Still on Windows 10? Your Real Options in 2026

The Deadline Passed. The Machines Are Still Here.

Windows 10 reached end of support on 14 October 2025. Nine months later, a remarkable number of South African businesses are still running it, and most of them know it. The machines still boot, the software still works, and replacing a fleet of computers is nobody's favourite line item. So the decision keeps sliding to next quarter.

Here is the uncomfortable part: "end of support" does not mean the computer stops working. It means Microsoft stopped fixing the holes. Every month since October 2025, security researchers and criminals have kept finding vulnerabilities in Windows, and Windows 11 gets the patches while unsupported Windows 10 machines do not. The gap between the two grows every single month, and attackers specifically hunt for unpatched systems because they are the easy wins. Running an unpatched operating system in 2026 is not a neutral choice. It is an open window that gets wider every patch Tuesday.

What Staying Put Actually Costs

The risk is not abstract, and it is not only technical. For a South African business it stacks up in three specific ways.

• The security gap compounds: Ransomware operators reverse-engineer each new Windows 11 patch to find the matching hole in older systems. The longer a machine goes unpatched, the larger the menu of known, documented, weaponised vulnerabilities it exposes.
• POPIA does not care about your hardware budget: If you process personal information on systems with known, unpatched vulnerabilities, you will struggle to argue you took the "reasonable technical measures" POPIA requires. A breach through a known Windows 10 hole is a hard conversation with the Information Regulator.
• Your cyber insurance may quietly lapse: Many policies require supported, patched operating systems as a condition of cover. An assessor who finds unsupported Windows 10 machines after an incident has an easy reason to repudiate the claim. Check your policy wording before you assume you are covered.

The ESU Bridge, and Why It Is Now a Short One

Microsoft sells Extended Security Updates, or ESU, as a paid bridge for organisations that need more time. It is exactly that: a bridge, priced to push you off it.

• For consumers: the ESU programme covers one year only, ending in October 2026. If your home or micro-business machines enrolled in it, that protection expires in a few months and cannot be extended.
• For businesses: ESU runs up to three years, but the per-device price roughly doubles each year. Year one was manageable; by year three you will have paid more per machine than a decent chunk of a replacement. Microsoft designed it that way on purpose.
• ESU is security-only: no new features, no bug fixes, no support tickets. It keeps the window closed while you plan; it is not a plan by itself.

One genuinely useful nuance: Microsoft 365 Apps (Word, Excel, Outlook and friends) continue to receive security updates on Windows 10 until October 2028. That softens the edge for a carefully managed transition, but it protects Office, not Windows itself.

Why Many Machines Cannot Simply Upgrade

The upgrade to Windows 11 is free, which sounds like the easy answer until the hardware check fails. Windows 11 requires TPM 2.0 (a security chip), Secure Boot, and a relatively recent processor, roughly Intel 8th generation or AMD Ryzen 2000 and newer. In practice, most business machines bought before 2018 will not qualify, and plenty of 2018 and 2019 machines sit right on the line.

Some of those older machines have TPM chips that are simply switched off in the BIOS, and a five-minute change makes them eligible. Others are genuinely excluded. There are registry tricks floating around the internet to force Windows 11 onto unsupported hardware; do not do this to a business machine. Microsoft does not guarantee updates on unsupported installs, which recreates the exact problem you were trying to escape.

The Decision Tree for an SME Fleet

Every Windows 10 machine in your business lands in one of three buckets. The work is sorting them, and the sorting is quick.

• Bucket one, upgrade in place: The machine passes the Windows 11 hardware check. Upgrade it, free, scheduled outside working hours. For most fleets this covers everything bought from about 2019 onward.
• Bucket two, replace: The machine fails the check and is four or more years old anyway. Replacing it is not a Windows 11 cost; it was already due. Our article on the hidden cost of old hardware runs the numbers, and they rarely favour keeping the old machine once support hours and downtime are counted. Buying through a procurement partner at volume pricing takes a meaningful slice off the sticker price.
• Bucket three, ESU while you plan: The machine fails the check but runs something genuinely hard to move, like a controller for specialised equipment. Pay for ESU on those specific machines only, isolate them on the network, and put a retirement date in the diary. ESU for a whole fleet is a money fire.

Two things make the whole exercise cheaper. First, laptops replaced in this cycle come with a built-in benefit for load shedding resilience, because a laptop rides out an outage that kills a desktop mid-save. Second, if you are moving files and email to the cloud anyway, the new machines need less local horsepower than the old ones did, and mid-range hardware is usually enough.

Doing the Migration Without Drama

A Windows 11 migration done properly is boring, and boring is the goal.

• Audit first: Run the hardware check across the fleet and list what passes, what fails, and what each failing machine actually does all day.
• Test the awkward software: That one ancient payroll utility or scanner driver is the thing that bites. Test it on one Windows 11 machine before you schedule fifty.
• Stage the rollout: A department at a time, with files already in OneDrive, SharePoint or Google Drive so a machine swap is a sign-in, not an archaeology project.
• Wipe before disposal: Old drives hold company and client data. Proper data destruction is a POPIA requirement, not a nicety, and responsible e-waste disposal is part of the job.

The Bottom Line

Windows 10 was a good ten-year run, but carrying it into 2027 is a risk decision, not a savings decision. The free upgrade covers most machines bought in the last six years, ESU buys breathing room for the stragglers at a price designed to sting, and the machines that qualify for neither were due for replacement anyway.

If you do not know which bucket your fleet falls into, that audit is an afternoon of work with the right tools. AMEA runs Windows 11 readiness checks for South African businesses, plans the migration around your team's working hours, and sources replacement hardware at partner pricing when replacement is genuinely the cheaper path.