Businesses still running Windows 10 need to act before October 13, 2026, when the first year of Microsoft's Extended Security Updates (ESU) program expires. After that date, staying protected means either paying for a second year of ESU coverage or migrating to Windows 11, because Windows 10 itself stopped receiving free security patches when mainstream support ended on October 14, 2025.
This isn't a niche problem. HP's CFO told investors in July 2026 that roughly 30% of all PCs in active use are still running Windows 10 (PCWorld, 2026), meaning a large share of businesses are approaching this deadline without a plan.
What Is Windows 10 ESU and Why Does the Date Matter?
Extended Security Updates (ESU) is Microsoft's paid program that keeps critical security patches flowing to Windows 10 after its official end-of-support date, sold in three sequential one-year tiers rather than as a flat multi-year plan (ManagedSolution, 2026):
- Year 1: October 15, 2025 to October 13, 2026, $61 per device
- Year 2: October 14, 2026 to October 12, 2027, $122 per device
- Year 3: October 13, 2027 to October 12, 2028, $244 per device
Pricing is cumulative for anyone enrolling late. Skipping Year 1 and jumping straight to Year 2 coverage costs $183 per device retroactively, not just $122. October 13, 2026 is the date Year 1 coverage lapses, which means any business that enrolled for Year 1 only now has to decide whether to pay for Year 2 or migrate off Windows 10 entirely.
What Happens If You Don't Renew or Migrate?
Once ESU coverage lapses without renewal, a Windows 10 machine keeps running normally but stops receiving patches for newly discovered vulnerabilities. Every security flaw found in Windows 10 from that point forward stays open on that device indefinitely. That's a materially different risk than a typical unpatched app: it applies to the operating system underneath everything else running on the machine, including whatever business software, email client, or remote access tool an attacker would use as an entry point.
Should You Pay for ESU or Just Upgrade to Windows 11?
For most businesses, migrating to Windows 11 is the more durable answer, since ESU is explicitly a bridge program that gets more expensive every year and still ends entirely in October 2028. Paying into it repeatedly without a migration plan just delays an unavoidable cost. ESU makes sense as a short-term option specifically for hardware that can't meet Windows 11's requirements and needs another budget cycle before replacement, or for specialized and legacy systems where an in-place upgrade carries its own operational risk.
Why Manufacturers May Have to Live With Windows 10 for Now
Manufacturing is the industry where "just upgrade" is hardest to say with a straight face. On the office side, a Windows 11 migration is mostly a hardware and scheduling exercise. On the plant floor, the operating system is often welded to the equipment it controls, and the decision is not yours alone to make.
A typical scenario: a machine shop runs a CNC mill whose controller software was certified by the machine builder for Windows 10 and nothing newer. The same PC also runs a Manufacturing Execution System (MES) client that logs jobs and feeds production data to the ERP. The MES vendor has a Windows 11 release on its roadmap, but the version this shop is on requires a paid upgrade, a database migration, and re-validation of every work instruction. The machine builder has no Windows 11 driver at all and has quietly stopped updating the product line. Upgrading that one PC means either taking the mill offline until both vendors catch up or accepting an unsupported configuration on a machine that earns money every hour it runs.
This pattern repeats across the shop floor and the OT (operational technology) environment more broadly:
- MES, SCADA, and HMI software is frequently pinned to a specific Windows build by the vendor. Running it on an unqualified OS can void support agreements, and in regulated or certified environments (ISO, AS9100, ITAR, CMMC) it can break a validated configuration.
- PLC programming tools, motion controllers, and vision systems often depend on 32-bit drivers, serial or USB dongles, or legacy communication stacks that have no Windows 11 equivalent.
- The PC is bundled with the machine. The equipment builder, not the shop, decides when the controller gets a new OS, and that timeline is tied to the machine's lifecycle, not Microsoft's.
- Downtime to test an upgrade is the real cost. Even when compatibility is likely, a shop running two shifts cannot easily spare a line for a day of testing and rollback.
For these systems, ESU is not procrastination. It is the correct bridge while vendor roadmaps, machine replacement cycles, and validation schedules catch up. The mistake is treating an ESU-covered OT machine the same as any other PC. It should be isolated on a segmented OT network with no general internet or email access, no local admin browsing, and tightly controlled remote access. That way, the exposure is limited to the machine's actual job, and ESU buys real time instead of false comfort.
The office fleet still gets migrated on schedule. The plant floor gets a written plan: which machines stay on Windows 10, why, what the vendor's stated path is, what the replacement date looks like, and how each one is segmented in the meantime. That is the difference between a defensible decision and an overlooked one.
What Should a Business Do Right Now?
Start by inventorying which devices are still on Windows 10 and which of those meet Windows 11's hardware requirements (TPM 2.0 being the most common blocker for older machines). Devices that qualify should be scheduled for upgrade before the Year 1 window closes. Devices that don't qualify, or that are tied to production equipment and vendor-certified software, need a decision between ESU enrollment as a stopgap and hardware or system replacement. Waiting until after October 13 doesn't remove the decision. It just removes the option to make it calmly instead of reactively.
Frequently Asked Questions
When does Windows 10 ESU Year 1 end?
Year 1 of Microsoft's Extended Security Updates program for Windows 10 ends October 13, 2026. After that date, continued security patches require enrolling in (and paying for) Year 2 coverage.
How much does Windows 10 ESU cost for businesses?
ESU is priced in three annual tiers: $61 per device for Year 1, $122 for Year 2, and $244 for Year 3, with pricing cumulative for anyone who enrolls after Year 1 has already started.
Is Windows 10 still safe to use after October 2026?
A Windows 10 device with active ESU coverage continues receiving critical security patches. Without ESU, the device keeps functioning but no longer receives patches for newly discovered vulnerabilities, which increases risk over time rather than causing an immediate failure.
How many businesses are still running Windows 10?
Industry estimates put Windows 10 usage at around 30% of all active PCs as of mid-2026, according to comments from HP's CFO, a large enough share that most businesses likely have at least some Windows 10 devices still in use.
Should my business upgrade to Windows 11 or pay for ESU?
Windows 11 migration is the more durable long-term choice for any device that meets its hardware requirements. ESU is best used as a short-term bridge for machines that can't yet be upgraded or replaced, not as an ongoing substitute for migration.
My CNC or MES software only supports Windows 10. What are my options?
Enroll those specific machines in ESU, isolate them on a segmented OT network, and get the vendor's Windows 11 support timeline in writing. Migrate everything else on schedule so the exception list stays small and documented.
Not sure which of your machines are still exposed, or which ones on the shop floor can't move yet? Infortech helps Bay Area manufacturers and other businesses inventory, patch, segment, and migrate systems before deadlines like this one become emergencies. Get a fit assessment to find out where you stand.