Windows 10 End of Support 2025: Plan Your Windows 11 Upgrade or ESU

Microsoft's announcement that Windows 10 will stop receiving routine security updates on 14 October 2025 crystallises a hard deadline for millions of users and organisations — an event that shifts long-standing security assumptions, raises urgent operational questions about migration and cost, and hands attackers a predictable target set unless companies and consumers take immediate action.

Background / Overview​

Windows 10 launched in 2015 and has been continuously patched and updated under Microsoft’s servicing model for a decade. Microsoft has now fixed the end-of-support date for the mainstream Windows 10 editions (Home, Pro, Enterprise, Education and most IoT/LTSC variants) as 14 October 2025. After that date, Microsoft will no longer publish routine OS security updates, monthly cumulative quality rollups, feature updates, or provide standard technical support for unenrolled Windows 10 devices.
Microsoft has provided a limited set of transition options rather than an abrupt “kill switch.” The two key pathways are:

• Upgrade eligible devices to Windows 11 (free for qualifying Windows 10 PCs).
• Enrol remaining Windows 10 devices in Extended Security Updates (ESU) to receive security-only patches for a limited period. For consumers, Microsoft made a one‑year ESU consumer pathway available (running through October 2026 for enrolled devices); for organisations, commercial ESU can be purchased for up to three years.

These are the structural facts; the practical consequences and the policy nuances around ESU — regional carve-outs, account requirements and pricing — are the operational levers that will determine who stays secure and who remains exposed.

---

Why this matters: the security calculus​

When a vendor stops issuing security patches, the attack surface becomes progressively more dangerous. Two technical realities make end of support consequential:

• Newly discovered vulnerabilities are no longer fixed in the OS. Kernel-level, networking, driver and privilege‑escalation flaws require vendor-supplied patches; antivirus signatures alone cannot close those classes of risk.
• Threat actors actively adjust priorities. Historically, attackers pivot quickly to unpatched platforms because the return on effort rises — a known, widespread vulnerability with no vendor fix is a high-value target. Unsupported systems are routinely scanned, weaponised, and used for lateral movement inside networks.

The immediate result is not that machines stop working, but that their security posture deteriorates predictably. This is a long‑tail problem: the exposure grows month by month as more vulnerabilities are discovered and no OS-level patches are released.

---

What Microsoft officially says and the ESU mechanics​

Microsoft’s lifecycle pages are explicit: Windows 10 (including 22H2 and relevant LTSB/LTSC SKUs) reaches end of support on 14 October 2025. The company’s consumer guidance points users toward Windows 11 for eligible machines and lists ESU as a temporary bridge for those who cannot upgrade immediately.
Key ESU facts verified across Microsoft documentation:

• Commercial ESU pricing: roughly US$61 per device for Year 1, with prices designed to increase in subsequent years (typical doubling mechanics across Year 2 and Year 3 for commercial/licensed devices). ESU for cloud-hosted Windows (Windows 365, Azure Virtual Desktop, Azure VMs) is available without additional ESU charge under some conditions.
• Consumer ESU: Microsoft published a consumer ESU pathway that covers eligible devices for one additional year (through October 13/14, 2026 depending on regional wording), with enrollment routes that initially included enabling Windows Backup sync to a Microsoft account, redeeming 1,000 Microsoft Rewards points, or paying a one-time fee (~US$30) in jurisdictions where the free option is not available.

Those mechanics are important: ESU supplies only security updates designated as Critical or Important — not feature updates, not broad quality rollups, and not full technical support. ESU is explicitly a bridge, not a long‑term support strategy.

---

The regional caveat: free ESU in the EEA and account requirements​

One of the most consequential recent changes is Microsoft’s concession for consumers in the European Economic Area (EEA): Microsoft confirmed that EEA consumers may receive ESU coverage for one year at no charge, under an enrollment flow that still requires a Microsoft account and periodic re‑authentication (the company requires sign‑in with the same Microsoft account at intervals to maintain eligibility). Multiple independent outlets and consumer‑rights campaigns reported this concession, which Microsoft framed as aligning the program with local expectations and regulatory pressure.
Important operational points about the EEA concession:

• The free EEA ESU window runs for one year beyond the OS end-of-support date (through October 2026).
• Enrollment still typically requires a Microsoft account and periodic sign‑in (for license validation). Local account holders who refuse a Microsoft account may therefore be excluded from the free path unless they move to a Microsoft account arrangement.

Outside the EEA, consumer ESU remains tied to the earlier enrollment conditions (backup sync to a Microsoft account, Microsoft Rewards points, or the paid purchase) in many markets. That geographic split creates a clear inequity in how the risk and cost of the Windows 10 transition are distributed.

---

The scale of the problem: how many devices are affected?​

Estimates vary by methodology, but independent telemetry and market trackers show a substantial remaining Windows 10 installed base as the 14 October deadline approaches. Web-traffic- and telemetry-based measures put Windows 10 usage in the mid-40% range globally in the months running up to October — meaning hundreds of millions of devices remain on Windows 10. National surveys, such as those cited in the UK, put the number of Windows 10 users in the tens of millions with a significant fraction indicating they plan to stay on the OS after updates stop. Those counts are estimates, not a single canonical registry; organisations must rely on their own inventories for precise risk assessment.

---

Security concerns and scam risk — what vendors and researchers are warning about​

Security vendors and researchers have been blunt: end of support is "not the end of the world, but it is the end of free safety nets." That phrasing captures a core idea — without vendor patches, unpatched Windows and driver bugs become long‑lived entry points that attackers will probe and exploit. Threats to watch for include:

• Increased commodity malware and ransomware targeting unpatched endpoints.
• Exploitation of long‑lived kernel/driver vulnerabilities enabling remote code execution or privilege escalation.
• Social engineering played off the transition itself: fake upgrade pop‑ups, fraudulent web pages offering “fast upgrades,” and phone scams where attackers pretend to be Microsoft support. Security researchers and vendors highlight the risk of scammers using the deadline to push malicious installers or to coerce remote‑access permissions.

These are not hypothetical — Microsoft and major security vendors have long warned about tech‑support scams and fake upgrade offers, and they advise users not to call numbers in popups or hand remote access to unknown callers.

---

Guidance for consumers: practical steps to reduce risk​

For home users and small organisations the migration choices come down to three practical options: upgrade, buy time, or mitigate while staying on Windows 10. The recommendations below synthesise Microsoft’s guidance and security vendor best practices into an actionable checklist.

• If eligible, upgrade to Windows 11 (free). Use the PC Health Check app to confirm compatibility and follow Microsoft’s upgrade prompts in Windows Update.
• If you can’t upgrade, enrol in consumer ESU where available — note the differing regional conditions (EEA free option, other markets may require Microsoft account sync, rewards redemption or a purchase). Validate eligibility in Settings → Update & Security → Windows Update.
• If you remain on Windows 10 without ESU, harden the device:
  • Keep browsers and all third‑party applications (especially PDF readers, Java, and web plugins) up to date.
  • Disable or remove legacy network protocols such as SMBv1.
  • Use a reputable security suite that commits to supporting Windows 10 and enable real‑time protection.
  • Operate daily activities from a non‑administrator account and enable multi‑factor authentication for online accounts.
  • Maintain verifiable offline backups and test restore procedures regularly.

Numbered quick checklist (consumer):

1. Check PC Health Check app for Windows 11 eligibility.
2. If eligible, back up data and run the Windows 11 upgrade via Windows Update.
3. If not eligible, enrol in the appropriate ESU path immediately (EEA consumers may have a free option).
4. Harden the device, update all apps and browsers, and enable MFA.
5. Keep an eye out for scam pop‑ups and do not call numbers shown in unsolicited messages.

---

Advice for businesses and IT teams: triage, segmentation, and cost planning​

For enterprises and public-sector organisations the calculus must include compliance, insurance, and operational continuity. Security vendors and corporate advisory threads converge on the following priorities:

• Inventory every endpoint running Windows 10 and tag devices by business criticality and internet exposure. Prioritise public‑facing and high‑privilege endpoints for immediate remediation.
• Segment networks to isolate legacy Windows 10 machines from critical services and limit lateral movement in case of compromise.
• Restrict risky features: disable macros in Office where possible, block unsigned drivers, and enable application allow‑listing for sensitive systems.
• Plan hardware refresh cycles and cloud migration where Windows 11 is not feasible on existing hardware. Consider Windows hosted alternatives (Windows 365, Azure Virtual Desktop) which can simplify compliance and reduce local patch risk.
• Budget for ESU where migration cannot complete before the cutoff. For commercial ESU the Year 1 price is approximately US$61 per device; organisations should model multi‑year cost escalation if they plan to stretch ESU coverage.

Businesses should also evaluate contractual obligations and cyber‑insurance provisions: knowingly operating unsupported software can complicate claims or regulatory compliance. For many regulated sectors the path to remediation must be documented, risk‑approved, and time‑boxed.

---

Cost analysis: ESU versus refresh​

Organisations must compare ESU subscription costs (plus the management overhead of enrollment and validation) to the capital and labour cost of hardware refreshes and OS migrations.

• ESU Year 1 commercial cost: ~US$61/device (Year 2 and Year 3 escalate).
• By contrast, buying replacement hardware capable of running Windows 11 is a one‑time capital expense but may include OS-image validation, driver testing, and application compatibility work that increases the total migration bill.

For organisations with device fleets, a hybrid approach is commonly rational: migrate high-value, modern hardware to Windows 11 now, use ESU as a bridge for legacy machines that require application remediation, and schedule targeted hardware refreshes for end-of-life endpoints. This staged plan aligns security risk reduction with budgeting cycles.

---

Compatibility and third‑party support erosion​

Another important risk vector is ecosystem drift: independent software vendors, browser vendors and hardware manufacturers tend to shift development and testing to supported OS versions over time. Expect:

• New versions of browsers and security agents to prioritise Windows 11 feature sets.
• Driver support for new peripherals to favour Windows 11, increasing the likelihood of compatibility problems on older machines.
• Application vendors gradually limiting support windows and dropping older OS compatibility.

This compatibility erosion affects functionality and security: an unsupported OS can still run, but third-party updates and compatibility assurances diminish, creating practical barriers to long-term operations.

---

Scam dynamics and social engineering — the human factor​

Attackers follow opportunity and momentum. Transition periods around an EOL event are fertile ground for fraud:

• Fake upgrade pages and malicious installers can masquerade as legitimate upgrade tools; downloading these can install trojans, backdoors, or ransomware.
• Tech‑support scams will increase, with fraudsters posing as Microsoft agents and attempting to obtain remote‑access or payment. Microsoft explicitly warns users not to call numbers shown in pop‑ups and not to accept unsolicited support calls.

Mitigation here is behavioural as much as technical: communications campaigns (clear notices from IT departments), end‑user training on scams, and enforced browser protections (pop‑up blocking, SmartScreen) will blunt social‑engineering success rates.

---

Notable strengths of Microsoft’s approach — and where it falls short​

Strengths

• Microsoft’s lifecycle calendar is clear and firm, which allows organisations to plan procurement, migration, and budgeting with a fixed date.
• The ESU programme provides a pragmatic bridge that addresses short‑term operational friction for enterprise migrations, and Microsoft’s carve‑outs for cloud-hosted Windows reduce friction for some workloads.
• The EEA concession to provide a free year of ESU for consumers in that region demonstrates responsiveness to regulatory pressure and consumer advocacy.

Weaknesses and risks

• The regional inconsistency (EEA vs non‑EEA) produces unequal access to free ESU and introduces consumer fairness concerns.
• Account and enrollment requirements (Microsoft account sign‑in for ESU validation) create friction and may exclude privacy‑minded or disconnected users.
• ESU is expensive for scale and explicitly short‑term; the pricing model is designed to nudge migration rather than serve as an affordable multi‑year lifeline for resource‑constrained organisations.

These weaknesses matter because a mass of unpatched devices is a systemic risk that can cascade across supply chains and public services.

---

Actionable migration roadmap for IT teams (30/60/90 day plan)​

1. Day 0–30: Inventory and triage
   • Run a full hardware and OS inventory. Tag devices by business criticality and exposure.
   • Identify internet‑facing and admin‑privileged endpoints. Plan immediate mitigations (segmentation, access control).
2. Day 30–60: Enrol and harden
   • Enrol critical devices in ESU if migration cannot be completed before 14 Oct 2025. Validate license activation and auditing.
   • Harden remaining Windows 10 endpoints: disable SMBv1, block unsigned drivers, enable application allow‑listing.
3. Day 60–90: Migrate and document
   • Begin phased migrations to Windows 11 for eligible hardware; pilot test apps and drivers.
   • Schedule hardware refresh for non-upgradeable machines; consider cloud-hosted Windows where appropriate.
   • Document risk decisions, ESU coverage windows and compliance evidence for auditors/insurers.

This roadmap is intentionally triaged: act fastest on the most exposed and most valuable endpoints.

---

Flagging unverifiable claims and commonly repeated estimates​

Some widely circulated figures — for example the oft‑cited “400 million devices unable to upgrade” number — are extrapolations and estimates, not direct counts from Microsoft. These headline totals convey scale but should be treated as indicative rather than precise. Organisations should prioritise their own fleet telemetry and inventories for decision‑making.
Similarly, consumer survey numbers (national estimates of users remaining on Windows 10) come from independent market and polling organisations and are valuable for context, but they are not a substitute for an organisation’s internal inventory. Where a claim cannot be traced to Microsoft’s official lifecycle pages or primary telemetry, it should be treated with caution.

---

Conclusion​

Microsoft’s October 14, 2025 end-of-support deadline for Windows 10 is a definitive, calendar-driven event that materially changes the security posture of any machine left unenrolled in ESU or un-upgraded to Windows 11. The technical facts are straightforward: no routine security updates, no feature or quality rollups, and no standard technical support after the deadline for unenrolled devices. Microsoft’s ESU program and the EEA concession add breathing room for some users, but they are explicitly temporary, often conditional, and not a substitute for migration.
The near-term priorities are equally clear: inventory devices, prioritise high-risk endpoints, enrol eligible machines in ESU where necessary, and accelerate Windows 11 upgrades or hardware refresh plans. At the same time, users and IT teams must harden systems and defend against a wave of opportunistic scams and social‑engineering attacks that will accompany this transition.
This is a migration challenge, a budgeting problem, and—for those who delay it—a widening security liability. The immediate practical prescription is to act now: count devices, buy time where needed, and plan for a sustained move to supported platforms to reduce long‑term risk and operational cost.

---

Source: SecurityBrief UK Microsoft to end Windows 10 support, raising security concerns