Windows 10 reached the end of its vendor-supported life today, leaving a vast portion of the global installed base in a new and immediate risk category — and recent vendor telemetry plus industry surveys suggest that millions of endpoints will remain unpatched and exposed unless organisations act now. TeamViewer’s near-term telemetry flagged that more than 40% of endpoints receiving support via its platform were still on Windows 10, and Cloudhouse’s industry survey highlights pervasive Windows technical debt inside enterprise estates — a combination that creates both a practical remediation burden and a regulatory, insurance and cyber‑risk problem for firms that defer migration.
Microsoft has set a fixed lifecycle cutoff for Windows 10: routine security updates, feature updates and standard technical support for mainstream Windows 10 editions end on October 14, 2025. After that date Microsoft will not ship routine OS‑level security fixes for Home, Pro, Enterprise and Education editions unless systems are enrolled in Extended Security Updates (ESU) or are otherwise covered. That calendar date changes the default security posture for any device left on Windows 10 without a documented, time‑boxed mitigation.
At the same time, vendor and independent telemetry collected in the run up to the cutoff paint a consistent operational picture: many devices — especially in enterprise and regulated sectors — still run Windows 10. Different data families answer different operational questions, but when remote‑support telemetry, security‑vendor telemetry and market trackers are triangulated, the conclusion is robust: a large and heterogeneous population of devices will cross into an unsupported state on the same day.
This article dissects the numbers, assesses what is verifiable and what is directional, explains the most likely operational and security consequences, and lays out a pragmatic, risk‑prioritised playbook for IT leaders and security teams who must act under tight budget, governance and time constraints.
However, two important caveats apply:
Actionable validation step: if your organisation’s sector or geography was underrepresented in their survey, treat high‑level percentages as directional and use your internal discovery to create a device‑by‑device remediation backlog.
Practical steps for finance IT leaders
The technical and organisational recipe for success is straightforward but operationally demanding: measure accurately, prioritise by risk, use ESU only as a time‑boxed bridge, harden and isolate non‑migratable assets, and execute staged migrations with strong post‑upgrade validation. Firms that act on that disciplined playbook — balancing tooling, governance and procurement — will convert the deadline from a scramble into an opportunity to modernise securely and sustainably.
Conclusion
The end of vendor support for Windows 10 marks the end of an era — and the start of a concentrated remediation challenge for organisations worldwide. Telemetry and survey data show the scale of the problem and the human costs of delayed action. The immediate imperative is clear: reconcile internal inventories against readiness scans, prioritise the riskiest endpoints for remediation or isolation, and document time‑boxed compensating controls where upgrades aren’t immediately feasible. Doing so will reduce attack surface, preserve compliance, and give IT teams the breathing room to modernise on their own terms rather than being forced into a costly, reactive scramble.
Source: TechRadar Almost half of global endpoints still run Windows 10, despite reaching end-of-life - and its leaving organizations exposed
Background / Overview
Microsoft has set a fixed lifecycle cutoff for Windows 10: routine security updates, feature updates and standard technical support for mainstream Windows 10 editions end on October 14, 2025. After that date Microsoft will not ship routine OS‑level security fixes for Home, Pro, Enterprise and Education editions unless systems are enrolled in Extended Security Updates (ESU) or are otherwise covered. That calendar date changes the default security posture for any device left on Windows 10 without a documented, time‑boxed mitigation.At the same time, vendor and independent telemetry collected in the run up to the cutoff paint a consistent operational picture: many devices — especially in enterprise and regulated sectors — still run Windows 10. Different data families answer different operational questions, but when remote‑support telemetry, security‑vendor telemetry and market trackers are triangulated, the conclusion is robust: a large and heterogeneous population of devices will cross into an unsupported state on the same day.
This article dissects the numbers, assesses what is verifiable and what is directional, explains the most likely operational and security consequences, and lays out a pragmatic, risk‑prioritised playbook for IT leaders and security teams who must act under tight budget, governance and time constraints.
The data: how big is the problem right now?
TeamViewer: a large operational signal (but not a census)
TeamViewer’s public messaging in the run‑up to the deadline reported analysis of an anonymised sample of roughly 250 million remote‑support sessions recorded during July–September 2025, and concluded that more than 40% of endpoints receiving support via TeamViewer were still running Windows 10. The vendor used that telemetry to underscore migration urgency and to promote its Digital Employee Experience (DEX) Windows 11 Readiness Pack for large fleets.- Strength: 250 million sessions is a substantial sample and represents an operationally meaningful footprint — these are endpoints that are actively receiving support.
- Important caveat: this is support‑session telemetry, not a probability‑sampled global census. The sample will be biased toward devices that call for help (and toward geographies or verticals where TeamViewer is more prevalent). Treat the topline as a directional alarm rather than an exact global market share.
Cloudhouse: wide organisational technical debt
Cloudhouse’s State of Technical Debt reporting (their 2025 study) found that Windows technical debt is widespread, with a very high share of organisations admitting legacy Windows dependencies, downtime attributable to outdated software, and budget diversion from strategic projects to day‑to‑day maintenance. Cloudhouse’s commentary emphasises that technical debt is both a security and operational problem that has real human and commercial costs inside enterprises.- The survey highlights the scale of the problem inside enterprises and especially regulated sectors (finance, manufacturing, government), where a substantial portion of respondents reported compliance headaches and downtime tied to legacy Windows estates.
Independent telemetry (triangulating the picture)
Other vendor telemetry sets — e.g., security vendors and market trackers — produced complementary snapshots: some security‑vendor telemetry showed an even higher share of Windows 10 inside corporate estates, while pageview‑based trackers placed Windows 11 near parity in active browsing samples. The methodological differences explain percentage variance: endpoint telemetry reflects installed base (including dormant or rarely used devices), while pageview trackers privilege actively used devices. The bottom line is consistent: many organisational fleets remain heavily weighted toward Windows 10.Why organisations still run Windows 10: the anatomy of technical debt
There are four recurring, interlocked reasons why large estates remain on Windows 10:- Legacy application compatibility. Many business‑critical apps have OS‑specific dependencies — legacy DLLs, device drivers, or integrations with bespoke hardware — that break under aggressive OS changes. Rewriting or certifying those apps for Windows 11 is costly and risky.
- Hardware baseline and OEM firmware. Windows 11’s security baseline (TPM, Secure Boot, CPU generation) leaves a non‑trivial installed hardware population incompatible without firmware or hardware changes.
- Procurement cycles and capital constraints. Large hardware refreshes are tied to fiscal cycles. Budget shortfalls or competing strategic priorities delay refresh waves.
- Risk aversion in regulated environments. Finance, healthcare and industrial controls environments prefer slow, validated change rather than fast upgrades that might break compliance or certified workflows.
The security, compliance and operational risks of staying on Windows 10
Unsupported operating systems do not instantly stop working — but they become accumulating attack surfaces.- Security escalation: newly discovered kernel, driver or platform vulnerabilities disclosed after the vendor cutoff will not receive vendor patches for non‑ESU Windows 10 machines. Attackers routinely prioritise unpatched ecosystems, meaning unsupported platforms often become high‑value targets.
- Compliance exposure: auditors and regulators increasingly view unsupported software as an adverse control finding. Organisations that keep critical systems on an unsupported OS risk audit failures and potential contractual or regulatory penalties.
- Insurance and liability: cyber‑insurance policies may exclude or increase premiums for assets running out‑of‑support systems; insurers will look for documented compensating controls or ESU procurement.
- Operational fragility and incident response scale: unplanned outages during a reactive migration can cascade — incompatible drivers, legacy peripherals and bespoke applications are common failure points during accelerated upgrades.
- Reputational and financial cost: breaches tied to known, unpatched vulnerabilities frequently carry substantial remediation and business‑continuity costs.
Assessing the vendor claims: strengths, limits and what to ask next
TeamViewer’s claim: what it buys you — and what you must validate
TeamViewer’s telemetry is valuable because it reflects devices that are actively part of support workflows, a practical signal for helpdesk and remediation planning. The company is correct to flag migration urgency and to offer tooling for discovery and post‑upgrade validation.However, two important caveats apply:
- Methodology transparency: the press coverage summarises a 250‑million‑session sample but does not publish a detailed whitepaper explaining session‑to‑endpoint mapping, geographic weighting, or deduplication rules. That absence means the headline percentage should be treated as an operational indicator, not a definitive global census. Ask vendors for the method used to convert sessions to unique endpoints before using the figure for budgeting or compliance commitments.
- Coverage bias: remote‑support telemetry overrepresents the population of systems that call for help and those in segments where TeamViewer is widely deployed. Vendors’ installed base and channel presence can skew results.
Cloudhouse’s survey: a reality check on organisational readiness
Cloudhouse’s State of Technical Debt report is useful because it captures the attitudinal and operational consequences of legacy dependence: downtime, diverted budgets, and constrained innovation. It’s evidence that the problem isn’t merely theoretical — IT leaders already feel the pain. That said, any survey needs scrutiny on sample size, sampling frame (which sectors/countries), and question wording to understand how broadly claims generalise.Actionable validation step: if your organisation’s sector or geography was underrepresented in their survey, treat high‑level percentages as directional and use your internal discovery to create a device‑by‑device remediation backlog.
Practical playbook: immediate triage and a 12‑month migration program
The clock is tight. The following sequence is a pragmatic approach to preserve security, compliance and business continuity.- Reconcile authoritative inventory now
- Export device inventory from MDM, SCCM, Intune, CMDB and asset management systems.
- Run Windows PC Health Check and a vendor readiness scanner across the estate to classify devices as upgradeable, remediable (firmware/driver fixes possible), replace, or ESU candidate. Use vendor DEX tools as accelerators, but treat them as measurement aids — not substitutes for your authoritative data.
- Prioritise by risk
- Tier 1: internet‑facing and high‑privilege endpoints, domain controllers, payment and customer data paths.
- Tier 2: regulated or audited systems (finance, HR, legal).
- Tier 3: user workstations and low‑risk peripherals.
- Apply short‑term compensating controls for non‑remediable assets
- Network segmentation, strict access controls, application allow‑listing, host‑based EDR with memory protection, and isolation via virtualisation or hardened jump hosts.
- Document compensating controls for auditors and insurers; treat ESU only as a time‑boxed bridge with a clear replacement plan.
- Execute a staged migration program
- Pilot: use a small, representative fleet to validate upgrades and application compatibility.
- Rollout: staged waves per hardware family and application compatibility bucket; monitor rollback and support KPIs.
- Post‑upgrade validation: verify firmware, Secure Boot, TPM state and driver health. Use DEX/ readiness tooling to automate verification where possible.
- Enforce governance and auditability
- Record per‑device remediation category, approval and expected retirement date.
- Include sustainability plans (trade‑in, secure wipe, refurbishment, e‑waste recycling) to control cost and reduce environmental impact.
- Budget for the long term
- Track total cost of ownership (TCO) for upgrades vs ESU vs replacement and include hidden costs (helpdesk, testing, downtime, regulatory fines). Cloudhouse’s findings highlight that deferred investments often cost more in the medium term.
Financial services: why banks and trading firms are uniquely exposed
Finance faces acute pressure: legacy infrastructure, regulatory requirements, and low tolerance for disruption. Cloudhouse’s sectoral analysis emphasises that financial services frequently shoulder heavy Windows technical debt with constrained modernization budgets, and many IT leads in finance report significant time spent on maintenance rather than strategic projects. Those characteristics create real operational risk at the same time regulators demand strong patching and configuration management.Practical steps for finance IT leaders
- Tighten compensating controls for trading desks and back‑office systems: micro‑segmentation, enhanced logging, immutable backups, and privileged access management.
- Create a documented ESU‑to‑replacement plan for any system that cannot be upgraded immediately.
- Engage auditors and regulators early — present the remediation roadmap, controls and expected retirement dates to reduce surprises.
- Consider application compatibility packaging and virtualization (application containers, application remoting) to avoid risky refactors during the window.
Alternatives and mitigations for devices that can’t be upgraded
- Enroll in Extended Security Updates (ESU) as a time‑boxed stopgap when eligible — document the plan and retirement timeline.
- Use hardened alternative OS options for low‑risk endpoints: Linux distributions, ChromeOS Flex, or dedicated kiosks where application requirements are limited.
- Application compatibility packaging and virtualization — these can often keep legacy apps running on modern hosts without full refactors. Vendors that specialise in compatibility packaging can reduce migration time and risk.
- Adopt zero‑trust controls and strong EDR/NGAV tooling to raise the baseline protection where vendor patches are no longer available.
Cost, sustainability and governance considerations
Large migrations are expensive and generate e‑waste. Smart procurement and sustainability planning reduce both direct cost and environmental impact:- Negotiate OEM trade‑in and refurbishment programmes to lower capex and reuse viable hardware.
- Use firmware updates and BIOS configuration changes where possible to salvage compatible devices rather than replace them prematurely.
- Record and publish per‑device remediation rationale for auditors, showing why replacements were necessary or why ESU was used temporarily. Cloudhouse’s report stresses that when budgets are diverted repeatedly to maintenance, strategic projects stall — making transparent cost/benefit decisions is essential.
What vendors and policymakers should do (brief, prescriptive)
- Vendors should publish detailed methodology behind headline telemetries and provide exportable per‑device readiness data that customers can import to their CMDBs.
- Regulators and insurers should offer clear guidance on acceptable compensating controls for time‑boxed ESU use, and what evidence must be produced to avoid coverage exclusions.
- OEMs and channel partners should expand firmware and driver support where practical, and offer low‑cost refurbishment pathways.
Final assessment and takeaway
Today’s Windows 10 end‑of‑support date is a clear lifecycle inflection point. The data from remote‑support telemetry and industry surveys creates a stark operational truth: a large slice of the installed base — particularly inside enterprise and regulated sectors — will need coordinated, documented remediation to avoid elevated cyber‑risk, compliance problems and escalating costs. TeamViewer’s support‑session snapshot is a powerful operational signal that helps quantify the challenge, but it should be treated as directional and validated against internal device inventories before making budgetary or compliance decisions. Cloudhouse’s organisational survey demonstrates that Windows technical debt is not a theoretical concern; it already drains budgets and slows strategic work inside many organisations.The technical and organisational recipe for success is straightforward but operationally demanding: measure accurately, prioritise by risk, use ESU only as a time‑boxed bridge, harden and isolate non‑migratable assets, and execute staged migrations with strong post‑upgrade validation. Firms that act on that disciplined playbook — balancing tooling, governance and procurement — will convert the deadline from a scramble into an opportunity to modernise securely and sustainably.
Conclusion
The end of vendor support for Windows 10 marks the end of an era — and the start of a concentrated remediation challenge for organisations worldwide. Telemetry and survey data show the scale of the problem and the human costs of delayed action. The immediate imperative is clear: reconcile internal inventories against readiness scans, prioritise the riskiest endpoints for remediation or isolation, and document time‑boxed compensating controls where upgrades aren’t immediately feasible. Doing so will reduce attack surface, preserve compliance, and give IT teams the breathing room to modernise on their own terms rather than being forced into a costly, reactive scramble.
Source: TechRadar Almost half of global endpoints still run Windows 10, despite reaching end-of-life - and its leaving organizations exposed
