Microsoft ended free security updates for Windows 10 on 14 October 2025. The machines still work, which is the problem: nothing visibly breaks, while every new vulnerability discovered from that date onward stays open on them permanently.
In the offices we assess, between a third and half of workstations are still on Windows 10. Most are five to eight years old and fail the hardware requirements for Windows 11, so an update alone will not fix it.
Three options, in order of cost. Replace: budget a refresh for machines that cannot run Windows 11; a planned replacement cycle costs less than an emergency one. Extended Security Updates: Microsoft sells a one-year ESU subscription that buys time for machines that must stay; use it as a bridge, not a plan. Isolate: anything that cannot be replaced or extended, such as a PC driving a specialist device, goes on its own VLAN with no internet access and no email.
What we do in a managed agreement: the asset register shows every Windows 10 device with its age and Windows 11 eligibility; the roadmap schedules replacements across quarters so the cost is spread; nothing end-of-life stays on the user network.
If you are not sure how many you have, the free assessment counts them in under an hour and tells you which can be upgraded, which should be replaced, and which must be isolated now.