Windows 10 Extended Security Updates (ESU) is Microsoft's paid program that keeps delivering critical and important security patches to Windows 10 PCs after the operating system reached end of support on October 14, 2025. It is not an extension of normal support: ESU includes no new features, no non-security fixes, and no general technical support. It exists for one purpose — to reduce security exposure on devices that cannot be migrated yet.
The program is sold in one-year blocks, and Year 1 ends on October 13, 2026. Year 2 begins the next day and runs until October 12, 2027; Year 3, the final year, ends on October 10, 2028. After that, there are no more security updates for Windows 10 at any price.
Why does this date matter right now? Because every organization still running Windows 10 has to make an explicit decision in the next three weeks for each remaining device: pay for Year 2, upgrade to Windows 11, replace the hardware, move the workload to the cloud, or retire it. A PC that silently falls out of coverage keeps working — but it stops receiving patches, and every new vulnerability Microsoft discloses becomes a permanent, unpatched door into your network.
For IT managers and CIOs across Latin America and the United States, the short answer is simple: the October 13, 2026 ESU deadline is a budget, security, and compliance checkpoint, not just a licensing renewal. Treat it as the moment to shrink your Windows 10 footprint, not extend it.
The core problem with ESU is that it gets more expensive every year while solving nothing permanently. Commercial ESU pricing is $61 per device for Year 1, $122 for Year 2, and $244 for Year 3 — the price doubles annually by design. Keeping a single PC patched until October 2028 costs $427; across 500 devices, that is more than $213,000 spent on machines the business already intends to replace.
ESU is also cumulative. An organization that skipped Year 1 and now wants Year 2 coverage must buy both years — $183 per device — even though Year 1 has already elapsed. Coverage cannot be purchased by the month or prorated.
The second challenge is hardware. Many Windows 10 PCs cannot upgrade to Windows 11 because they lack TPM 2.0 or a supported processor generation, not because they are slow. That means a machine that still feels perfectly usable may require a full replacement — and with global hardware prices under pressure in 2026, procurement lead times matter.
The third challenge is security. Unsupported or unlicensed Windows 10 devices are exactly what ransomware operators look for: a single unpatched endpoint can be the entry point for lateral movement across the network. Without continuous monitoring from a managed SOC and MDR service, those devices become blind spots.
Finally, there is visibility. Kiosks, shared workstations, conference-room PCs, and computers attached to specialized equipment rarely appear in the main asset inventory — and they are the devices most likely to fall out of coverage unnoticed.
How should an enterprise prepare for the end of ESU Year 1? Follow this five-step plan before October 13, 2026:
1. Inventory every Windows 10 device. Pull data from Intune, Configuration Manager, your RMM, and network discovery tools. Include laptops, desktops, kiosks, lab machines, and PCs connected to manufacturing, medical, or retail equipment. Record OS version (ESU requires Windows 10 version 22H2), hardware model, TPM version, and CPU generation.
2. Verify actual ESU coverage. Buying a license does not mean a device is patched. Confirm that each enrolled PC has its ESU key activated and is successfully installing monthly security updates.
3. Assign each device a single migration path. Every machine should land in one of five buckets: upgrade in place to Windows 11, replace hardware, keep temporarily on ESU with a documented reason, move to a cloud desktop, or retire. ESU should only be used for a named list of verified exceptions — such as a line-of-business application not yet certified for Windows 11.
4. Consider cloud desktops. ESU is included at no additional cost for Windows 10 virtual machines running in Windows 365, Azure Virtual Desktop, and Azure virtual machines, and Windows 10 endpoints connecting to a Windows 365 Cloud PC are entitled to ESU for up to three years. For some teams, a cloud PC delivers Windows 11 on existing hardware while avoiding escalating ESU fees. Cloud desktops depend on reliable bandwidth, so validate your dedicated internet and SD-WAN connectivity at every site first.
5. Test and roll out in phases. Pilot business-critical applications, printers, VPN clients, security agents, and collaboration tools such as Microsoft Teams on Windows 11. Then deploy by department or site to contain compatibility issues before they reach the whole organization.
Why should enterprises treat the ESU deadline as a migration trigger rather than a renewal? The benefits are measurable:
In short: ESU buys time, not progress. Organizations that use the next three weeks to shrink their Windows 10 estate will spend less and be more secure in 2027 than those that simply renew.
HIT Communications has helped enterprises across Latin America, the United States, and Europe modernize their technology for more than 30 years. For the Windows 10 ESU deadline, our team delivers an end-to-end program:
Whether you have 50 remaining Windows 10 PCs or 5,000, HIT gives you one accountable partner from inventory to the final retired device.
Windows 10 ESU Year 1 ends on October 13, 2026, and Year 2 costs twice as much. The organizations that come out ahead will be the ones that use this deadline to cut their Windows 10 footprint — upgrading what can be upgraded, replacing what can't, moving suitable users to cloud desktops, and keeping ESU only for a short, documented list of exceptions.
The clock is short, but three weeks is enough time to build an inventory, verify coverage, and lock in a migration plan that saves money through 2028.
Ready to turn the ESU deadline into a modernization plan? Contact HIT Communications today for a Windows 10 readiness assessment and a clear, costed path to Windows 11.

Find out how we can transform your business. Talk to one of our experts now!
Get in touch