Windows 10 end of life arrived October 14, 2025. Microsoft stopped issuing security patches that day. Anything discovered after that date stays open in Windows 10 permanently. No fix is coming.
Your machines still boot up and your screens still glow. Nothing in the office looks different than it did on October 13th.
That is exactly the problem.
The Clock Already Ran Out
Six months ago. Done.
If you are still running Windows 10 on any machine in your business right now, that machine has no security updates and no protection for any vulnerability attackers find going forward.
They are already looking. They always look.
What Windows 10 End of Life Actually Means for Your Business
I have watched this playbook run before. It ends the same way every time.
In May 2017, WannaCry ransomware tore through 200,000 machines across 150 countries in a single weekend. Hospitals sent patients away and ambulances got rerouted entirely. Estimated global damages hit four billion dollars.
Here is the part that matters for you right now.
Most of those machines were running Windows XP. Microsoft had ended support for XP in April 2014, three years earlier. When Microsoft released a patch for a critical vulnerability in supported systems, XP never received it. Attackers found that vulnerability, built WannaCry around it, and ran it against every unpatched machine they could find.
That is the exact setup Windows 10 end of life creates today. Microsoft will keep patching Windows 11. Attackers will reverse-engineer those patches, find the identical flaw in Windows 10, and use it. Your machine will never see a fix.
The method does not change. Only the target does.
Those attackers did not need to be sophisticated. They needed their targets to do nothing.
Look at the businesses across the Triangle still running Windows 10 end of life right now. They are doing nothing, and some of them are going to find out what that costs.
Digit’s Rule 11: “Probably fine” is a threat waiting for a timeline.
What Small Businesses Risk from Windows 10 End of Life
Breaches get easier.
Attackers run automated scans for known vulnerabilities on unpatched machines. They are patient. They have all the time in the world and a running list of every system they can find that will never see a patch. VikingCloud’s 2026 cybersecurity research found that 38% of small businesses name an inability to keep up with patches as a top reason they remain vulnerable. Windows 10 end of life just made that problem permanent for every machine you have not moved yet.
Your cyber insurance may not pay.
Many carriers now have policy language that limits or eliminates coverage when a breach happens on an unsupported operating system. Call your carrier before you ever need to file a claim. Ask specifically about Windows 10 end of life coverage and get the answer in writing.
Recovery costs real money.
The average small business breach runs $120,000 or more in recovery costs alone, per Verizon’s Data Breach Investigations Report. That number does not include downtime or the time it takes to rebuild client trust. Forty percent of small businesses say a loss that size could close them permanently.
Compliance exposure is active today.
HIPAA requires supported and patched software protecting patient data. Running Windows 10 end of life on any machine that touches health records is a violation right now, not a future risk. PCI DSS Requirement 6.2 says the same about payment card data. CISA has been direct on this: unsupported systems are a known attack surface. The auditor arriving at your door will not be moved by your upgrade intentions.
The Hardware Problem Nobody Warned You About
Windows 11 has requirements. Your machines either meet them or they do not.
You need a processor from 2017 or newer, TPM 2.0, and UEFI firmware with Secure Boot enabled. Machines from 2018 or newer typically qualify. Older machines often fail on the TPM requirement alone. For a business running a mixed fleet, some devices get a free upgrade path and others need full replacement. You need to know which is which before you commit to a single dollar.
Microsoft built a free tool called PC Health Check. One minute per machine. It tells you whether the device qualifies for Windows 11 and names the specific requirement it failed if it does not.
Run it on every machine you own. That includes the computer in the back office that appears to belong to nobody. Especially that one.
What you find out shapes every decision that comes after it. Do not budget for anything until this step is done.
5 Steps for Windows 10 End of Life Migration
Step 1. Run PC Health Check on every machine you own.
Not most of them. Every one. The tool is free and takes about a minute per device. The results tell you whether you are budgeting for upgrades or replacements. That is a significant difference in both cost and timeline. Do this first, before anything else.
Step 2. Get your compliance exposure documented in writing.
If your business handles health records or payment data, a verbal sense of where you stand is not enough. You need a written assessment. Neither the compliance auditor nor the breach notification process will accept “we were planning to upgrade.”
Step 3. Call your cyber insurance carrier today.
Ask them directly whether running Windows 10 end of life affects your current coverage. Use those exact words. Write down what they say, then get it from them in writing. You need that documentation before you file a claim, not while you are filing one.
Step 4. Assign every machine a category and a timeline.
Upgrade eligible goes in one column. Full replacement needed goes in another. Any machine tied to a legacy application that genuinely cannot move yet gets its own row with a specific end date attached. Assign real dollar figures to each. Put the devices handling your most sensitive data at the top and work backwards from there.
Step 5. Work with someone who has done this before.
Data loss and application compatibility failures are real outcomes when this work gets handled poorly. A 15 to 20-person business with a clear plan and the right support gets through a full migration in four to six weeks. Trying to compress that into a weekend is how you end up managing two crises instead of one.
The Extended Security Updates Situation
Microsoft offers Extended Security Updates for Windows 10 (ESU) after the end-of-life date. Security patches only. Bug fixes stay broken, and feature updates are off the table entirely. Call Microsoft support and you are on your own.
The pricing goes up each year. Year one costs $61 per device. Stay for year two and that jumps to $122. By year three the annual cost hits $244 per device, and if you skipped year one and try to enroll at year two, Microsoft charges you for both years at once. The program does not forgive gaps.
Run all three years and you have spent $427 per device.
For a 20-device business, that is $8,540.
I will let that number sit there for a moment.
ESU has one legitimate use. A single machine running a legacy application that needs a few months to find a replacement, that is what the program was designed for. Use it that way, on that machine, with a specific end date in mind. Your entire company sitting on ESU because the upgrade conversation kept getting pushed to next quarter is $8,540 to delay a problem you are going to have anyway, with the compliance exposure running in the background the entire time.
Windows 10 End of Life Decision Chart
Your Situation | Recommended Path
Machines from 2018 or newer that pass Health Check | Upgrade to Windows 11 now. The OS upgrade is free.
Mixed fleet of older and newer machines | Upgrade eligible machines now. Phase in replacements for the rest.
All machines are five or more years old | Phased hardware replacement across one to two quarters
One machine tied to a legacy application | ESU for that specific machine only, with a defined end date
Healthcare, financial services, or regulated payments | Move immediately. Compliance exposure started October 15th.
No internal IT resource to manage the migration | Bring in a managed IT partner. This is not a weekend project.
Key Takeaways
Windows 10 end of life arrived October 14, 2025. Microsoft will not release another security patch for it. Any vulnerability found after that date stays open in Windows 10 permanently.
Every machine still running Windows 10 carries active security risk and likely compliance exposure. If your carrier discovers it during a claim, coverage may disappear.
Run PC Health Check on every device before you plan or budget for anything. The results shape every decision that follows.
ESU costs $427 per device over the full program with no compliance protection included. Use it for a specific machine with a specific problem, not as a company-wide answer.
The average small business breach costs $120,000 or more in recovery alone. A phased migration costs a fraction of that and removes the exposure for good.
Look. I know this landed on a list that is already too long. That is a fair feeling and I am not going to pretend otherwise. But this one has a deadline that passed six months ago, and a breach does not care about your timeline.
The team at 2 Dog Digital helps small and mid-size businesses across Raleigh and the Triangle figure out exactly what they have and what needs to move. One price per device. You know what it costs before we start.
Ready to find out where your business stands? Reach out. We start with what you actually have.
FAQ
How do I know if my computers can run Windows 11?
Download the free Microsoft PC Health Check tool and run it on each machine. It checks processor generation, TPM 2.0, available RAM, storage space, and firmware type. About one minute per device. If a machine fails, the tool tells you exactly which requirement it missed. That result is your decision point for that machine.
What should I do if I cannot replace all my computers at once?
Move the machines handling your most sensitive data first. Use ESU only as a short-term bridge for a specific machine with a specific application problem you are actively working to resolve. A managed IT partner can help you sequence the rest against your actual budget across one to two quarters.
What happens to my data if I stay on Windows 10 end of life?
Your data stays where it is right up until it does not. Every day on an unpatched operating system raises the risk of a breach or ransomware infection. Attackers specifically target known vulnerabilities on systems that will never see a fix. Ransomware recovery is running an average of $53,000 per hour of downtime. The longer you wait, the more that number matters.
Will my cyber insurance cover a breach on an unsupported machine?
Call your carrier and ask directly. Use the words “Windows 10 end of life.” Write down what they say. Then get it from them in writing. Many policies now include language that limits or eliminates coverage for breaches on unsupported operating systems. Find that out now, before you need to file a claim.
2 Dog Digital | Raleigh, NC | www.2dogdigital.com | Serving clients in North Carolina and 27 states