Windows 10 ESU for Business: The Real Cost of Waiting

TL;DR
– Microsoft extended consumer Windows 10 ESU into 2028 — but the headline program is not the one your business uses.
– Commercial ESU is priced per device, doubles every year, and is cumulative, so waiting raises the bill.
– The highest-risk group is the firms that read the extension news and do nothing — no upgrade, no ESU.
– An unsupported Windows 10 device receives zero security patches and becomes a standing liability for insurance and compliance.
– The lowest-cost path is a planned migration sequenced into your normal budget cycle, not a deadline scramble.

The extension everyone is celebrating is the most expensive piece of good news your business will read this year.

“Windows 10 got extended, so we’re fine” is the conclusion most owners drew from the recent headlines. It is the wrong one. Microsoft did extend Windows 10 Extended Security Updates — but it extended the consumer program, a thirty-dollar, home-user offering. The program your business runs on is a different instrument with a different price curve, and the machines sitting on neither program are a different problem entirely. The extension didn’t remove the pressure. It repriced it, and the price climbs every year you wait.

What is Windows 10 ESU?

Windows 10 ESU is the ability to keep receiving critical and important security patches on a Windows 10 device after Microsoft’s end-of-support date of October 14, 2025. It is a paid subscription that delivers security updates only — no feature updates, no general bug fixes, and no technical support. According to Microsoft Learn, the program is sold by the year and is cumulative, which becomes the central fact in any business decision about it.

The consumer version is cheap and now runs in annual stages into 2028. The commercial version — the one your organization buys — is structured very differently. Conflating the two is exactly how a business talks itself into a costly position.

What are the three options for a Windows 10 device?

Every Windows 10 machine in your business now sits in one of three lanes. Only one of them is supported, predictable, and headed somewhere.

The table is the whole argument in miniature. The free, supported path exists. The paid bridge has a real and rising cost. And the option that looks free is the one that quietly carries the largest bill.

Where does the commercial ESU math actually land?

Commercial ESU is priced per device, per year, and the curve is steep. Year One runs roughly $61 per device. The price doubles in Year Two and doubles again in Year Three. It is also cumulative — a firm that delays enrollment and buys in later still pays for the years it skipped.

Put that against a real fleet:

• Twenty-five Windows 10 machines at Year One pricing is roughly $1,500 to stand still for twelve months.
• Carry those same machines into Year Three and the annual figure is several times higher.
• Every dollar buys security patches and nothing else — no new capability, no productivity gain, no support line.

In the IT audits and assessments we run, the pattern is consistent: the firms paying the most for ESU are the ones that treated it as a default for the whole fleet rather than a targeted bridge for a few genuinely stuck machines. ESU is a tool for the exception, not the rule.

What happens to the firms that do nothing?

The most exposed businesses are not the ones paying for ESU — they are the ones who read the extension headline and stopped thinking about it. Those machines are not covered by the extension. They are simply unsupported, and that has concrete operational consequences, not hypothetical ones:

• Permanent, unpatched vulnerabilities. Any critical flaw found after October 14, 2025 stays open on that device indefinitely. The fix is never written for it.
• A published map for attackers. Each month, Windows 11 receives patches that reveal what was vulnerable. Those same flaws often remain live on the Windows 10 machines that never got the fix — and CISA’s ransomware guidance is consistent that unsupported software is a primary entry point.
• Cyber-insurance exposure. Carriers increasingly require supported, patched operating systems as a condition of coverage. End-of-life software can be grounds to deny a claim or decline a renewal.
• Compliance and audit findings. A line of “Windows 10, end of life” on a client security questionnaire or a framework audit is a finding that can cost a contract or a certification.
• A single weak entry point. One unsupported endpoint is enough to reduce the blast radius argument to rubble — once an attacker is on it, the fully patched machines around it are reachable from the inside.

The do-nothing lane feels free because the invoice is deferred. It arrives later, as an incident, a denied claim, or a lost contract — and it is the largest bill on the table.

The question is not whether Windows 10 still turns on. It is whether you can defend, to an auditor or an insurer, the decision to keep running it.

What does a sound migration plan look like?

The answer is not a panic migration before a deadline. It is a sequenced transition you control, ideally folded into your next budget cycle rather than handled reactively. The practical sequence is:

1. Inventory honestly. Establish exactly how many Windows 10 devices you have, which are eligible for a free Windows 11 upgrade, and which need replacement hardware. You cannot plan what you have not counted.
2. Isolate the genuinely stuck. Identify the handful of machines pinned to Windows 10 by a legacy application or hardware dependency. Those — and only those — are candidates for deliberate, time-boxed ESU coverage.
3. Sequence the rest into the budget. Eligible machines upgrade at no licensing cost. Aging hardware folds into a normal refresh schedule instead of an emergency purchase.
4. Clear the do-nothing lane first. Any machine running today with no upgrade and no ESU is the top priority regardless of budget timing, because that is where the live exposure sits. Pair the migration with a current security review and, where warranted, managed detection so the transition closes gaps rather than just relocating them.

What do most firms get wrong about Windows 10 end of support?

• Reading the consumer headline as business coverage. The thirty-dollar consumer extension does not apply to commercially licensed devices.
• Defaulting the whole fleet to ESU. Paying to keep dozens of machines on a dying OS is rarely cheaper than a planned upgrade-and-refresh.
• Treating the do-nothing machines as low priority. They are the highest-risk devices in the building precisely because no one is looking at them.
• Waiting for a forced deadline. Year One ESU pricing is the lowest it will ever be; every delay makes the math worse.
• Migrating without closing security gaps. A device swap that doesn’t address identity, patching, and monitoring just moves the problem to newer hardware.

The firms that come through this well will not be the ones that found the cheapest way to keep Windows 10 breathing. They will be the ones that stopped paying to stand still.

Map Your Operational Gaps →

We run this as a fixed-scope fleet review: every device inventoried, every machine sorted into upgrade, replace, or bridge, and the full transition costed against your budget cycle — so the decision is made on numbers, not headlines.

Executive-level discussion. No technical pre-work required.

About the author
Sebastian Abbinanti is the MSP Leader at The Isidore Group, a Chicago-based managed services and cybersecurity firm serving SMBs nationally. With 12+ years of experience in operational resilience, Microsoft 365 administration, and partner-managed tenant environments, Sebastian advises growth-stage organizations on operational maturity and cybersecurity readiness.

Frequently asked questions

What is Windows 10 ESU?
Windows 10 ESU (Extended Security Updates) is a paid Microsoft program that delivers critical and important security patches to Windows 10 devices after end of support on October 14, 2025. It provides security updates only — no new features, no bug fixes, and no technical support — and is structured as an annual subscription that escalates in price each year.

How much does Windows 10 ESU cost for a business?
Commercial ESU is priced per device, per year, starting at roughly $61 for Year One. The price doubles in Year Two and doubles again in Year Three. It is also cumulative: a business that enrolls late still pays for the earlier years it skipped. Across a fleet, the cost compounds quickly for an operating system that is already past end of support.

Is Windows 10 still safe to use after October 2025?
A Windows 10 device that is neither upgraded to Windows 11 nor enrolled in ESU receives no security updates at all. Any vulnerability discovered after October 14, 2025 stays open permanently on that machine. Unsupported endpoints are a common entry point for ransomware and can void cyber-insurance coverage and fail compliance audits.

Should my business pay for ESU or upgrade to Windows 11?
For most devices, upgrading to Windows 11 is the right answer — it is free on eligible hardware and remains fully supported. ESU is best reserved as a deliberate, short-term bridge for the small number of machines pinned to Windows 10 by a legacy application or hardware dependency, not as a default for the entire fleet.

Related reading:
– Summer Travel and Remote Work Security: Five Controls Before Your Team Scatters
– IT Audits and Assessments