Windows 10 support has ended: what UK SMBs should do first
Windows 10 support has ended, and any UK business still running it on live devices now has a known risk sitting in plain sight. Microsoft says support for standard editions ended on 14 October 2025, which means routine security updates and mainstream technical support stopped on that date in its Windows lifecycle guidance. An old laptop can still boot, log in and open files, but that does not make it safe to leave in normal circulation.
That matters because unsupported endpoints do not fail all at once. They become easier to compromise, harder to defend and more awkward to manage as browsers, security tools and line of business apps move on. Teams usually feel this first as friction, printer issues, unreliable remote access, failed updates and more time lost to workarounds.
For UK SMBs, the risk is not only technical. Unsupported software can affect Cyber Essentials readiness, supplier assurance conversations and the evidence you need to show that systems handling personal data are protected with appropriate measures. Even the limited security updates Microsoft is still providing for Microsoft 365 Apps on Windows 10 do not turn Windows 10 back into a supported platform.
The right response is not a vague refresh plan for later in the year. It is a 30 day decision cycle: find every remaining device, rank the business impact if it fails, and move the highest risk machines first. The support window is already closed. The only sensible question now is how quickly you can shrink the exposure.
Your 30 day Windows 10 support action plan
A proper 30 day plan starts by turning the remaining Windows 10 estate into an asset problem rather than a vague IT headache. You need a clear register of every Windows device, who uses it, what it connects to and what business process depends on it.
Start the audit with the facts that tend to get missed when teams work from memory:
- device owner and department
- hardware age, warranty status and battery health
- encryption, patching and MFA status
- core apps, printers, scanners and specialist peripherals
- whether the device is office based, remote, shared or tied to a frontline role
Do not skip home and remote workers. The latest Cyber Essentials requirements make clear that corporate and BYOD home working devices used for the organisation’s business fall into scope, so a device in a spare bedroom can matter just as much as one on the office floor.
Next, test readiness against the official Windows 11 requirements. Check processor compatibility, RAM, storage, TPM 2.0 and Secure Boot, then confirm whether your core business apps, VPN tools, printers and scanners will survive the move. In many SMEs, the real blocker is not the laptop but one legacy application or one piece of kit that nobody reviewed early enough.
Then map devices by business criticality. A spare meeting room PC can wait. A finance workstation, booking terminal, warehouse desk or director’s laptop used for approvals probably cannot. This is where an MSP style scoring model helps: combine security exposure, downtime cost and user dependence so everyone is working from the same priority list.
It also helps to score each device against change complexity. Some machines are technically compatible but still awkward because they run old accounting plugins, connect to label printers, or support a user who cannot afford downtime during payroll, month end or customer service peaks. That is why the audit should include a small pilot group early on. Test one device from each critical user type before you assume the whole estate will move cleanly.
By week three, divide the estate into three buckets. Upgrade now for devices that are compatible and stable. Replace now for machines that fail checks or are too weak to justify more effort. Hold briefly for exceptions tied to legacy software or specialist kit, but only with a named owner, a review date and tighter controls.
This is also the point where Windows 10 support options become commercial decisions, not just technical ones. Delay often shows up as lost productivity before it shows up as a breach: more service desk tickets, more app conflicts, slower devices and rushed buying decisions. A focused review lets you spend money where it reduces risk fastest.
Good teams also make room for procurement and disposal. If a batch of machines clearly needs replacing, order them before the migration backlog becomes urgent. Plan data transfer, user handover, device wiping and safe disposal at the same time, so old laptops do not sit in cupboards with live credentials or business files still on them.
Upgrade, ESU or replace: choosing the right path
Most firms comparing Windows 10 support options end up with three routes: upgrade compatible devices, replace uneconomical ones and use Windows 10 ESU only where a short bridge is unavoidable. The mistake is treating ESU as a strategy for the whole estate. It is a holding measure for exceptions.
If a machine already meets Windows 11 requirements and runs well, upgrading is usually the cleanest answer. It extends support life, simplifies management and removes a growing stack of special cases from the environment. Replacement makes more sense when older hardware fails on processor, TPM or performance, or when users are already losing time to battery issues, slow startup and unreliable peripherals.
ESU is best reserved for business critical systems with a hard blocker, such as a specialist app or device that cannot move immediately. Microsoft says commercial ESU starts at $61 per device for Year One and doubles each year, so the real question is not only licence cost but the admin time, exception handling and slower standardisation that come with carrying those devices for longer.
That comparison matters because ageing hardware rarely stays still. Batteries fail, storage fills up, user patience drops and support effort climbs. A cheap delay on paper can become an expensive exception list in practice, especially if the same small IT team is also trying to manage onboarding, security reviews and everyday support.
For most UK SMBs, the sensible mix is simple: upgrade what is ready, replace what is not, and keep ESU on a short list with an exit date. If a device cannot be given an exit date, it should trigger a deeper decision about replacement, virtualisation or process change instead of being left to drift.
How to reduce security and compliance exposure fast
The last step is governance. Treat the remaining Windows 10 estate as a board level risk with owners, dates and evidence, not a background upgrade ticket. If unsupported machines remain, record why they remain, what data they touch and what control changes are in place until they disappear.
Any short term holdouts need compensating controls: remove local admin rights, limit internet access where possible, isolate them on segmented networks, enforce MFA, tighten monitoring and make sure backup and recovery plans are current. The point is to reduce blast radius while you finish the move.
Certification and assurance matter here as well. IASME says organisations using unsupported software within scope will fail Cyber Essentials, which is why its Cyber Essentials FAQ needs to sit alongside your migration plan. If you bid for contracts, handle sensitive client data or answer supplier security questionnaires, that detail matters.
Do not let the Microsoft 365 nuance create false comfort. Microsoft is continuing security updates for Microsoft 365 Apps on Windows 10 until 10 October 2028, but that only helps the apps during transition. It does not restore full Windows support or remove the underlying endpoint risk.
Document the remaining exposure while you work through the migration. That means a simple register of unsupported devices, the reason each one remains, the target replacement or upgrade date and the control owner. This becomes useful evidence for leadership, auditors, insurers and customers who want to know whether the issue is being ignored or actively managed.
Use the next 30 days to lock the plan down:
- confirm every remaining Windows 10 device, owner and business dependency
- approve replacement and rollout dates
- protect short term exceptions with named owners and review points
- check whether any in scope device would undermine Cyber Essentials readiness
- report residual risk, budget and completion dates at board level
- schedule data transfer, wiping and disposal for retired hardware
If you need a practical route from audit to rollout, Wise Solutions can help you prioritise by business criticality and turn Windows 10 support risk into a controlled migration plan.
