Still on Windows 10 One Year On? What Happens Next
Nothing visibly happened on 15 October 2025. The PCs started up, Outlook opened and the finance team carried on as usual. That is the quiet trick of an operating system reaching end of support: it does not break, it simply stops being repaired. A year on, the businesses still running Windows 10 are finding out what that difference means in practice.
What a year without patches looks like
Microsoft ended support for Windows 10 on 14 October 2025. Since then, security updates only reach PCs enrolled in the Extended Security Updates (ESU) program. ESU is a paid arrangement that delivers critical security fixes only, with no new features or technical support. It has not been idle either. Updates for enrolled Windows 10 machines during 2026 have included zero-day fixes, six of them in February alone. A zero-day is a flaw that was already being exploited, or publicly known, before a fix existed.
Every month, on Patch Tuesday (the second Tuesday, when Microsoft releases its security updates), Microsoft publishes a list of what it has fixed. Defenders read that list, and so do attackers. A PC that is not receiving the fixes is left with a freshly published catalogue of known weaknesses and no way to close them, and the gap widens every month.
Microsoft 365 apps are a partial exception. Microsoft 365 Apps on Windows 10 continue to receive security updates until October 2028. That keeps Word and Outlook patched, but the operating system underneath them, which is where much of the risk sits, is a separate matter.
Why the “extension” headlines confuse people
You may have seen that Microsoft extended Windows 10 support. It did, but only for personal devices. The free consumer program now runs to 12 October 2027, and it does not cover business use.
Business devices sit in the commercial program, which is sold per device in three annual periods. Year one ends on 13 October 2026, year two on 12 October 2027 and year three on 10 October 2028, with the price doubling each year. Year one closes this week, so any business still relying on it faces a decision about year two now. The years are also cumulative: enrolling late means paying for the earlier year as well. Confirm the exact terms with your licensing partner before committing.
The practical reading is that ESU buys time, not a destination. It has a hard end date, it costs more each year, and 2028 is the furthest it goes.
What the Essential Eight says about it
Patching operating systems is one of the Essential Eight, the Australian Government’s baseline for cyber resilience, and the requirement has two parts. The first is speed: patching windows are measured in days and weeks, and as short as 48 hours when a vulnerability is rated critical or a working exploit exists. The second is support, and it is blunt: operating systems that are no longer supported by vendors are replaced. That wording applies from the first maturity level up.
The awkward question is whether a device on ESU counts. It still receives patches, so it is in a very different position from a machine with no coverage at all. But whether it satisfies “supported by the vendor” is a judgement that depends on the assessor and the context, and we would not assume the answer. We would treat ESU as a documented, time-limited exception rather than a pass.
The same logic shows up outside formal frameworks. Cyber insurance applications and client security questionnaires commonly ask whether any device runs an unsupported operating system. A “yes” with a dated plan reads very differently from a “yes” with a shrug.
Why some Windows 10 devices are still in use
In our experience, the Windows 10 devices still running a year later are rarely the obvious ones. The main office PCs went first because people noticed them. What is left usually falls into four groups.
Machines that cannot run Windows 11. Windows 11 needs a security chip called TPM 2.0 and a reasonably recent processor. A PC can work perfectly well and still be ineligible, which means replacing it rather than upgrading it. That costs money, and it is a hard sell for a machine that seems fine.
Machines tied to one older application. Some line-of-business software and specialised equipment, such as the workshop or warehouse computer, was built and tested on Windows 10. Nobody wants to risk the one program the team depends on, so the PC stays where it is.
Machines nobody is watching. The shared PC at reception or in a meeting room, and the laptop that rarely visits the office, often sit outside normal reporting. They are easy to miss, and they often still have access to something that matters.
Machines that look fine. Nothing breaks when support ends, so there is no outage to prompt action. Some businesses also saw the headlines about Microsoft extending Windows 10 support and assumed they were covered, when that extension applies to personal devices only.
The hardware group is the one to plan for first, because replacement takes budget and lead time.
What to do this month
- Count everything. Build a live inventory of every device and its Windows version, including the laptops that seldom connect. Last year’s spreadsheet will not do.
- Sort into three groups. Devices that can upgrade in place, devices that need replacing, and devices that genuinely cannot move yet.
- Contain the third group. Cover them with ESU for as long as they need it, keep them away from general web browsing and email, limit administrator rights, separate them from the rest of the network and make sure endpoint protection is running. This reduces risk without removing it.
- Write it down. Record which devices remain, why, and when each will be gone. That record is your evidence for an assessor, an insurer or a client.
Windows 10 will keep starting up every morning. That has been the whole problem since day one.
Windows 10 to Windows 11 Migration Help for Australian Businesses
Affinity MSP helps Australian businesses move off Windows 10 by starting with the inventory. Across the environments we manage, our vulnerability management tooling (ConnectSecure) flags devices running unsupported operating systems, including the ones quietly falling behind. From there we sort the list with the business: staged upgrades and replacements timed to budget cycles, ESU only where a machine genuinely needs the extra time, and a written record of exceptions that lines up with Essential Eight expectations. The aim is a plan the business can explain to its insurer without wincing.
If you would like a second opinion on how many Windows 10 devices are still out there, our Essential Eight support and managed IT services teams are happy to take a look. You can contact us any time.
Frequently asked questions
Is it safe to keep using Windows 10 in 2026?
For a business, only with coverage and a plan. Without ESU, a Windows 10 PC receives no security fixes, so the risk grows every month. With ESU it still receives critical and important patches, but only for a limited time.
Does Windows 10 ESU meet the Essential Eight?
It keeps security patches flowing, which matters, but the Essential Eight expects operating systems that are no longer vendor-supported to be replaced. Treat ESU as a documented, temporary exception and confirm how your assessor views it.
How long can a business stay on ESU?
Up to three years in total, ending 10 October 2028, with the cost rising each year. Microsoft does not allow part-year purchases.
Can every Windows 10 PC be upgraded to Windows 11?
No. Windows 11 needs a TPM 2.0 security chip and a supported processor, so older hardware generally needs replacing rather than upgrading.
How does Affinity MSP help with Windows 10 end of support?
We inventory every device and flag unsupported operating systems, separate the machines that can upgrade from those that need replacing, plan ESU coverage only where it is justified, and document the remaining exceptions so they stand up to an Essential Eight review, an insurer or a client questionnaire.
