Windows 10 ESU: A 2026 Security Bridge for Non Upgraders

If you’re not ready to move to Windows 11, Microsoft has given Windows 10 users a one‑year lifeline: the consumer Windows 10 Extended Security Updates (ESU) program. It preserves delivery of critical and important security patches through 13 October 2026, while Microsoft stops normal, free security and feature updates for Windows 10 on 14 October 2025. The ESU path is intentionally narrow — security‑only updates, no new features or technical support — and it comes with specific eligibility rules, free enrollment methods for many personal users, and a capped one‑year window that makes it a bridge, not a replacement, for migration.

---

Background / Overview​

Microsoft launched Windows 10 in 2015 and has supported it for nearly a decade. The official end of mainstream support for Windows 10 arrived on October 14, 2025; after that date, regular monthly cumulative updates and free technical support end for consumer installations unless you take specific steps to enroll in ESU. The consumer ESU program extends security updates for eligible devices through October 13, 2026 and is designed to give people time to upgrade, replace older PCs, or make other long‑term plans.
This article explains exactly what ESU is, who qualifies, how to enroll, what you can and can’t expect from the program, practical mitigation if you don’t enroll, and the realistic upgrade alternatives — including the hardware constraints that prevent many older PCs from moving to Windows 11. Key claims and numbers below are verified against Microsoft’s public guidance and independent coverage from established Windows outlets.

---

What is Windows 10 Extended Security Updates (ESU)?​

ESU is a time‑boxed, security‑only update program for consumer Windows 10 devices that Microsoft created to reduce immediate risk for users who can’t or won’t upgrade to Windows 11 by the end‑of‑support date. Important characteristics:

• ESU provides only critical and important security updates defined by Microsoft’s Security Response Center (MSRC). It does not include feature releases, non‑security quality fixes, or general technical support.
• Coverage for consumer devices under this program runs through October 13, 2026. That’s the last day Microsoft will publish ESU security patches for eligible consumer machines.
• The consumer ESU is explicitly a bridge — intended to buy time to migrate data, replace aging hardware, or plan a move to Windows 11 or another OS. It’s not a long‑term security program.

---

Who can enroll (eligibility requirements)​

To be eligible for the consumer ESU enrollment experience you must meet several concrete requirements:

• The device must be running Windows 10, version 22H2 (the last feature update for Windows 10).
• The edition must be Home, Pro, Pro Education, or Workstation. (Domain‑joined business devices follow enterprise licensing paths instead.)
• The device must have the latest Windows 10 updates installed before enrolling.
• You must be signed into the PC with a Microsoft account that has administrator rights (local accounts and child accounts do not qualify; corporate Azure AD or MDM‑managed devices are excluded).

These constraints matter: ESU for consumers is tied to a Microsoft account and to the specific 22H2 baseline. If your PC is joined to a domain or managed by corporate tools, your organization must use the commercial ESU purchase channels instead.

---

How to enroll (consumer path) — step by step​

Microsoft built a simple wizard into Windows Update so eligible personal devices can enroll without complex licensing steps. The consumer enrollment options are deliberately straightforward:

• Open Settings → Update & Security → Windows Update.
• If your device is eligible and the rollout has reached you, you will see an “Enroll now” prompt or an end‑of‑support notification. Click it and follow the on‑screen instructions.

When you follow the wizard you’ll be offered one of three enrollment routes:

• Free: Sync your PC settings using Windows Backup (Windows will detect the backup/sync and enroll the device at no extra charge).
• Free (alternate): Redeem 1,000 Microsoft Rewards points to claim ESU coverage.
• Paid: A one‑time purchase of roughly $30 USD (local currency equivalent plus tax) for one year of ESU coverage. A single purchased ESU license can be used to protect up to 10 devices that are linked to the same Microsoft account.

Notes on timing and rollout: Microsoft has been deploying the enrollment wizard in waves; not every eligible machine will immediately see the option in Settings. Microsoft says that eligible devices will receive the enrollment experience before the end‑of‑support date, but if you don’t see it immediately you may need to check for updates and wait for the phased rollout. You can enroll anytime through the ESU window (until October 13, 2026).

---

What ESU gives you — and what it does not​

What you get if you enroll:

• Monthly security updates that address critical and important vulnerabilities as classified by MSRC. These are the patches that help prevent large‑scale exploits.

What you do not get:

• No new feature updates, no quality or non‑security fixes, and no general technical support from Microsoft for Windows 10 under the consumer ESU program. ESU is security‑patch delivery only.

This tradeoff is essential to understand: ESU reduces the most serious exposure surface, but leftover unpatched bugs or driver/firmware mismatches can still produce security, reliability, or compatibility problems outside the scope of monthly security patches.

---

Enterprise / business ESU — short primer​

Businesses that need to keep Windows 10 longer follow a different path:

• Commercial ESU pricing differs and is not identical to the consumer program. Microsoft published enterprise ESU pricing at about $61 per device for the first year, with incremental increases for subsequent years if organizations renew (and the commercial program can be purchased through volume licensing and cloud partners). Enterprises can renew for up to three years under prescribed terms.

If you manage multiple business devices, talk to your volume licensing rep or cloud provider; don’t use the consumer enrollment flow for domain‑joined or managed endpoints.

---

If you don’t or can’t enroll: practical hardening steps​

If you opt not to enroll (or your device doesn’t qualify), the machine will stop receiving Windows 10 security patches after October 14, 2025. That increases risk over time, but there are pragmatic ways to reduce exposure while you plan a migration:

• Use a modern, reputable antivirus/endpoint product with real‑time protection. Microsoft Defender will continue to receive Security Intelligence updates, but antivirus alone can’t compensate for missing OS patches.
• Prefer modern browsers: Chrome, Edge, or Firefox will likely continue to support Windows 10 for at least a window of time; they receive frequent security fixes that reduce web exposure. Keep browsers and key apps (PDF readers, mail clients) up to date.
• Limit risky activities: avoid doing online banking or handling sensitive corporate work on an unpatched machine; use a trusted device for those tasks.
• Use network controls: place legacy devices on segmented networks or behind VPNs/firewalls to reduce lateral exposure to the internet or to internal systems.
• Back up regularly: maintain offline and cloud backups so you can recover if an incident occurs.
• Consider virtualization or Cloud PC options: running modern workloads in a Windows 11 VM or using Windows 365 Cloud PC can isolate critical work from an unsupported local OS.

These steps lower, but do not eliminate, risk — they’re mitigations rather than substitutes for security updates from the OS vendor.

---

What about Microsoft Defender and Microsoft 365 apps?​

Microsoft has confirmed that certain Microsoft services will continue to receive updates beyond Windows 10’s end of mainstream support:

• Microsoft Defender Antivirus will continue to receive Security Intelligence updates through October 2028, which helps keep malware definitions current. That said, these updates don’t patch underlying OS vulnerabilities that a defender can’t block.
• Microsoft 365 Apps (Word, Excel, Outlook, etc.) will receive security updates until October 10, 2028, with feature updates continuing only until August 2026. These continuations ease the migration for users who rely on Microsoft 365 productivity tools.

Those continuations are helpful but are not a replacement for OS patching: if a critical kernel or networking vulnerability is discovered after Windows 10 loses mainstream support, Defender’s signature updates alone cannot fix the underlying unpatched hole. Enrollment in ESU or migration to a supported OS is the preferred mitigation to address such gaps.

---

Upgrading to Windows 11 — hardware realities and risks​

Upgrading to Windows 11 is the long‑term solution, but many older PCs fail to meet Microsoft’s minimum system requirements, which are stricter than Windows 10’s. Important requirements include TPM 2.0, UEFI Secure Boot, sufficient RAM and storage, and a CPU on Microsoft’s supported list — broadly meaning machines manufactured in recent years. Microsoft’s guidance and compatibility tooling (PC Health Check) let you verify readiness.
For technically adept users there are documented ways to install or upgrade to Windows 11 on unsupported hardware — registry edits, modified ISOs, and third‑party tools such as Rufus that can remove or bypass hardware checks. Microsoft has publicly documented registry workarounds for certain scenarios while cautioning that unsupported installations may not receive future updates and could be unstable. Those routes are doable but carry real risks: instability, driver incompatibility, and being excluded from future feature and security updates. Microsoft does not recommend unsupported installs for typical users.
If you choose an unsupported install, treat it as an experimental or temporary measure and maintain robust backups, or prefer a fresh machine that meets Windows 11 requirements for long‑term reliability.

---

Alternatives: Linux distributions and ChromeOS Flex​

If hardware won’t meet Windows 11 requirements and ESU is not attractive, consider alternatives:

• Modern, user‑friendly Linux distributions (Ubuntu, Linux Mint, Fedora) can be excellent for general web‑centric and productivity use and they receive long‑term security updates. They’re especially compelling for older hardware that struggles with Windows 11.
• ChromeOS Flex can repurpose eligible PCs into lightweight, secure devices for web and cloud work; it’s a low‑friction alternative for many non‑Windows‑centric workflows.
• Cloud‑hosted Windows instances (Windows 365 or other desktop virtualization) let you run a supported Windows environment while keeping local hardware as a thin client.

Each alternative has tradeoffs in application compatibility and user experience, so evaluate software needs (especially line‑of‑business apps) before switching.

---

Risks and practical pitfalls to watch for​

• Enrollment rollout issues: Microsoft rolled ESU enrollment out in waves. Some users reported not seeing the “Enroll now” option even when eligible; patience and ensuring prerequisites are met are often the remedy. Don’t assume the absence of the button means ineligibility; it can be a phased rollout artifact.
• Misunderstanding the coverage scope: ESU’s security updates do not replace feature or general quality updates. Devices may still experience incompatibilities over time as application and driver vendors cease testing older OS versions.
• False security comfort: continuing to use Microsoft Defender and receiving definition updates is helpful, but it’s not a substitute for OS patching. If attackers find a zero‑day in kernel or network stacks, Defender cannot patch the vulnerability itself.
• Unsupported Windows 11 installs: the registry and ISO workarounds are tempting, but they can create brittle systems that might not receive future security or feature updates, and may be harder to support. Backup before experimenting.

---

Recommended plan of action (practical checklist)​

• Verify whether your PC is eligible for consumer ESU: confirm you are on Windows 10 version 22H2, signed in with a Microsoft account that is an administrator, and that your PC is not domain‑joined or MDM‑managed.
• Open Settings → Update & Security → Windows Update and check for the “Enroll now” option; if it’s not visible, ensure Windows Update is current and wait — Microsoft is rolling the wizard out in phases.
• If you can’t upgrade right away, enroll via the free Windows Backup sync or Microsoft Rewards method, or use the one‑time purchase if needed — a single paid ESU license can cover up to 10 devices on the same Microsoft account.
• If ESU is not an option, follow hardening steps: modern AV, up‑to‑date browsers and apps, network segmentation, and careful use of sensitive services. Maintain frequent offline backups.
• Plan a migration timetable: use the ESU year to test Windows 11 upgrades, evaluate hardware replacement options, or migrate to alternative operating systems or cloud desktops. Account for app compatibility testing and procurement lead times.

---

Bottom line — realistic value and limits​

The consumer ESU program is a practical, short‑term buffer that gives millions of Windows 10 users crucial breathing room. Its strengths are simplicity, an accessible free path for many users, and the one‑year security window to plan a safe transition. However, ESU’s security‑only scope, the phased rollout and eligibility hooks, and the inevitable eventual end‑of‑support (October 13, 2026) mean it should be treated as a tactical pause — not a long‑term strategy.
For users who need time, enrolling in ESU is a sensible, low‑friction way to reduce immediate risk. For those who can upgrade, moving to Windows 11 or a supported alternative remains the durable solution; for those who can’t, robust hardening, backups, and possibly a migration to Linux or cloud PCs will be the most sustainable choices. The calendar is concrete: Windows 10 mainstream support ended on October 14, 2025, ESU runs through October 13, 2026, and Microsoft will continue certain Microsoft 365 and Defender updates into 2028 — all of which should shape any migration timetable.

---

Choosing the right path depends on your hardware, software needs, and risk tolerance. Use the ESU year to make a deliberate plan — test upgrades, schedule replacements where needed, and ensure that critical work runs on supported platforms as soon as practical.

---

Source: The Business Standard Don't want Windows 11 yet? Here is how to keep updates on Windows 10

 

[ChatGPT]

Microsoft’s planned end of free support for Windows 10 has arrived, and security experts — echoed by local advisories such as the Cyber Security Association of Pennsylvania — are warning that the practical effect is real: with routine OS patching stopped, millions of devices become comparatively easier targets for attackers.

Background / Overview​

Windows 10 launched in 2015 and enjoyed a decade-long lifecycle under Microsoft’s Modern Lifecycle policy. That lifecycle concluded on October 14, 2025, when Microsoft formally stopped providing routine security updates, feature updates and standard technical support for mainstream Windows 10 editions unless a device is enrolled in the company’s time‑boxed Extended Security Updates (ESU) program.
What this means in practical terms is straightforward: a Windows 10 PC will continue to boot and run applications after October 14, 2025, but the vendor-supplied stream of fixes that previously closed kernel, driver and platform vulnerabilities will no longer be delivered to ordinary devices. Microsoft’s official guidance to users is to upgrade eligible devices to Windows 11, enroll in the Consumer ESU program if migration is impossible within the transition window, or replace the device.
Microsoft’s ESU program is explicitly time‑boxed: consumer ESU enrollment is available through October 13, 2026, and enrolled systems will receive security‑only updates for eligible Windows 10 (22H2) devices through that date — with enrollment options that include signing in with a Microsoft account, redeeming Microsoft Rewards, or a one‑time local‑account purchase. ESU does not provide feature updates or standard technical support.
The local reporting and industry commentary that followed the retirement event distilled two linked facts: (1) routine vendor patching stopped on October 14, 2025, and (2) security experts, regional associations and national CERTs framed that removal of patching as the principal driver of elevated cyber risk for systems that remain on the unsupported OS.

---

Why security experts say risk increases after end of support​

The technical mechanics: forever‑days, patch diffing and weaponization​

When a vendor stops shipping patches for an operating system, newly discovered vulnerabilities affecting that OS cease to receive vendor-supplied fixes (for non‑ESU systems). That single operational fact has several predictable consequences that defenders and incident responders understand well.

• Patch diffing becomes a fertile source of intelligence. When Microsoft issues a fix for a newer OS build or for other products, attackers can reverse‑engineer the patch to reveal the vulnerable code path. On machines that keep the older, unchanged code, that knowledge converts a future fix into a long‑lived “forever‑day.” Security practitioners have repeatedly warned about this effect in the run‑up to October’s cutoff.
• Once an exploit exists, automation and commodity tooling let attackers scale attacks cheaply. Exploit kits, mass scanners and ransomware-as-a-service lower the cost and effort to turn a single vulnerability into an epidemic across large installed bases. Historical examples show how quickly weaponization spreads when a large population of unpatched devices exists.
• Lateral movement magnifies the danger inside mixed estates. A single unsupported Windows 10 machine on a corporate or university network can act as a pivot into domain controllers, databases and cloud resources if segmentation or least‑privilege controls are weak. That risk is the reason many advisories specifically urge organizations to treat unsupported endpoints as high‑risk assets.

Industry telemetry and vendor analyses — including monthly patch‑cycle commentary from leading security firms — underscore the operational shift: once vendor OS patching ceases, defenders must rely on compensating controls rather than routine fixes. That changes both probability and impact calculations for threat models.

Operational and regulatory consequences​

Operating unsupported systems does not just increase the technical attack surface. It also raises governance, compliance and insurance exposures.

• Regulated industries (payment processors, healthcare, education) that knowingly retain unsupported endpoints may face compliance challenges and potential insurance disputes if a breach traces back to an unpatched OS.
• Auditors and boards increasingly view end‑of‑support systems as controllable risk — one that requires executive‑level remediation plans, not ad‑hoc technician work.
• Smaller organizations without centralized IT or formal patching programs are disproportionately exposed because the cost and logistics of fleet refresh are non‑trivial.

These governance angles were highlighted repeatedly by regional security bodies and associations in the period around October 14, 2025.

---

What the KXAN/PennCyber reporting said — summary and immediate advice​

Local coverage of the retirement, including the KXAN story and public statements from the Cyber Security Association of Pennsylvania, emphasized urgency. PennCyber described unsupported Windows 10 systems as “essentially converting to an unlocked door,” warning that cybercriminals will specifically target those systems because updates are no longer coming. The group urged immediate steps: upgrade where feasible, use ESU as a last‑resort bridge, and isolate legacy systems that must remain online for business reasons.
PennCyber’s practical recommendations match Microsoft’s guidance and broadly accepted defense‑in‑depth practice:

• Upgrade to Windows 11 if the hardware is compatible.
• Replace older devices that cannot run Windows 11 with modern hardware that supports current security features.
• Enroll eligible devices in Microsoft’s Consumer ESU program for short‑term protection through October 13, 2026.
• If a Windows 10 machine must remain in use for legacy applications, isolate it from the internet and internal networks and never use it to process payments or store client data.

Those steps are practical and familiar to IT leaders, but they also expose the friction points: many organizations and households own hardware that cannot meet Windows 11’s hardware requirements, and the cost of replacement or remediation can be significant.

---

What Microsoft actually offers — precisely verified​

Microsoft’s official guidance and lifecycle documentation are explicit and should inform any remediation plan:

• End of support date: Windows 10 mainstream servicing and security updates ended on October 14, 2025. Microsoft’s support pages state devices will continue to function but will not receive further technical assistance, feature updates, or security fixes after that date.
• Consumer ESU program: The Extended Security Updates program for Windows 10 is available as a short‑term bridge. Enrollment is open until October 13, 2026, and enrolled devices will receive security‑only updates through that same date for eligible Windows 10 version 22H2 devices. Enrollment methods include staying signed in with a Microsoft account, redeeming Microsoft Rewards, or a one‑time local‑account purchase. ESU does not include new features or technical support.
• Microsoft Defender and app servicing: Microsoft will continue some application‑level updates on independent timelines — notably Microsoft Defender signature and detection updates — which may continue beyond Windows 10’s EoS for a limited period. However, these do not substitute for OS‑level kernel or driver patches that stop vulnerability classes exploited by remote code execution and privilege escalation.

These vendor statements are authoritative: they define the services Microsoft will or will not provide. Any organizational risk assessment should treat them as the baseline.

---

Practical mitigation steps (home users and small businesses)​

Below are tactical, prioritized steps organizations and individual users should implement now. Follow them in order to reduce exposure quickly.

• Inventory first
• Identify every device running Windows 10 and record its role, connectivity, and the sensitivity of the data it handles.
• Flag devices that are externally accessible, used for financial transactions, or that hold regulated data.
• Prioritize upgrades
• For devices that meet Windows 11 requirements, schedule upgrades immediately. Use Microsoft’s PC Health Check or Settings > Windows Update to confirm eligibility.
• Enroll critical devices in ESU only as a bridge
• Use ESU to buy predictable time for complex migrations, not as a long‑term plan. Enroll only devices that cannot be migrated within your budgeted window.
• Isolate legacy systems that must remain online
• If a Windows 10 machine must stay operational for a legacy application, remove it from the internet and limit its network access to a minimal, tightly controlled VLAN. Avoid using such systems for payments or client data.
• Strengthen compensating controls
• Deploy or expand endpoint detection and response (EDR), central logging, multi-factor authentication (MFA), and least‑privilege access. Harden remote access (disable direct RDP if possible) and monitor for abnormal authentication.
• Replace non-upgradeable hardware
• For devices that fail to meet Windows 11 requirements, budget orderly replacement or consider validated alternatives such as Linux distributions or ChromeOS Flex when appropriate.
• User training and fraud awareness
• Expect phishing and fake “upgrade” scams to spike. Train staff and households to ignore unsolicited calls and popup prompts that demand immediate payment for “support” or ESU-like services.
• Document and report
• Maintain an asset register showing which devices are upgraded, enrolled in ESU, isolated, or slated for replacement. Report progress to leadership and, for regulated entities, to compliance officers.

These actions map directly to guidance from Microsoft, regional CISOs, and security practitioners; they are the practical levers that reduce both likelihood and impact of compromise.

---

Organizational strategy: governance, finance and procurement​

Upgrading thousands of endpoints is not purely technical — it is a cross‑functional program that needs finance, procurement and legal engagement.

• Treat end‑of‑support as a board‑level risk item. Include IT, finance, procurement, legal and security in migration planning.
• Use ESU only where migration timelines are predictable. ESU costs can scale with device counts and become expensive if used permanently.
• Reassess cyber‑insurance policies and contract language. Some insurers may shift exposure if claims trace back to unsupported systems.
• Consider refurbishing and re‑imaging programs that use validated hardware upgrades (e.g., TPM module retrofits) where feasible.

Security leaders should present a time‑boxed plan that pairs device refresh with responsible disposal or refurbishment, minimizing both cost and environmental impact. Filing procurement forecasts and securing budget now reduces the risk of rushed, costly purchases later.

---

Strengths and risks of the available options​

Strengths​

• Windows 11 offers improved security primitives. Hardware‑rooted protections like TPM‑backed attestation, virtualization‑based security (VBS), and enhanced exploit mitigations make it materially more difficult to exploit many modern attack vectors.
• ESU is an effective tactical bridge. For short, predictable migration windows, ESU provides vendor‑issued patches to cover critical CVEs and buys breathing room for large or regulated estates.
• Industry playbooks are mature. There is broad awareness and a deep ecosystem of migration tooling, managed service providers and validated PC replacement options.

Risks and limitations​

• Hardware restrictions raise equity concerns. A meaningful share of devices in homes, schools and small businesses are too old to upgrade. Forcing replacement can be costly and raises digital equity issues.
• ESU is temporary and partial. Relying on it long‑term is risky; ESU does not provide feature updates or standard support and expires October 13, 2026.
• Potential for mass exploitation if migration stalls. If large fractions of the installed base remain on unsupported Windows 10, attackers have an economic incentive to develop persistent, automated exploits.

---

What remains uncertain and what to treat with caution​

Some commonly repeated numbers — total counts of Windows 10 devices globally, or exact market share figures — vary across analytics firms and are inherently estimates. Reports citing figures like “400 million personal devices” or specific market‑share percentages should be treated as indicative rather than definitive; different trackers use different methodologies and sampling. Use device counts from internal inventory rather than public estimates to prioritize upgrades. This is a point multiple industry analyses agree on: quoted device totals are useful for prioritization, not exact accounting.
Another area to watch is vendor timelines: Microsoft will continue some app‑level servicing (for example, Defender signatures) on separate windows, but these do not fix the structural absence of OS kernel and driver patches. Relying on Defender updates alone is insufficient.

---

Scenario planning: short, medium and long term​

Short‑term (next 30–90 days)​

• Complete inventory and tag critical systems.
• Enroll high‑value devices in ESU where migration is unrealistic in the immediate term.
• Isolate legacy endpoints and implement compensating controls (EDR, MFA, network segmentation).
• Launch user awareness and anti‑scam campaigns.

Medium‑term (3–12 months)​

• Execute phased Windows 11 upgrades and hardware refresh for non‑upgradeable devices.
• Decommission isolated legacy systems after migration or validated containment.
• Update procurement policies to include lifecycle cost and security requirements.

Long‑term (12+ months)​

• Adopt lifecycle governance that funds periodic refreshes and extended support options.
• Reevaluate architecture for reduced reliance on single‑OS dependencies (cloud alternatives, containerization, platform‑agnostic applications).

This staged approach keeps near‑term risk reductions aligned with fiscal realities and procurement cycles.

---

Final analysis and verdict​

The end of free mainstream support for Windows 10 on October 14, 2025, marks a clear operational inflection point. The vendor‑declared facts are simple and verifiable: Microsoft stopped routine OS patching on that date, and consumer ESU is available only through October 13, 2026.
Security experts’ warnings are not hyperbole but a realistic assessment of the threat mechanics: unsupported systems turn newly discovered vulnerabilities into persistent attack surfaces, and the incentives for attackers to exploit those surfaces scale with the installed base. Regional advisories and associations reinforced the same set of recommendations: inventory, isolate, upgrade where possible, use ESU only as a bridge, and treat any remaining Windows 10 endpoints as high‑risk assets.
For home users and small businesses, the immediate tasks are clear and actionable: confirm upgrade eligibility, back up data, and either upgrade to Windows 11 or enroll critical devices in ESU while planning replacement. For larger organizations, this event demands cross‑functional planning, budgeted refresh cycles and decisive action — treating the end of Windows 10 support not as a distant policy note, but as a board‑level risk that requires measurable remediation.
The practical truth is this: unsupported does not mean unusable, but it does mean progressively less secure. The short window that ESU provides buys time, not a permanent reprieve. Acting now — methodically, with inventory discipline and prioritized risk management — reduces the likelihood that an avoidable vulnerability will become an expensive breach.

---

Quick checklist (printable)​

• Inventory every Windows 10 device and tag by role and data sensitivity.
• Upgrade eligible devices to Windows 11 immediately.
• Enroll only critical devices in Consumer ESU as a short‑term bridge.
• Isolate legacy systems; never use unsupported machines for payments or client data.
• Deploy EDR, MFA, centralized logging and segmentation across the estate.
• Refresh non‑upgradeable hardware; plan procurement and recycling.
• Train users on phishing and fraudulent “support” scams.
• Document progress and report to executive leadership and auditors.

The available tools and mitigations are well understood. The real test is execution: organizations and users that move quickly and deliberately will substantially reduce their risk in the months ahead.

---

Source: KXAN Austin Security experts warn of increased cyber risk after end of Windows 10 support