Windows 10's second deadline: your ESU safety net ends in October 2026
Paid Windows 10 Extended Security Updates run out on 13 October 2026 for business — and year two costs double. Your options, explained in plain English.
If your business bought itself a year of Windows 10 breathing room, that year runs out on 13 October 2026 — and the next one costs double. Here's the countdown plan.
When Windows 10 support ended in October 2025, plenty of businesses did the pragmatic thing: paid for a year of Extended Security Updates (ESU) and moved on. Fair call. But ESU year one ends on 13 October 2026, and this second deadline is easy to sleepwalk past — there is no big headline this time, just a renewal notice and a price that has doubled.
What exactly happens on 13 October 2026?
On 13 October 2026, business devices covered by ESU year one stop receiving security patches unless year two is purchased. Year two costs roughly double year one, per device, and year three doubles it again before the program ends for good in October 2028. Microsoft designed the pricing as a ratchet — each year you stay, the exit gets more expensive.
There is a second, quieter 2026 problem: Secure Boot certificates on many older machines begin expiring from mid-2026, needing firmware and update attention of their own. Old fleets are collecting deadlines.
What are your options between now and October?
Between now and October, a business with Windows 10 machines has three honest options — and the right answer is usually a mix:
Upgrade in place.
Machines that meet the Windows 11 hardware requirements upgrade free. Many 2019-or-later devices qualify and simply never got around to it.
Replace on a schedule.
Hardware that cannot run Windows 11 is generally 6+ years old — past its sensible business life anyway. A staged replacement between now and October, planned through IT procurement, spreads the cost and avoids a December scramble.
Buy ESU year two — deliberately.
Legitimate for a machine tied to legacy software that cannot move yet, but only with a dated exit plan. See our companion explainer on how the ESU maze works.
Why "we'll risk it" is the one wrong answer
Running Windows 10 with no ESU means every new Windows vulnerability stays open on your machines forever. Attackers reverse-engineer each month's Windows 11 patches and point the result at unpatched systems — the risk compounds monthly. It also has flow-on effects: cyber insurers ask about unsupported operating systems, and an unpatched fleet is a hard question to answer well at renewal. Unsupported systems sit squarely inside the Essential Eight's patching controls for a reason.
The 8-week plan
Week 1–2: audit.
Count every Windows 10 device, check Windows 11 eligibility, flag the legacy-software stragglers.
Week 3–6: upgrade wave.
Eligible machines move to Windows 11, tested against your critical applications first.
Week 6–8: replacement orders.
Ineligible machines are quoted, ordered and staged — arriving configured, not in boxes.
October: nothing happens.
Which is the point.
Frequently asked questions
How do I know which machines can run Windows 11?
Windows 11 needs a compatible 8th-generation-or-newer Intel (or equivalent AMD) processor, TPM 2.0 and Secure Boot. Microsoft's PC Health Check tool reports per machine — or we audit the whole fleet in one pass as part of managed IT.
Is ESU year two worth it for a handful of machines?
As a bridge, sometimes. As a strategy, no — the price doubles again for year three and the program ends in 2028. Pay for it only alongside a dated plan to retire the need.
Will Windows 11 disrupt our team?
Less than people fear. The working day looks almost identical, files and applications carry across, and we schedule upgrades outside working hours so most staff just sign in to a newer machine.
What about the Secure Boot certificate issue?
From mid-2026, expiring Secure Boot certificates need firmware and Windows updates applied to keep older machines booting securely. It is handled as routine patching on a managed fleet — one more reason unmanaged old hardware is a false economy.
Beat the ratchet
An audit takes days and turns October from a deadline into a non-event. Talk to us before the renewal notice arrives — Managed IT support clients get this planned as standard.
Related Key IT services
More insights
Windows 10 ESU: free vs paid
Consumer Windows 10 security updates now run to 2027 — but business terms are unchanged. What's…
Read article →Windows 10Windows 10 end of life
Windows 10 support ended in October 2025. If your business is still running it, here's the risk and…
Read article →RansomwareRansomware hits Australian construction
An Australian construction consultancy was listed by a ransomware crew this month. Why project…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.