Still Running Windows 10 in the Office? Here Is What October 2026 Actually Costs You

A lot of business owners assume "end of support" for an operating system mostly means Microsoft stops adding new features, and that an old, stable machine that already does its job is fine to leave alone. That is backwards. Once support ends, Microsoft stops finding and closing the security holes that get discovered afterward, and there is no shortage of people looking for them. Every flaw found in Windows 10 from now on stays open on that machine permanently, on purpose, because nobody at Microsoft is going to fix it.

Microsoft ended standard support for Windows 10 on October 14, 2025. If your office kept a handful of machines on it through the free year of Extended Security Updates that followed, that free year runs out on October 13, 2026, about six weeks from now. What happens after that date, and what it actually costs to keep those machines patched, catches most small businesses off guard because nobody put it on a calendar the first time around, and the first year's free coverage made the whole subject feel like it had already been dealt with.

What actually changes on October 13, 2026

Consumer devices enrolled in the free Extended Security Updates (ESU) program lose that coverage entirely on that date. If a Windows 10 Home machine in your office was enrolled under the consumer program rather than a business one, its last free security patch has already been written; nothing more is coming, at any price, for that device.

Business devices are different, and this is the part that trips people up. A company that enrolled its Windows 10 Pro or Enterprise machines in the business ESU program does not lose coverage on October 13. It moves into Year Two of a three-year program, and Year Two costs twice what Year One cost. Year Three, arriving in October 2027, doubles again. None of this buys new features or a nicer interface. It buys the same critical and important security patches Windows 11 gets for free, sold back to you one year at a time, at a rising price, for a system Microsoft has already told the market it wants retired.

The price that doubles every year

The numbers are small per device, which is exactly why they get ignored until they are multiplied by a fleet. Microsoft's own pricing, laid out on its Extended Security Updates page, is cumulative: enrolling a device in Year Two requires having paid for Year One as well.

Ten Windows 10 machines still running in a twelve-person office is not unusual, especially for point-of-sale terminals, a warehouse PC, or a reception desk machine nobody has thought about since it was set up. Ten machines through all three years comes to roughly $4,270 in licensing alone, before anyone's time is counted, for hardware that was already fully paid for and that a straightforward managed device refresh would likely have replaced or upgraded to Windows 11 for less.

Why some businesses cannot just click "upgrade"

The obvious answer is to move every machine to Windows 11 and skip the ESU fee entirely. That works cleanly for hardware bought in the last three or four years. It does not work at all for a chunk of the small business installed base, because Windows 11 requires a security chip called TPM 2.0 and a supported processor generation, and a large number of otherwise perfectly usable Windows 10 machines, particularly desktops assembled or bought before 2019, simply do not have either.

That is the actual reason ESU exists as a paid product rather than a footnote: Microsoft knows a meaningful share of the Windows 10 fleet cannot upgrade in place even if the business wants to. For those machines, the honest options are a hardware replacement, a motherboard-level upgrade that usually costs close to a new machine anyway, or paying for ESU as a deliberate, time-boxed bridge while a replacement is budgeted and rolled out in an ordinary refresh cycle rather than a scramble. What is not a real option is doing nothing and assuming the deadline is a formality, because for Home editions specifically, it is not a formality at all.

The cost that shows up somewhere else: your insurance policy

The license fee is the visible cost. The one that surprises business owners lives in their cyber insurance policy. Most cyber insurance applications now ask directly whether systems are patched and vendor-supported, and an unsupported operating system sitting on the network when a claim is filed gives the insurer a documented reason to point at an exclusion clause rather than pay out. A 2026 review of insurance exclusions by HeroDevs found insurers increasingly citing unsupported software specifically, not just missing patches, as grounds to deny a claim after a breach traced back to a legacy machine.

That is a materially worse outcome than the ESU fee. A denied claim after a ransomware incident means the business absorbs recovery costs, and possibly a client's costs too, entirely on its own, on top of whatever it already spent trying to keep the old machine limping along. The device that felt cheap to leave alone becomes the reason a six-figure claim gets refused, and unlike the ESU invoice, that number is not capped at $244 a device.

The renewal questionnaire is usually where this gets caught, or missed. Most cyber policies renew annually, and the patching and supported-software section is filled in by whoever handles the paperwork, not necessarily by whoever knows which ten machines in the warehouse are still on Windows 10. A mismatch between what the form says and what is actually running is not fraud in most cases, it is simply nobody having checked, but the insurer does not distinguish between the two when a claim comes in.

How to find out how exposed you actually are

Most owners genuinely do not know how many Windows 10 devices are still running on their network, because the machines that get left behind are rarely the ones anyone uses every day. A short inventory answers the question in an afternoon:

• Check Settings > System > About on every device you can physically reach, or pull it centrally if devices are enrolled in Intune or another management tool.
• Separate Home from Pro and Enterprise. Home editions lose all coverage on October 13 with no paid option; Pro and Enterprise devices can still be enrolled in Year Two ESU as a stopgap.
• Check your cyber insurance renewal questionnaire for a patching or supported-software attestation, and confirm what you told the insurer matches what is actually running.
• Price a straight hardware refresh against three years of cumulative ESU fees before assuming the license is the cheaper option; for machines already five or six years old, it usually is not.

A proper Microsoft 365 security assessment covers this as a matter of course, because an unsupported endpoint is one of the first things that shows up when someone actually looks at a tenant instead of assuming it is fine. For businesses that need the patching and supported-software attestation to hold up on paper, not just in practice, that finding needs to feed into the documentation your IT governance and compliance records already require.

Quick answers