Windows 10 stopped receiving free security updates on 14 October 2025. Any PC still running it no longer gets the monthly patches that fix newly discovered security holes, and the longer those machines stay on desks, the more exposed they become. You have three realistic choices: upgrade eligible PCs to Windows 11 for free, pay for Extended Security Updates as a short-term bridge, or replace the hardware that cannot run Windows 11. The one option that causes real problems is doing nothing.
If you still have Windows 10 machines in the office, it is worth sorting out properly rather than letting it drift. Here is what actually changed, why it matters for a UK business specifically, and how to plan a sensible response without an eye-watering bill.
What "end of support" actually means
Your Windows 10 computers did not stop working on 14 October 2025. They keep switching on quite happily and will do for years. The change is invisible day to day, which is precisely why it catches people out. Microsoft has simply stopped releasing the security updates that close vulnerabilities as attackers find them.
New weaknesses in Windows turn up every month. On a supported system they get patched automatically in the background. On an unsupported one they stay open for good. So a Windows 10 machine is a little less safe than it was last year, and it slips a little further each time a fresh flaw is found and left unfixed. Antivirus and a firewall help, but neither can cover a hole in the operating system itself.
Why this is a compliance problem, not just a security one
For most UK businesses the security risk is only half the story. Running unsupported software can trip you up on two fronts you may be relying on without thinking about it.
Cyber Essentials
If you hold Cyber Essentials certification, or you need it to win work (plenty of public sector and supply-chain tenders now insist on it), an unsupported operating system is a straight fail. The scheme requires that all software in scope is still supported by the vendor and receiving security updates. A Windows 10 PC without paid updates breaks that requirement, and your renewal will not pass until it is dealt with.
UK GDPR and the Data Protection Act 2018
The law requires you to put "appropriate technical and organisational measures" in place to protect personal data. Processing customer or staff data on a computer that no longer receives security patches is hard to argue is appropriate. If you had a breach that traced back to an unpatched Windows 10 machine, the ICO would reasonably ask why it was still in service, and that is not a position you want to be defending after the event.
Your three options
There is no single right answer. The sensible mix depends on how old your machines are and whether they can take Windows 11.
1. Upgrade eligible PCs to Windows 11 (free)
Where a computer meets the Windows 11 hardware requirements, the upgrade itself costs nothing, and this is the outcome you want wherever you can get it. As a rough guide, a PC bought new from around 2019 onwards stands a decent chance of being eligible, though that is not a guarantee and there are exceptions in both directions.
2. Pay for Extended Security Updates (ESU)
Microsoft sells Extended Security Updates as a paid bridge for machines you cannot upgrade yet. For businesses it starts at roughly £60 per device in the first year (around $61 USD through volume licensing), and the price doubles every year after that. ESU delivers critical and important security patches only - no new features, no general bug fixes, no technical support - and the programme stops in October 2028. Treat it as breathing space to plan a replacement rather than a destination. You also cannot game it by joining late: the licences are cumulative, so starting in year two still means paying for year one.
3. Replace incompatible hardware
Older PCs that fail the Windows 11 requirements need replacing. That is real money, but a machine from 2017 or earlier is usually near the end of its working life anyway, running slowly and quietly costing staff time every day. A replacement puts you on supported, faster hardware that will comfortably see out the rest of the decade.
How to tell whether a PC can run Windows 11
The two requirements that catch most older machines are TPM 2.0 (a small security chip) and a supported processor. Broadly, Windows 11 needs an Intel 8th-generation CPU or newer, or an AMD Ryzen 2000 series or newer, along with 4GB of RAM and 64GB of storage.
For a single machine, the quickest check is Microsoft's free PC Health Check app. It scans the computer and tells you plainly whether it qualifies and, if not, why. One thing worth knowing: some PCs have a TPM chip that is simply switched off in the firmware, so a machine that looks incompatible can sometimes be made eligible with a settings change rather than a new purchase. That distinction matters, because it can be the difference between a free fix and £600 spent for no reason.
Checking one PC is easy. Checking thirty, and working out which apparent failures are genuine and which are a two-minute firmware tweak, is where it gets fiddly. This is the kind of audit an MSP runs across your whole estate in one pass, so you end up with an accurate split of "upgrade free", "needs a firmware change" and "must replace" rather than a pile of guesses.
Spread the cost with a phased refresh
The thing that stops most businesses acting is the fear of replacing every machine at once. You rarely need to. A workable plan tends to look like this:
Audit every device and sort it into upgrade-now, firmware-fix or replace.
Upgrade all eligible PCs to Windows 11 straight away, at no cost.
Identify the genuinely incompatible machines and rank them by age and risk.
Replace the oldest and most exposed first, then phase the rest across the following months or your next budget year.
Use ESU only on the specific machines you cannot replace immediately, so you are paying for a handful of devices rather than the whole office.
Handled this way, the bulk of your machines move to supported software for nothing, and the hardware spend is staged across the budget instead of landing as one lump in a single quarter.
What to do next
If you are not sure how many Windows 10 machines you have, or which of them can take Windows 11, that is the first thing to pin down. Once the real numbers are in front of you, the decision usually makes itself, and it is almost always less painful than the worst case you have been imagining.
We help businesses across Berkshire, Oxfordshire and London audit their machines, upgrade everything that can be upgraded for free, and plan a phased refresh for the rest so it fits the budget. If you would like a clear picture of where you stand and what it will actually cost, we are happy to take a look.