What happens now that Windows 10 support has ended?

Windows 10 stopped receiving security fixes on 14 October 2025. The machines still boot and the software still runs, but every vulnerability found since that date stays open on them permanently. A year later, a remarkable number of South African businesses are still running it, and most of them know it. The machines still boot, the software still works, and replacing a fleet of computers is nobody's favourite line item. So the decision keeps sliding to next quarter.

Here is the uncomfortable part: "end of support" does not mean the computer stops working. It means Microsoft stopped fixing the holes. Every month since October 2025, security researchers and criminals have kept finding vulnerabilities in Windows, and Windows 11 gets the patches while unsupported Windows 10 machines do not. The gap between the two grows every single month, and attackers specifically hunt for unpatched systems because they are the easy wins. Running an unpatched operating system in 2026 is not a neutral choice. It is an open window that gets wider every patch Tuesday.

What changes for Windows 10 in October 2026?

October 2026 closes the last cheap exits from Windows 10. Consumer Extended Security Updates end on 13 October 2026, and business ESU moves into its second, more expensive year.

Consumer ESU ends: home and micro-business machines enrolled in the one-year consumer programme stop receiving security updates after 13 October 2026, and that programme cannot be extended.
Business ESU year two begins: Microsoft's commercial ESU was priced at about 61 US dollars per device for year one, doubling to about 122 dollars for year two and 244 dollars for year three.
Late joiners pay for the missed year: ESU is cumulative, so a business enrolling now pays for year one as well as year two. For most fleets that makes replacement the cheaper option.
Microsoft 365 Apps keep their updates: Word, Excel, Outlook and the other Microsoft 365 apps still receive security updates on Windows 10 until October 2028. That protects Office, not Windows itself.

What are the real risks of staying on Windows 10?

Staying on Windows 10 carries three concrete risks: security, POPIA and insurance. The security gap widens every patch Tuesday, unpatched systems undermine the "reasonable technical measures" the Act requires, and most cyber policies can be repudiated because they require a supported operating system. The risk is not abstract, and it is not only technical. For a South African business it stacks up in three specific ways.

The security gap compounds: Ransomware operators reverse-engineer each new Windows 11 patch to find the matching hole in older systems. The longer a machine goes unpatched, the larger the menu of known, documented, weaponised vulnerabilities it exposes.
POPIA does not care about your hardware budget: If you process personal information on systems with known, unpatched vulnerabilities, you will struggle to argue you took the "reasonable technical measures" POPIA requires. A breach through a known Windows 10 hole is a hard conversation with the Information Regulator.
Your cyber insurance may quietly lapse: Many policies require supported, patched operating systems as a condition of cover. An assessor who finds unsupported Windows 10 machines after an incident has an easy reason to repudiate the claim. Check your policy wording before you assume you are covered.

What is Extended Security Updates (ESU) and is it worth paying for?

Extended Security Updates (ESU) is a paid Microsoft programme that keeps security patches coming to Windows 10 after end of support. Consumer ESU ran for one year only and ends on 13 October 2026, while business ESU runs up to three years, with the per-device price doubling each year. That makes it worth buying for a handful of machines you genuinely cannot move, and a waste across a whole fleet. Microsoft sells Extended Security Updates, or ESU, as a paid bridge for organisations that need more time. It is exactly that: a bridge, priced to push you off it.

For consumers: the ESU programme covered one year only and ends on 13 October 2026. If your home or micro-business machines enrolled in it, their security updates stop now and the programme cannot be extended.
For businesses: ESU runs up to three years, but the per-device price doubles each year, and enrolling late means paying for the years you missed. Year one was manageable; by year three you will have paid more per machine than a decent chunk of a replacement. Microsoft designed it that way on purpose.
ESU is security-only: no new features, no bug fixes, no support tickets. It keeps the window closed while you plan; it is not a plan by itself.

One genuinely useful nuance: Microsoft 365 Apps (Word, Excel, Outlook and friends) continue to receive security updates on Windows 10 until October 2028. That softens the edge for a carefully managed transition, but it protects Office, not Windows itself.

Why will some PCs not upgrade to Windows 11?

Most business machines bought before 2018 fail the Windows 11 hardware check, no matter how well they still run. Windows 11 requires TPM 2.0, Secure Boot and roughly an Intel 8th-generation or AMD Ryzen 2000 processor or newer. The upgrade to Windows 11 is free, which sounds like the easy answer until the hardware check fails. Windows 11 requires TPM 2.0 (a security chip), Secure Boot, and a relatively recent processor, roughly Intel 8th generation or AMD Ryzen 2000 and newer. In practice, most business machines bought before 2018 will not qualify, and plenty of 2018 and 2019 machines sit right on the line.

Some of those older machines have TPM chips that are simply switched off in the BIOS, and a five-minute change makes them eligible. Others are genuinely excluded. There are registry tricks floating around the internet to force Windows 11 onto unsupported hardware; do not do this to a business machine. Microsoft does not guarantee updates on unsupported installs, which recreates the exact problem you were trying to escape.

How do you decide which PCs to upgrade and which to replace?

Sort every machine into one of three buckets: upgrade, replace or buy ESU. Upgrade in place if it passes the Windows 11 check, replace it if it fails and is four or more years old, and buy ESU only for the few that fail but run something genuinely hard to move. Every Windows 10 machine in your business lands in one of three buckets. The work is sorting them, and the sorting is quick.

Bucket one, upgrade in place: The machine passes the Windows 11 hardware check. Upgrade it, free, scheduled outside working hours. For most fleets this covers everything bought from about 2019 onward.
Bucket two, replace: The machine fails the check and is four or more years old anyway. Replacing it is not a Windows 11 cost; it was already due. Our article on the hidden cost of old hardware runs the numbers, and they rarely favour keeping the old machine once support hours and downtime are counted. Buying through a procurement partner at volume pricing takes a meaningful slice off the sticker price.
Bucket three, ESU while you plan: The machine fails the check but runs something genuinely hard to move, like a controller for specialised equipment. Pay for ESU on those specific machines only, isolate them on the network, and put a retirement date in the diary. ESU for a whole fleet is a money fire.

Windows 10 fleet: which machines to upgrade, replace or bridge with ESU
Bucket	Test	Action	Typical cost
Upgrade in place	Passes the Windows 11 hardware check (TPM 2.0, Secure Boot, Intel 8th gen / Ryzen 2000 or newer)	Free in-place upgrade, scheduled out of hours	R0 in licences, about an hour of labour per machine
Replace	Fails the check and is four or more years old	Replace on the normal refresh cycle; the cost was already due	R9,000 to R18,000 per business laptop
Bridge with ESU	Fails the check but runs something that genuinely cannot move, such as equipment control software	Buy ESU for those machines only, isolate them on the network, set a retirement date	Per device, roughly doubling each year

Two things make the whole exercise cheaper. First, laptops replaced in this cycle come with a built-in benefit for load shedding resilience, because a laptop rides out an outage that kills a desktop mid-save. Second, if you are moving files and email to the cloud anyway, the new machines need less local horsepower than the old ones did, and mid-range hardware is usually enough.

How do you run a Windows 11 migration without disruption?

Audit the fleet first, then stage the rollout department by department. Test the awkward legacy software on one machine before it spreads, and move files into OneDrive, SharePoint or Google Drive first, so that swapping a machine becomes a sign-in rather than a data rescue. A Windows 11 migration done properly is boring, and boring is the goal.

Audit first: Run the hardware check across the fleet and list what passes, what fails, and what each failing machine actually does all day.
Test the awkward software: That one ancient payroll utility or scanner driver is the thing that bites. Test it on one Windows 11 machine before you schedule fifty.
Stage the rollout: A department at a time, with files already in OneDrive, SharePoint or Google Drive so a machine swap is a sign-in, not an archaeology project.
Wipe before disposal: Old drives hold company and client data. Proper data destruction is a POPIA requirement, not a nicety, and responsible e-waste disposal is part of the job.

What is the bottom line on Windows 10?

Before you migrate anything, confirm your restores work: our backup and recovery guide is the short version of what to test.

Sort the fleet now, upgrade everything that qualifies, and budget replacements over two or three quarters rather than waiting for an incident to force the decision. Windows 10 was a good ten-year run, but carrying it into 2027 is a risk decision, not a savings decision. The free upgrade covers most machines bought in the last six years, ESU buys breathing room for the stragglers at a price designed to sting, and the machines that qualify for neither were due for replacement anyway.

If you do not know which bucket your fleet falls into, that audit is an afternoon of work with the right tools. AMEA runs Windows 11 readiness checks for South African businesses, plans the migration around your team's working hours, and sources replacement hardware at partner pricing when replacement is genuinely the cheaper path.