When Windows 10 support ended in October 2025, we wrote that nothing would visibly break - the risk was the invisible kind, accumulating one unpatched vulnerability at a time. A year on, the situation has changed in three specific ways, and this time there are dates and prices attached.
If your business still runs Windows 10 machines - and plenty of London small businesses do - this is the year the maths stops being ambiguous.
Three things change in 2026
First: the consumer safety net disappears. The consumer Extended Security Updates programme, which many small businesses quietly relied on, ends on 13 October 2026. There is no consumer year two. After that date, a Windows 10 machine outside a business ESU agreement receives no security updates at all.
Second: business ESU gets expensive, deliberately. Microsoft's commercial programme runs for up to three years, priced at $61 per device for year one, doubling each year: $61, then $122, then $244. Two details matter for anyone deciding late. ESU is cumulative - enrol in year two and you pay year one retroactively, so a first-time year-two enrolment costs $183 per device. And it buys security patches only: no features, no non-security fixes, no technical support.
Third: Secure Boot certificates from 2011 are expiring. This one is separate from the end-of-support story and affects Windows 11 machines too. The certificates that anchor Secure Boot - the mechanism that stops malware loading before Windows does - began expiring in June 2026 (Microsoft Corporation KEK CA 2011 on 24 June; Windows Production PCA 2011 on 19 October). To be clear about what this does and doesn't mean: devices without the updated 2023 certificates continue to start and update normally. What they lose is new protections for the early boot process - updates to the boot manager, revocation lists, and fixes for newly discovered boot-level vulnerabilities. Most managed, updated devices receive the new certificates automatically; unmanaged and older machines may need firmware updates from the manufacturer, and that's exactly the category of machine most likely to still be running Windows 10.
The actual maths
Take a typical small-business machine: a five-year-old laptop that cost £700 new, worth perhaps £120 today.
Keeping it on business ESU through 2028 costs $427 in update fees - roughly £340 - to protect hardware worth a third of that, while getting no new features and no support. That is not a bridge; it's a subscription to standing still.
Against that: a capable business laptop that runs Windows 11 comfortably starts around £500–£700, and if the existing machine meets Windows 11's hardware requirements, the upgrade itself is free.
ESU has a legitimate use: buying defined time for machines that genuinely cannot move yet - a device running legacy software awaiting replacement, or a fleet mid-migration. It is a deliberate, priced delay. What it should not be is the default option chosen by not choosing.
Deciding machine by machine
The decision is simpler than it looks if you take it per device rather than per fleet:
- Machine meets Windows 11 requirements (8th-gen Intel/2nd-gen Ryzen or newer, TPM 2.0) → upgrade now, free. The main cost is an hour of checking that your key software runs, which you can test on one machine before rolling out.
- Machine can't run Windows 11 but does light work (email, browser, documents) → replace on your schedule, before October. Waiting past the deadline doesn't save money; it moves the purchase to whenever an incident forces it.
- Machine can't move because software holds it hostage → business ESU, with an exit date. Pay for year two if you must - but attach a project to it: replacing or migrating whatever it is that's keeping the machine on Windows 10. ESU without an exit plan just repeats this decision in 2027, at double the price.
- Any machine staying on Windows 10 without ESU → take it off the internet or out of service. For a business device handling client data, "unpatched but fine so far" is not a position you want to explain to an insurer or a client after the fact.
Start with an inventory - the same advice as last year, but with a deadline now. Ten minutes per machine: model, Windows 11 eligibility, what it's used for, what it would cost to replace. Most businesses we see have a shorter "genuinely stuck" list than they feared.
The default decision for 2026
Microsoft's pricing here is not subtle, and it isn't meant to be: doubling fees and retroactive enrolment are designed to make delay cost more than action. We'd rather say that plainly than pretend ESU is a neutral option. For nearly every small business, the right move in 2026 is to upgrade what can be upgraded, replace the light-duty stragglers, and reserve ESU for the short list of machines with a documented reason and a documented exit.
And a note on the machines you replace: “can't run Windows 11” does not mean “worthless”. Many of these devices have years of useful life with a lightweight operating system, as spares, or through refurbishment. The better test is to decide by the machine's role rather than its age.
Sources
- Microsoft Learn - Extended Security Updates (ESU) program for Windows 10
- Microsoft - Windows 10 Consumer Extended Security Updates
- Microsoft Windows IT Pro Blog - Act now: Secure Boot certificates expire in June 2026
- Microsoft Support - Windows Secure Boot certificate expiration and CA updates
- Microsoft - Windows 11 specifications and requirements
Not sure which machines can make the jump? A device audit is part of our business IT support, with an upgrade, bridge or replacement decision for each machine. Ask us to check the fleet.
