Windows 10 is out of support. What that means for your business.

Windows 10 reached end of support on 14 October 2025. No security updates, no technical support, and — the part that matters — no fixes for anything discovered afterwards.

Nearly a year on, plenty of small businesses are still running it. Usually not through negligence: the machine works, the software on it works, and replacing it costs money that had somewhere better to go. That is a rational position right up until it is not.

Why this is different from previous end-of-life dates

The usual reassurance is that an old operating system is only a risk if something targets it. That is roughly true on day one and progressively less true afterwards.

Every vulnerability published after October 2025 is a permanent, documented way in. It is not a race between attacker and patch any more, because there is no patch. The list only grows, and it is public.

The second-order effects arrive quietly. Software vendors drop support for the platform. Browsers stop updating. Your accounting package, your card terminal software or your line-of-business tool eventually requires something newer. And if you handle card payments or hold personal data, an unsupported operating system is difficult to defend to an auditor, an insurer or a regulator after an incident.

That last one is where this most often becomes real for a small business — not a dramatic breach, but a cyber insurance renewal with a question about unsupported systems on it.

Find out what you actually have

Most businesses cannot answer this straight away, which is itself the finding. Before deciding anything:

• Every machine, what it runs, and whether it meets the Windows 11 requirements.
• What each machine is actually for. The one driving a printing rig or a piece of workshop equipment is a different problem from a laptop used for email.
• Which are on Extended Security Updates, and until when.
• What each one touches — payment data, customer records, the network everything else sits on.

A spreadsheet is fine at this size. The point is having the list at all. We have made this argument at the other end of the scale in keeping a server hardware inventory that stays true, and the principle is the same: you cannot make a sensible decision about an estate you have not written down.

Your four options

Upgrade in place. Free where the hardware qualifies. The compatibility requirements are the obstacle — a good many otherwise-serviceable machines do not meet them, which is precisely why this transition has been slower than previous ones.

Extended Security Updates. Paid, time-limited, and a legitimate answer for a machine you cannot replace yet. It buys time. It is not a destination, and the price is designed to remind you of that.

Replace the hardware. The real answer for most, and worth doing in a planned batch rather than one panicked machine at a time. Budget for it as a cycle, not an emergency.

Isolate and accept. For a machine that genuinely cannot move — usually one tied to equipment or software with no successor — take it off the internet, segment it from the rest of the network, and control what connects to it. This is a real engineering answer, not a cop-out, but it only works if the isolation is enforced rather than intended.

Do this in order

1. Anything handling payments or personal data comes first, regardless of how well it works.
2. Anything with access to your main network second.
3. Isolated, single-purpose machines last — and consider isolating rather than replacing them.

The instinct is to start with the oldest machine. The better rule is to start with the one that would do the most damage.

The wider point

What makes this expensive is not the operating system. It is that the refresh was never a cycle — machines were bought as they broke, so they all aged together, and now they need replacing together.

Knowing what you have and when it expires turns a recurring emergency into a line in the budget. That is the whole argument for taking inventory seriously, and it applies to a rack of servers exactly as it does to eight laptops and a machine in the back office. It is the same reasoning behind the console we built for server estates: the value is not the software, it is knowing what you have.

If you would like help working out what you are running and what needs doing first, book a free call. We will give you an ordered list rather than a quote for replacing everything. See also the three attacks that actually hit small businesses and what changed in Cyber Essentials this year.