.
• Consider alternatives for irreplacable hardware.
• Where hardware replacement isn’t possible, consider cloud‑hosted Windows 11 via Windows 365, or migrating specific workloads to Linux or thin‑client solutions.
• Prepare user training and support.
• Change management reduces productivity loss. Create clear guidance, short training sessions, and step‑by‑step migration documentation.
• Monitor and revise.
• Track progress weekly and maintain a register of all ESU‑covered devices with renewal dates and owners.

This playbook is deliberately conservative: it assumes the worst (exploitation trends post‑EOL) while offering practical, cost‑aware steps teams can execute at scale.

---

Alternatives: not everything is Windows‑centric​

• Linux desktop distributions. For older hardware that can’t run Windows 11 and where Windows‑only apps are not required, modern Linux distributions can extend device life and reduce EOL exposure, though migration carries its own/user‑support costs. Community toolkits exist to simplify migration.
• Cloud desktops / Windows 365. Devices that cannot be upgraded can run a cloud‑hosted Windows 11 session and thus retain supported software without local OS upgrades. This can be a practical option for distributed workforces.
• Device refresh programs and trade‑ins. Many OEMs and retailers offer trade‑in or subsidized replacement programs designed to accelerate refresh cycles at lower net cost.

Each option requires weighing security, cost, and user‑experience tradeoffs; none is a universal panacea.

---

Costs and timing: realistic expectations​

• Consumer ESU: one‑time $30 (or free via Windows Backup or 1,000 Rewards points) covering up to 10 devices on a Microsoft account, valid through Oct. 13, 2026. This is a budget‑friendly stopgap for small numbers of devices. (support.microsoft.com)
• Enterprise ESU: per‑device pricing that can escalate across years; for large fleets, the total cost can be large and should be factored into procurement and lifecycle budgets. (blogs.windows.com)
• Hardware refresh: costs vary widely by organization size; strategic refreshes staged with fiscal cycles are the most cost‑effective for enterprise fleets. Third‑party analyses estimate substantial potential costs if migration is deferred without planning, including lost productivity from rushed upgrades or breach remediation. (techradar.com)

---

Strengths and weaknesses of the current reporting​

Strengths:

• Telemetry from endpoint products (like Kaspersky) provides a ground‑level view of installed OS versions across consenting users, which is valuable for understanding real device populations. (it-online.co.za)
• Pageview trackers (StatCounter) give an independent signal of what’s actually active on the web and can highlight temporal shifts in active user behaviour. (gs.statcounter.com)

Weaknesses / caveats:

• No single dataset is a perfect global census. Telemetry samples can overrepresent certain geographies, customer profiles, or device types; pageview trackers can overrepresent heavy web users. Always interpret market share claims in the context of methodology and sampling bias. When messaging high‑stakes decisions (procurement, compliance), use multiple data sources and, where possible, internal inventory to make final calls.

---

What readers should do this month​

• If you run Windows 10 at home: verify your Windows build (22H2 recommended), decide whether to upgrade, and if you will remain on Windows 10 temporarily enroll in ESU (free options exist) and enable automatic updates. Back up data before any change. (support.microsoft.com)
• If you manage business devices: perform a prioritized inventory, pilot Windows 11 deployment with a rollback plan, consider ESU only for devices that truly cannot be replaced, and implement network segmentation and strengthened endpoint protections immediately.

---

Final assessment​

Windows 10’s official cutoff is a discrete pivot point in enterprise and consumer security. The data shows significant inertia: many users and organizations have valid reasons to delay migration, but delaying indefinitely is no longer safe or defensible. The practical reality is a multi‑year, multi‑track transition: some devices will move to Windows 11 quickly, some will use ESU for a short period, and some will be repurposed or replaced. The smart path combines inventory discipline, short ESU bridges where necessary, prioritized migrations for high‑risk endpoints, and proactive hardening for the remainder. The alternatives (cloud desktops, Linux migrations, targeted hardware refresh) must be on the table for any realistic long‑term plan. (support.microsoft.com)
Act now: inventory, classify, and set firm migration deadlines tied to risk and compliance priorities. October 14, 2025, is not merely the end of a product lifecycle — it is the deadline by which organizations must move from planning to execution to avoid the very real and increasingly exploited security gap left by an unsupported OS. (support.microsoft.com)

---

---

Source: Absolute Geeks More than half of PCs still run Windows 10 as Microsoft ends support