Mainstream Windows 10 support ended in October 2025, and the grace of Extended Security Updates only delays the reckoning — at an escalating price. If your fleet still has a tail of Windows 10 devices in 2026, you have three honest choices: pay for ESU, upgrade in place to Windows 11, or replace the hardware. The right answer is rarely the same for every device. This is the practical decision framework for UK businesses still working through a mixed fleet.
Where the deadlines actually sit
Consumer and mainstream Windows 10 reached end of support on 14 October 2025. Paid Extended Security Updates (ESU) buy time — up to three years for organisations via volume licensing or a cloud provider — but the price escalates each year by design, to push migration rather than reward delay. The long-term-servicing (LTSC/LTSB) editions run on their own, later clocks. The point is simple: ESU is a bridge, not a destination, and every year on it costs more.
Running Windows 10 unpatched after support is the one option that isn't really an option — it fails Cyber Essentials, most cyber-insurance conditions, and basic due diligence the moment a vulnerability lands with no fix.
The three paths, per device
Triage the fleet rather than treating it as one decision:
- •Upgrade in place to Windows 11 — for devices that meet the hardware bar (TPM 2.0, supported CPU, Secure Boot). The cheapest path where the kit qualifies.
- •Pay ESU — for a small set of devices that genuinely can't move yet (a pinned application, a certification dependency). Treat it as a time-boxed bridge with an end date, not a renewal habit.
- •Replace the hardware — for devices that fail the Windows 11 bar or are simply old enough that a refresh is overdue. Often the lowest total cost once you account for escalating ESU fees and support time.
The hidden Windows 11 hardware gate
The reason this is a fleet project and not a software update is the Windows 11 hardware requirements. Devices without TPM 2.0, Secure Boot or a supported CPU can't take the in-place upgrade, and on an older fleet that can be a large minority. The practical move is an audit first: how many devices qualify for the free upgrade, how many need ESU as a short bridge, and how many should simply be refreshed — then cost the three buckets against each other, including the escalating ESU price and the security risk of the long tail.
What we'd advise
For most UK businesses the cheapest defensible plan is: upgrade everything that qualifies, refresh the devices that don't (it's usually cheaper over two to three years than stacking ESU), and reserve ESU for a deliberately small, time-boxed set with a hard exit date. Build the device refresh around what staff actually do — and remember that moving the fleet is also the moment to confirm your Microsoft 365 data is independently backed up.
Servnet can audit the fleet, size the Windows 11-ready vs replace split, and supply business laptops and desktops to match — quoting refurbished where it stretches the budget further.