The countdown is now measured in days, not months. On Wednesday 14 October 2026, Microsoft pulls the plug on the Consumer Extended Security Updates (ESU) programme for Windows 10 — the last lifeline keeping non-upgradeable Windows 10 PCs receiving security patches. From today, 24 April 2026, that gives UK SMEs exactly 173 days to plan, budget, procure, deploy and migrate every Windows 10 device in their estate. Statcounter still puts roughly 38% of UK business endpoints on Windows 10. The Microsoft scenario in front of those firms is brutally simple: upgrade hardware, pay for Commercial ESU, or accept Cyber Essentials auto-fail under the new v3.3 framework launched 27 April. There is no fourth option.
Microsoft already retired the free Windows 10 mainstream support track on 14 October 2025. The Consumer ESU programme bought eligible devices a single additional year of security-only patches at $30 per device (waived if enrolled with Windows Backup and a Microsoft Account). On 14 October 2026 that consumer extension expires too. Commercial ESU continues for up to three more years, but at $61 per device for year one, doubling annually — a cost most UK SMEs will not absorb. After that date, every unpatched zero-day in Windows 10 stays open forever.
What changed on 14 October 2025 — and what changes on 14 October 2026
Microsoft’s Windows lifecycle has now split into three concurrent tracks. Understanding which track every device in your estate sits on is the foundation of any sane migration plan.
Track 1 — Windows 10 unsupported. Devices that did not enrol in the ESU programme and which can no longer run Windows 11 because of the TPM 2.0 / 8th-gen-Intel / supported-CPU requirement. These devices stopped receiving security updates on 15 October 2025. They have already been outside the patch window for six months. Every CVE published since that date is permanent on these machines.
Track 2 — Windows 10 with Consumer ESU. Devices that enrolled (free with Windows Backup, $30 otherwise) before 14 October 2025 and are now receiving security-only patches. This track ends on 14 October 2026. There is no consumer-tier extension beyond that date.
Track 3 — Windows 10 with Commercial ESU. Business and education customers can buy up to three additional years through volume licensing, ending in October 2028. Pricing starts at $61 per device for year one, $122 for year two, $244 for year three — a total of $427 per device over three years. For a 30-seat office, that is roughly £9,950 in pure life-extension fees with no functional improvement.
Track 4 — Windows 11. The only fully supported Microsoft client OS from 15 October 2026 onward. Windows 11 has its own lifecycle, with version 24H2 currently in mainstream support until October 2027.
Why this is now a Cyber Essentials problem, not just a Microsoft problem
Cyber Essentials v3.3 (the new Danzell question set, launched 27 April 2026) introduced the first automatic-fail triggers in the scheme’s history. One of those triggers is operating systems that are no longer receiving vendor security updates. The IASME assessor manual is unambiguous: a single Windows 10 device on the certification scope that is past its ESU window is sufficient to fail the assessment outright.
The same rule applies to PSN, NHS DSPT, and the Cyber Assessment Framework (CAF). Most UK insurers have now adopted the same baseline through their cyber insurance underwriting questionnaires. From 15 October 2026, an unsupported Windows 10 device is not just a security risk — it is a contractual, regulatory and insurance risk simultaneously.
The chain of consequences for a typical UK SME goes like this:
The hidden Windows 10 estate — what UK SMEs are missing
Most SMEs vastly underestimate their Windows 10 footprint. The recent migration audits we have conducted across London-based clients show consistent gaps. The user laptops are usually counted; the rest of the estate is rarely on the spreadsheet.
The eight categories below are where unsupported Windows 10 devices typically still live in a 50-seat business environment as of April 2026:
The pattern is consistent. The user-facing fleet is usually well managed; the “edge” of the estate — meeting rooms, signage, single-purpose PCs — almost never is. Yet every one of these devices is on the same Active Directory domain, has the same network access, and counts as scope for Cyber Essentials.
The real cost of doing nothing — and the real cost of doing it properly
The cost-of-doing-nothing maths has hardened considerably since October 2025. Pre-EOS modelling assumed a vague “security risk” cost. Post-EOS, with Cyber Essentials v3.3 active and the typical UK SME ransomware recovery cost confirmed at £3.4m (Hiscox, March 2026), the numbers are now disturbingly concrete.
| Business size | Devices to migrate | Cost of proper migration | Cost of CE v3.3 auto-fail | Cost of one breach (avg) |
|---|---|---|---|---|
| Micro (1-10 staff) | 4-8 devices | £5,200 – £8,800 | £2,500 (lost contract) | £38,000 |
| Small (11-25 staff) | 9-20 devices | £9,500 – £18,500 | £28,000 (insurance + contracts) | £187,000 |
| Medium (26-100 staff) | 22-85 devices | £19,800 – £72,500 | £88,000 (DSPT + insurance + tenders) | £712,000 |
| Larger SME (100-250) | 85-220 devices | £72,500 – £165,000 | £240,000 (cyber insurance loaded 18%+) | £3.4m |
The hidden cost most SMEs miss is the cyber insurance loading. As of Q1 2026 every major UK cyber insurer (Hiscox, AXA, Aviva, Beazley, Chubb) explicitly asks for current vendor support status of every endpoint operating system. A single “no” on that question typically results in a 15-25% premium loading or outright refusal of cover. For a typical 50-seat firm paying £6,000-£14,000 a year for cyber cover, that loading frequently exceeds the cost of the actual migration.
The Windows 11 hardware reality — what your existing PCs can and cannot do
The single biggest reason 38% of the UK business estate is still on Windows 10 is hardware compatibility. Microsoft’s Windows 11 system requirements are unforgiving: a TPM 2.0 chip, Secure Boot enabled, and a CPU on Microsoft’s officially supported list (8th-gen Intel Core / AMD Ryzen 2000 series or newer). Anything older fails the upgrade check.
This is the hidden detonator inside most migration plans. SMEs assume they can simply run Windows Update on their existing PCs and get Windows 11 for free. For roughly two-thirds of devices in a typical UK SME estate over three years old, that simply is not true. The migration is a hardware refresh in disguise.
The four migration paths — and which one fits your business
Path A — In-place upgrade
For Windows 11-eligible hardware
Path B — Hardware refresh
For ineligible Windows 10 devices
Path C — Cloud PC / Windows 365
For older endpoints staying as thin clients
Path D — Commercial ESU
Last resort for trapped legacy systems
The 173-day migration plan — what to do, when to do it
The October 2026 cliff is far enough away to do this properly, and close enough that procrastination is now expensive. The plan below is the one we are actively running for clients across our managed-IT base.
How prepared are UK SMEs right now?
Not very, frankly. Statcounter and our own April 2026 client telemetry show a stark gap between intent and execution.
The other 68% know about the deadline, often have a vague intention, but have not yet costed it, scoped it, owned it, or scheduled it. Once you cross into July, lead times on hardware tighten significantly, deployment partners book up, and the price-per-device for crash-deployment programmes rises by 30-45%. The next eight weeks are the cheapest weeks to plan this.
The Cyber Essentials v3.3 alignment angle
For any UK SME holding or pursuing Cyber Essentials Plus, this migration is no longer optional. Under the Danzell question set, the assessor will ask:
- Are all in-scope devices running an operating system version still receiving vendor security updates?
- If the answer is “no” for any device, is that device under a written, signed, time-limited extended-support agreement (Commercial ESU or equivalent)?
- Is patching evidence available showing critical and high-severity patches applied within 14 days of release?
A single Windows 10 device that does not meet all three conditions is an automatic fail. That fail propagates to the cyber insurance renewal, the supplier-portal questionnaires, the public-sector contract clauses, and the NHS DSPT. The migration plan is the certification plan.
The same Intune / Autopilot / BitLocker / TPM 2.0 / Secure Boot / Defender for Endpoint stack you deploy as part of a Windows 11 rollout meets virtually every technical control in the v3.3 framework: secure configuration, MFA on all cloud services, automatic patching, supported software, removable-media controls. Done well, the migration delivers Cyber Essentials Plus as a by-product, not an extra project.
What about Copilot+ PCs and the AI angle?
Microsoft has positioned the 2026 hardware-refresh wave as the on-ramp to Copilot+ PCs — devices with a 40-TOPS+ NPU running local AI features such as Recall, Cocreator, Live Captions and on-device Studio Effects. For most UK SMEs, the AI capability will not be the deciding factor in Q2 2026; Microsoft 365 Copilot integration into Word, Excel, Outlook and Teams continues to work on standard Windows 11 hardware.
However, two pragmatic points are worth banking now. First, the price difference between a non-NPU and an NPU-equipped business laptop has narrowed to around £90-£180 by April 2026. Second, Microsoft has signalled that future Windows 11 / 12 features will be NPU-accelerated. For a 3-4 year refresh cycle, paying the small Copilot+ premium now is the lower-regret decision.
Don’t fall for the “just buy ESU” trap
Commercial ESU looks attractive on the surface: $61 per device for an extra year, no behaviour change, no rollout pain. The maths breaks down quickly.
For a 30-seat firm: $61 × 30 = $1,830 in year one, $122 × 30 = $3,660 in year two, $244 × 30 = $7,320 in year three. That is roughly £9,950 over three years spent not moving forward. By 2028 you will still need to migrate, the hardware will be three years older, the deployment will be more painful, and you will have spent the migration budget on rent rather than ownership. Every credible MSP we know recommends ESU only for specific trapped legacy applications — never as a fleet-wide strategy.
Need help running this migration?
Cloudswitched runs Windows 11 migrations end-to-end for UK SMEs
From the initial Lansweeper estate audit to the final Cyber Essentials Plus v3.3 evidence pack: discovery, costing, hardware procurement, Intune Autopilot setup, in-place upgrade orchestration, BitLocker/TPM provisioning, line-of-business application testing, end-user comms, decommission and asset disposal. We have completed migrations for clients across London, Manchester, Birmingham and the South East throughout 2025 and 2026. Talk to us before lead times tighten in July.
Book a Windows 11 migration assessmentQuick-reference: your 173-day checklist
| Milestone | Deadline | Owner | Status check |
|---|---|---|---|
| Complete Windows 10 estate audit | 1 May 2026 | IT lead / MSP | Master spreadsheet exported |
| Tag every device by migration path | 15 May 2026 | IT lead / MSP | Costed migration register signed off |
| Test critical LOB applications on Win11 | 5 June 2026 | Application owners | Compatibility matrix complete |
| Order replacement hardware | 30 June 2026 | Finance + IT | Purchase orders raised |
| Pilot wave (10% of eligible) | 15 July 2026 | IT lead / MSP | Pilot success report signed off |
| First major wave (30%) | 15 August 2026 | IT lead / MSP | Wave 1 dashboard 95%+ green |
| Hardware refresh wave (ineligible cohort) | 10 September 2026 | IT lead / MSP | New devices deployed via Autopilot |
| Final wave (remaining 60%) | 1 October 2026 | IT lead / MSP | Estate audit shows zero unsupported |
| Edge-case clean-up | 10 October 2026 | IT lead / MSP | Reception / signage / spares all done |
| CE v3.3 evidence pack | 14 October 2026 | Compliance lead | Submission ready |
Frequently asked questions
The bottom line for UK SMEs
The 14 October 2026 cliff is not a future problem. It is a 173-day problem, and the front-loaded weeks — April, May, June — are when the cost-quality-risk equation is most favourable. After July, hardware tightens; after September, deployment partners are fully booked; in October itself, the cost of crash-mode migration is roughly double a measured one.
The good news is that this is also the cleanest opportunity in five years to consolidate your endpoint estate, reach Cyber Essentials Plus v3.3 compliance, qualify for the best cyber insurance terms, and bring AI productivity tools (Copilot, Copilot+) into the business on day one of the new fleet. The migration is not a tax. Run properly, it is a force-multiplier. Run badly, it is the most expensive 173 days your business will spend this decade.
If you would like a Cloudswitched team to come and run the audit-and-plan stage for your business in the next two weeks, we have remaining capacity in May and early June. After that, we cap intake until late September.
CloudSwitched
London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.
