HOME I BACK TO BLOGS I ABOUT US I CONTACT US

Windows 10 Is Out of Support. What It Costs to Stay, and How to Move Your Business to Windows 11

On October 14, 2025, Microsoft stopped providing free security updates for Windows 10. If a computer in your office still runs it, you're in one of two groups: paying Microsoft for patches, or going without them.

And the price of staying just changed again. Year 1 of Microsoft's paid Extended Security Updates (ESU) for businesses ended on October 13, 2026. Renew, and you're on Year 2 pricing. Enroll for the first time now, and you pay for Year 1 as well.

Here's what staying costs, what Windows 11 actually gives you, and how to decide device by device.

What Staying on Windows 10 Costs Now

ESU is a paid, per-device bridge that keeps delivering security updates after support ends. It runs for three years, and the price doubles each year:

•Year 1 (through October 13, 2026): US$61 per device. Already over.

•Year 2 (through October 12, 2027): US$122 per device.

•Year 3 (through October 10, 2028): US$244 per device.

Two rules make it expensive. Coverage is cumulative, so a business that buys in Year 2 must also pay for Year 1. And you can't buy a partial year.

Take a 50-device office enrolling today: 50 × ($61 + $122) is US$9,150 to stay covered through October 2027, and US$21,350 if you carry it through all three years. That buys security updates only. No new features, no performance gains, no hardware refresh. These are U.S. list prices, so confirm Canadian pricing with your reseller.

You may have seen a $30 ESU option. That one is for personal devices. Machines joined to Active Directory or Microsoft Entra, or managed through device management, don't qualify.

What Windows 11 Actually Gives You

Windows 11 is a free upgrade for compatible Windows 10 devices. Its real security advantage is that it makes hardware-backed protection the baseline: every supported machine has a TPM 2.0 security chip and Secure Boot capability. That enables:

•Secure Boot: checks that the PC loads only trusted software at startup.

•BitLocker drive encryption: a lost or stolen laptop doesn't become a data breach.

•Windows Hello for Business: sign-in with a device-bound PIN or biometric instead of a password that can be phished.

•Virtualization-based security: isolates critical parts of the system so malware that lands on a PC has a harder time reaching them.

Can Your PCs Run It?

Windows 11 requires a 64-bit processor (1 GHz or faster, two or more cores), 4 GB of RAM, 64 GB of storage, UEFI firmware with Secure Boot capability, and TPM 2.0.

In practice, processor age is the dividing line: Intel 8th generation or newer, or AMD Ryzen 2000 series or newer. That's roughly PCs made since 2018. Older machines fail the check.

Microsoft's PC Health Check app tests one machine at a time. For a whole fleet, Intune can report which managed devices are ready.

Skip the workarounds. Modified installers can force Windows 11 onto unsupported PCs, but Microsoft doesn't support that setup, and a machine without TPM 2.0 is missing the protection you're upgrading for.

Decide Device by Device

You don't have to treat every PC the same. Sort them into three groups:

1.Compatible: upgrade. It's free for eligible devices. Test your line-of-business apps first, and back up before you start.

2.Incompatible, low risk: bridge, then replace. Use ESU only for machines you're retiring soon. Compare US$183 per device today (US$427 across all three years) against what it would cost to replace that machine.

3.Incompatible, handles sensitive data: replace first. Client files, financial records, health information. These shouldn't sit on a bridge.

The Mistake After the Upgrade

Upgrading doesn't make a PC secure. Configuring it does. Windows 11 gives you the capability, but someone still has to turn it on and enforce it:

•BitLocker enabled on every laptop, with recovery keys stored where you can find them.

•Secure Boot actually switched on, not just supported.

•Devices enrolled in Intune, so you can see them and enforce rules.

•Conditional Access blocking sign-ins from devices that aren't compliant.

•Staff working as standard users, not local administrators.

Intune and Conditional Access are included in Microsoft 365 Business Premium, and plenty of businesses pay for them without ever configuring them. This is Invisible Configuration Debt. A new operating system doesn't pay it down.

What This Means for Insurance and Contracts

Insurers and clients ask about specific controls: MFA, endpoint protection, tested backups. An operating system that no longer gets free security updates is a hard thing to explain on any of those forms.

Don't wait for your renewal to find out how yours is treated. Ask your broker now how your policy and application handle unsupported operating systems.

Get a Plan Before Your Next Renewal

Delvetek plans and runs Windows 11 migrations for small and mid-sized businesses: an inventory of what you have, a prioritized replacement schedule, and a backup-first cutover so nobody loses a day of work.

To see the bigger picture, book the Insurability & Contract-Readiness Assessment. You receive a written, plain-English, prioritized report showing exactly where you'd fail an insurer or client questionnaire, and what to fix first.

The deadline already passed. Your plan doesn't have to wait for the next one.

[Book Your Assessment →]

Sources

•TechRepublic, Windows 10 ESU Cheat Sheet: Cost, Eligibility, and Coverage: techrepublic.com/article/news-windows-10-esu-cheat-sheet/

•Redmond Magazine, Windows 10 ESU Enrollments for Orgs (June 27, 2025): redmondmag.com/articles/2025/06/27/windows-10-esu-enrollments-for-orgs.aspx

•Pureinfotech, Windows 11 system requirements: pureinfotech.com/windows-11-system-requirements/

HOME I BACK TO BLOGS I ABOUT US I CONTACT US