Windows 10 security updates expiry for businesses raise cybersecurity risks

Microsoft has ended the first year of paid security coverage for commercial users as unpatched devices face growing exposure to cyber threats.

Businesses running Windows 10 computers without renewed security coverage face increased cybersecurity risks following the expiration of Microsoft’s first-year Extended Security Updates (ESU) programme for commercial customers on October 13, 2026.

The deadline implies that organisations that relied on the paid programme but have not secured coverage for a second year will no longer receive new security patches for eligible Windows 10 devices, thereby leaving vulnerabilities discovered after the expiry date without Microsoft-issued fixes.

Windows 10 reached the end of its standard support on October 14, 2025, prompting Microsoft to introduce ESU as a temporary measure for organisations that needed more time to migrate to newer operating systems.

Under the programme, businesses could continue receiving critical and important security updates without gaining access to new features or general product support.

The expiration of the first-year coverage puts renewed pressure on businesses to upgrade compatible computers to Windows 11, purchase additional security coverage where eligible, or adopt other measures to reduce their exposure to cyberattacks.

A July 2026 analysis by Lansweeper, a technology asset management firm, found that Windows 10 devices carried an average of 1,903 active common vulnerabilities and exposures (CVEs), compared with 652 for Windows 11 devices.

The report indicated that Windows 10 devices had nearly three times as many recorded vulnerabilities on average.

The findings highlight the security implications for organisations that continue using unsupported software, especially where computers handle sensitive customer information, financial transactions or internal business systems.

Businesses face higher costs to maintain Windows 10

Microsoft’s commercial ESU programme offers a phased extension for organisations that cannot immediately replace or upgrade their existing computers.

The first year of commercial coverage cost $61 per device, while the second year costs $122 per device and runs through October 12, 2027.

A third and final year costs $244 per device, extending coverage through October 2028, according to the programme’s published terms.

The arrangement requires sequential enrolment, meaning organisations generally cannot skip the first year and purchase the third year directly.

Businesses that already purchased Year 1 coverage can pursue Year 2 to maintain protection while planning their transition.

However, ESU is not a permanent solution. It provides eligible security updates but excludes new features, most non-security fixes and general technical support.

Windows 11 upgrade offers an alternative

Businesses with compatible computers can upgrade to Windows 11 to continue receiving supported security updates without paying the annual ESU fee.

Microsoft’s published requirements include a compatible processor, at least 4GB of RAM, 64GB of storage, Trusted Platform Module (TPM) 2.0 and Secure Boot capability.

Read also: Nigeria’s inflation cools to lowest since 2025 despite rising energy prices

Organisations should assess their computer fleets before deciding whether to upgrade existing devices, replace older hardware or maintain selected machines under extended coverage.

For businesses dependent on legacy applications that cannot run on newer systems, cybersecurity specialists recommend restricting network access and isolating vulnerable computers wherever possible.

Such devices should not be used for sensitive operations unless appropriate safeguards are in place.

Home users have a separate deadline

The commercial expiration does not automatically mean that all Windows 10 users have lost access to extended security updates.

Microsoft operates a separate consumer ESU programme for eligible personal computers running Windows 10 version 22H2.

Under the extended consumer arrangement, enrolled devices can receive critical and important security updates through October 12, 2027.

Eligible consumers can enrol through Windows settings using the available options, which may include syncing PC settings through Windows Backup, redeeming Microsoft Rewards points or paying $30, subject to regional eligibility.

Microsoft has nevertheless advised users to upgrade to Windows 11 where possible, warning that computers without ongoing security updates become vulnerable to malware and other threats.

The distinction is important for organisations and individuals assessing their next steps:m. Windows 10 computers can continue functioning after support expires, but continued operation does not guarantee protection against newly discovered security flaws.

For businesses, the end of the first commercial ESU year makes operating-system migration and vulnerability management more urgent, especially where unsupported computers remain connected to corporate networks or handle sensitive information.