The consumer watchdog Which? has issued a blunt warning to anyone still running older versions of Windows: treat unsupported systems with
extreme caution, and if you cannot immediately upgrade or enroll in an official extended‑security program, disconnect them from the internet until you can. This alert follows Microsoft’s formal end of mainstream support for Windows 10 on October 14, 2025, and is part of a wider chorus of security experts urging users to manage the real and growing risks of running out‑of‑support operating systems.
Background and overview
Microsoft stopped providing free security updates, feature updates, and standard technical support for Windows 10 on October 14, 2025. That means machines running stock Windows 10 will no longer receive vendor patches that address newly discovered vulnerabilities, leaving them progressively more exposed to malware, ransomware, and targeted intrusions. Microsoft’s lifecycle pages make the change explicit and advise users to upgrade to Windows 11 where possible or enroll eligible devices in the
Windows 10 Consumer Extended Security Updates (ESU) program for a temporary safety net. Which? — the UK consumer group — included Windows 10 and older Windows releases (Windows 7, 8 and XP) in a broader public advisory on obsolete hardware and software. Its headline guidance is strikingly practical: if you cannot immediately mitigate risk through upgrade or paid support,
disconnect that machine from the internet until you can replace or isolate it safely. That recommendation is framed as an emergency, short‑term measure rather than a permanent solution. Microsoft also offers a paid ESU route for consumers: a one‑year security‑only bridge that covers eligible Windows 10, version 22H2 devices until October 13, 2026. ESU is limited in scope (security updates only, no new features or routine technical support) and in duration — it is explicitly a migration aid rather than a long‑term plan. Several widely read outlets reported the consumer ESU pricing and enrollment details as part of the transition coverage.
Why the “disconnect” advice matters now
The technical rationale
Unsupported operating systems stop receiving security patches. When attackers discover a vulnerability in current Windows builds, they frequently analyze the patch to produce working exploits that also hit older, unpatched versions — a technique often called “patch diffing.” Over time, a system left unpatched becomes a repeatedly expanding target: each new exploit or variant increases the chance of compromise. The risk is not hypothetical; security researchers and national agencies routinely add legacy Windows components — for example MSHTML/Internet Explorer compatibility code — to lists of actively exploited vulnerabilities. That combination of unpatched code and public exploit knowledge makes internet‑connected, unsupported Windows machines especially attractive to attackers.
Real‑world consequences
- Ransomware and large‑scale malware campaigns preferentially target known vulnerabilities on unpatched systems.
- Unsupported clients can be used as beachheads for lateral movement inside a network, undermining corporate and home environments.
- Compliance and insurance frameworks may explicitly require supported software; running out‑of‑support systems can jeopardize coverage or regulatory compliance.
Those are the practical reasons consumer groups like Which? and enterprise advisors alike recommend isolating unpatchable systems from networks until a safer option is in place.
What Microsoft says and the official options
Microsoft’s guidance
Microsoft’s published lifecycle and support pages are unambiguous: Windows 10 reached end of support on October 14, 2025, and consumers should move to Windows 11 when their device meets the hardware requirements. Where an upgrade is not viable, Microsoft points to the Consumer ESU program as a temporary protective measure for eligible devices. Microsoft also explains that devices will still
function after end of support, but will be at a greater risk for
viruses and malware without security updates.
Extended Security Updates (ESU) — the temporary bridge
- What ESU is: A security‑only update program for eligible Windows 10 devices (version 22H2) that delivers critical and important fixes defined by Microsoft Security Response Center (MSRC). It does not include feature updates or standard Microsoft technical support.
- Duration: Consumer ESU coverage is available through October 13, 2026. Business licensing offers multi‑year ESU options with different pricing, up to a limited maximum term.
- Cost and enrollment caveats: Reports indicated consumer ESU initially carried a modest fee (widely reported in outlets profiling the transition), and recent coverage has highlighted practical enrollment requirements and some regional or procedural friction. One reputable hardware press outlet reported that Microsoft now requires ESU devices to be linked to a Microsoft Account, which may frustrate users who prefer local accounts or older hardware. That requirement and any evolving enrollment processes are relevant practical constraints to consider.
Which users are most affected?
Home users and small offices
Many consumer devices are affected: laptops, older desktops, and devices that consumers cannot or will not upgrade for cost or compatibility reasons. For users who mainly surf the web, handle email, and run mainstream apps, remaining on an unpatched OS increases the chance of compromise from commodity attacks. The practical choices are:
- Upgrade the existing device to Windows 11 if eligible.
- Enroll in ESU where eligible and feasible.
- Replace the device with a Windows 11 machine, or migrate to a supported alternative OS.
- If none of the above are immediately possible, isolate or air‑gap the machine until you can act.
Businesses and regulated organisations
Organisations face sharper constraints: compliance, audit, and contractual obligations often stipulate supported software. Running unsupported Windows versions can trigger compliance failures and insurance issues. Businesses have additional options — commercial ESU for multiple years, vendor patch backports, or third‑party support — but must also weigh the operational complexity and long‑term cost. Many organisations will opt for staged device replacement and tightened network segmentation rather than indefinite ESU reliance.
Practical steps for consumers: a checklist you can use today
Below is a pragmatic, ordered plan for anyone who reads Which?’s advice and needs to act quickly.
- Identify your Windows version and build.
- Open Settings > System > About (or press Windows key + R, type winver, Enter) to confirm edition and version. If you are not on Windows 10, version 22H2, ESU eligibility may be affected.
- Back up your data immediately.
- Use Windows Backup, File History, or a full disk image to an external drive; copy critical files to cloud storage or another device. Backups protect against ransomware and data loss during migration.
- Check hardware compatibility for Windows 11.
- Use Microsoft’s PC Health Check tool (Settings > Privacy and Security > Windows Update > Check for updates will also prompt) to determine whether your device can upgrade in place. If it meets requirements, you may be offered a free upgrade path.
- If eligible, upgrade to Windows 11.
- Install via Settings > Update & Security > Windows Update > Check for updates, and follow the upgrade prompts. Make sure backups are complete before the upgrade.
- If you cannot upgrade, consider ESU or replacement.
- Enroll in Windows 10 Consumer ESU if your device is version 22H2 and you need time to migrate. Remember ESU is temporary and may have account or regional prerequisites. Evaluate replacement device options and trade‑in programs.
- If immediate upgrade or ESU is impossible, isolate the device.
- Remove the device from Wi‑Fi and unplug Ethernet cables.
- Disable network adapters in Device Manager or through Network & Internet settings.
- If the device must remain on a local network, place it on a VLAN with no internet access and restrict inbound/outbound traffic at the router/firewall.
- Do not use the device for web browsing, email, or untrusted USB devices while it remains connected.
- Consider alternatives: Linux distributions or ChromeOS Flex.
- For older hardware that cannot meet Windows 11 requirements, modern Linux desktops (Ubuntu, Linux Mint, Zorin) or ChromeOS Flex can extend the usable life of a device while restoring access to modern browser and security updates. Such migrations require some learning but are a cost‑effective route for many.
How to isolate (air‑gap) a legacy Windows PC safely
Disconnecting a PC from the internet is simple in principle but must be done carefully to maintain usability for local tasks while eliminating remote attack surface.
- Physically unplug Ethernet cables and switch off or forget Wi‑Fi networks.
- Turn off Bluetooth and any other wireless radios.
- Remove VPN and cloud sync services that might create outbound connections.
- Disable the network adapter in Device Manager and confirm the OS shows no network.
- If the device must temporarily access files from the internet, use a separate, up‑to‑date device to download files and transfer them via verified, read‑only media (preferably scanned on an isolated, up‑to‑date machine first).
- For business use, implement strict firewall rules and VLAN segmentation so the unsupported device cannot traverse to sensitive resources.
Caveat: air‑gapping is a useful short‑term mitigation but is operationally limiting. It is not a substitute for migrating to a supported platform when the machine must interact with the broader internet or a business network.
Trade‑offs, costs and other practical considerations
The ESU trade‑off
ESU buys time but not modern features or indefinite security. It is explicitly a stopgap to give users a transition window. Consumer ESU pricing and mechanics reported in the press suggest it is affordable for individuals seeking a short deadline extension, but users should weigh the $‑cost, account requirements, and administrative steps against simply replacing a device or switching to an alternative OS. Business ESU can be expensive over multiple years and is intended for organisations with complex application dependencies that need extended migration timelines.
Hardware and compatibility friction
Windows 11’s minimum requirements (including TPM 2.0, specific CPU lists, Secure Boot) mean many older PCs cannot perform an in‑place upgrade. In some cases hardware upgrades are possible, but often they approach the cost of a new PC, especially when battery life, performance, and driver support are considered. For many consumers the most practical pathway is a new or refurbished Windows 11‑capable device. Microsoft and many retailers maintain trade‑in and recycling programs to make the transition more economical.
Privacy and identity factors
Some enrollment and migration workflows — notably some ESU enrollment flows reported in the press — may require linking devices to a Microsoft Account. That is a point of friction for users who prefer local accounts for privacy or administrative reasons. It’s a trade‑off between a short‑term security update path and the convenience (or privacy cost) of using a cloud‑linked identity. Independent coverage has flagged this as a real practical constraint for some users.
Risk analysis: where Which?’s warning is strongest — and where nuance is needed
Strengths of the Which? warning
- The guidance is pragmatic and evidence‑based: disconnecting an internet‑exposed, unpatchable machine meaningfully reduces immediate exploitation risk.
- It empowers consumers with a clear, actionable mitigation that does not require technical expertise beyond unplugging or switching off Wi‑Fi.
- It focuses attention on a genuine security transition: the end of vendor patching is a structural change in exposure that merits an explicit plan.
Where nuance is needed
- Disconnecting a PC is a short‑term emergency measure, not a long‑term strategy. Many users rely on networked services (email, cloud backup, remote printers) and cannot operate indefinitely offline.
- Not every Windows 10 device is equally at risk; ESU‑enrolled or heavily firewalled systems have different risk profiles. But the general principle stands: the longer an unsupported device remains internet‑connected, the more likely an attack will succeed.
Unverifiable or variable claims to treat with caution
- Broad market‑share claims (e.g., precise percentages of Windows 10 users still in the wild) fluctuate and are reported with varying methodologies. Use caution with exact share numbers unless they are from a named, recent market survey. The central fact — that many millions of devices remain on Windows 10 in October 2025 — is verifiable; precise percentage figures are more variable and should be treated carefully.
Alternatives and longer‑term options
- Buy a Windows 11‑capable device and migrate using Windows Backup or cloud services to transfer files and settings.
- For unsupported hardware, install a modern Linux distribution (Ubuntu, Linux Mint, Zorin) or ChromeOS Flex to regain modern browser and security updates with minimal cost.
- For specialised legacy applications that require old Windows releases, restrict those machines to air‑gapped, tightly controlled environments with strict physical and network controls; document and regularly audit exceptions.
- Consider professional migration services if the device hosts business‑critical applications or complex dependencies.
Each option comes with pros and cons: cost, compatibility, user training, and operational impact. The choice should be driven by the device’s role, the user’s risk tolerance, and a well‑defined migration timeline.
Final assessment and recommended roadmap
The Which? warning to “disconnect” unsupported Windows machines is a practical and defensible short‑term mitigation backed by Microsoft’s own lifecycle announcements and by repeated security advisories from the broader community. Unsupported systems represent a predictable and growing risk: attackers will continue to weaponise new vulnerabilities against unpatched builds, and the absence of vendor fixes magnifies that danger.
For consumers and small offices, the simplest, safest path is:
- Confirm Windows edition and version now.
- Back up data immediately.
- If eligible, upgrade to Windows 11 as soon as convenient.
- If not eligible, evaluate ESU or plan a hardware replacement.
- As an immediate stopgap, disconnect any unpatchable device from the internet until a migration path is implemented.
For organisations, the calculus is similar but more formal: inventory affected devices, prioritise high‑value targets for replacement or ESU, and apply strict network segmentation and monitoring for any legacy endpoints that must remain connected. Compliance, audit, and insurance implications must be explicitly considered in the decision.
Which?’s headline advice is not alarmist — it is risk management boiled down to a single, actionable step that every user can perform immediately. Treat it as the alarm it is: if you are running unsupported Windows and cannot patch or upgrade today, disconnect the machine from the internet until you can put a secure plan in place.
Quick reference — essential links and facts to remember
- Windows 10 end of support: October 14, 2025. Microsoft recommends upgrading to Windows 11 or enrolling in ESU where eligible.
- Consumer ESU: security‑only coverage available for eligible Windows 10, version 22H2 devices through October 13, 2026 (limited, temporary).
- Which? recommendation: exercise extreme caution with older Windows versions — ideally disconnect from the internet until you can replace or secure the device.
The next steps are straightforward: back up, check compatibility, and either migrate or isolate. The longer an unsupported system stays connected, the higher the odds of compromise — and that is precisely what Which? and Microsoft both aim to prevent.
Source: Daily Record
People urged to 'disconnect' from internet in Windows alert