The first year of paid security updates for Windows 10 ends on 13 October 2026. Windows 10 ESU year two costs twice as much. Before you renew, it is worth knowing what you are buying, what Cyber Essentials accepts, and what the alternatives cost. The UK pricing, the compliance position and the four exits follow, with sources listed at the end.
Microsoft ended support for Windows 10 on 14 October 2025. Since then, the only way to keep a business machine on Windows 10 patched has been the Extended Security Updates programme, sold per device, per year. Most organisations bought year one as a bridge. The bridge now needs paying for again, at double the toll.
Your first year of cover ends on 13 October 2026
Commercial ESU runs in three annual blocks. Year one ends on 13 October 2026. Year two runs to October 2027 and year three to October 2028, after which there is no further cover at any price.
ESU delivers critical and important security fixes, and nothing else. There are no new features, no fixes for bugs that are not security bugs, and no general technical support from Microsoft beyond problems with ESU itself.
What happens if you do nothing? The machines keep working. They stop receiving patches, and every vulnerability disclosed after 13 October stays open on them. For a business, that is a control failure with a date on it.
One practical trap sits in the renewal. Each year of ESU is activated by a key installed on each device. A year-two licence that has been bought but not activated on the machine protects nothing, and an assessor will look at the device, not the invoice.
Windows 10 ESU year two: what it costs in the UK
Microsoft's list price for commercial ESU is $61 per device for year one, doubling in each following year to a maximum of three. UK resellers put year one at around £58 per device for commercial customers. On that basis, year two lands at about £116 per device and year three at about £232. What you pay depends on your licensing agreement, so confirm the figures with your partner before you budget.
| Coverage | Price per device | Cumulative cost per device |
|---|---|---|
| Year one (to October 2026) | around £58 | £58 |
| Year two (to October 2027) | around £116 | £174 |
| Year three (to October 2028) | around £232 | £406 |
The detail that catches people is that ESU is cumulative. If you skipped year one and want cover now, you pay for year one as well. A late joiner is looking at roughly £174 per device to reach October 2027, and around £406 per device to reach the end of the programme. Across fifty machines that skipped year one, the total comes to just over £20,000 for patches on an operating system with no future. An organisation that already bought year one faces £17,400 more to reach 2028.
Education customers paid far less for year one, around 90p per device, and Microsoft's published education pricing doubles on the same pattern, to $2 and $4 in years two and three. Charity and non-profit customers also started at around 90p; pricing for their later years had not been confirmed at the time of writing.
Cyber Essentials accepts ESU, on conditions
IASME's position is clear. A Windows 10 device enrolled in ESU counts as supported for Cyber Essentials. A Windows 10 device that is not enrolled counts as unsupported, and an unsupported device in scope fails the assessment.
Two conditions matter. The device must be on version 22H2, and enrolment must be real and evidenced rather than assumed. IASME also describes ESU as a short-term fix, so expect an assessor to ask about your exit plan.
So for any organisation holding Cyber Essentials or Cyber Essentials Plus with Windows 10 still in scope, the renewal is not optional. Let year one lapse on 13 October and those devices are out of compliance from the following morning.
Consumer ESU will not cover a business laptop
Microsoft has extended the consumer programme to 12 October 2027. It does not help a business. Consumer ESU is for personal devices, and it excludes any machine joined to a domain, joined to Microsoft Entra or enrolled in device management. Using it on a company laptop to avoid the commercial fee breaches the licence terms, and it leaves you with a device you cannot evidence as properly supported.
There is a sovereignty footnote here. Residents of the European Economic Area receive consumer ESU free when signed in with a Microsoft account. UK residents pay, back up their settings to Microsoft's cloud, or spend reward points. The EEA concession followed pressure from European consumer groups, including a Digital Markets Act complaint from Euroconsumers. Britain, outside the EEA, was not part of that conversation.
Office keeps patching longer than Windows does
Microsoft 365 Apps will keep receiving security updates on Windows 10 until 10 October 2028, three years after Windows 10 left support and broadly in line with the end of ESU. That removes one reason for panic. It does not remove the underlying problem: a patched copy of Word on an unpatched operating system is still an unpatched machine.
Alternatives to Windows 10 ESU: four exits compared
Every route off unpatched Windows 10 costs something. The difference is what you get for it.
- Upgrade in place to Windows 11. Free where the hardware qualifies, which means TPM 2.0 and a supported processor. The cheapest route, and it leaves your dependency on Microsoft exactly where it was.
- Replace the hardware. The route Microsoft prefers for machines that fail the Windows 11 check. Capital cost, plus certified data wiping and WEEE-compliant disposal of the old kit.
- Move to Windows 365 Cloud PCs. Windows 10 devices that connect to a Windows 365 Cloud PC receive ESU at no additional cost, for up to three years with an active subscription. The price is that your desktop now runs in Microsoft's cloud on a monthly subscription, so control moves further from you rather than closer.
- Leave Windows for Linux. The licence cost disappears. The migration cost does not, and it lands on your people rather than your budget.
A Sheffield-built laptop carries my working week
Earlier this year I moved my own working machine to a Sheffield-built laptop, a Star Labs machine running Zorin OS. The build is solid and the battery gives around seven hours of real work. The firmware is open-source coreboot, with TPM 2.0 and a hardware switch that cuts the wireless. Proton handles mail, files and calendar.
Nothing in that setup needs an ESU licence, and none of it runs to a US vendor's renewal calendar. I wrote up the full experience in I Ditched Windows for a Sheffield-Built Linux Laptop.
Linux stops where line-of-business software starts
Linux is ready for a browser-and-documents workload today: Microsoft 365 in the browser, Teams in the browser, Proton, LibreOffice or OnlyOffice. It struggles with Windows-only finance, design and specialist line-of-business packages, and with staff whose working day runs on complex Excel macros. Pretending otherwise is how migrations fail.
Management is less of a barrier than people assume. Microsoft Intune can enrol Ubuntu LTS devices and report their compliance, so a mixed estate does not have to be an unmanaged one. For Cyber Essentials, a Linux machine is treated like any other: it must run a release with a published support date, and critical and high-risk patches must go on within 14 days.
For most organisations the sensible answer is a split. Move the browser-and-documents users to Linux. Upgrade to Windows 11 where the hardware allows. Renew ESU for year two only on the machines that need Windows and cannot run 11, with a named end date for each.
The renewal is a board decision, not a service desk task
Every October until 2028, the price rises and the options narrow. The ESU schedule is designed to move you. The only open question is where to.
Renewing is a decision to stay put at a rising price for another year. Windows 11 keeps the dependency unchanged. The free ESU route through Windows 365 deepens it. Only one route reduces it. That makes the renewal a question about who controls the estate, and that question belongs with the people who own the risk.
This quarter has three jobs in it
- Count. List every Windows 10 device: its version, whether it passes the Windows 11 hardware check, and what its user does all day. Any device management tool will give you most of this in an afternoon.
- Sort. Put each device into one of three piles: upgrade to Windows 11, move to Linux, or renew ESU for year two as a bridge with a named end date.
- Act before 13 October. Buy and activate year two only for the third pile. Book the upgrades and the pilot migrations for the other two.
None of this needs anyone's permission. The inventory is yours, the hardware is yours, and the choice of operating system has always been yours to make.
Notes and sources
- Microsoft Learn, Extended Security Updates programme for Windows 10: pricing, scope, activation and end dates, accessed 24 September 2026.
- IASME, Cyber Essentials Knowledge Hub: Windows 10 end of life, the ESU programme and the 14-day patching requirement, accessed 24 September 2026.
- Primary Technology, UK year-one ESU pricing for commercial, education and non-profit customers, 8 October 2025, accessed 24 September 2026.
- Microsoft, Windows 10 consumer ESU, including the extension to 12 October 2027 announced June 2026, accessed 24 September 2026.
- Microsoft Learn, Microsoft 365 Apps security updates on Windows 10 ending 10 October 2028, accessed 24 September 2026.
- Thurrott, reporting Windows Central, on the Euroconsumers Digital Markets Act complaint that preceded the free EEA concession, 26 September 2025.
Prices are UK reseller figures for Microsoft's recommended commercial price, rounded, and the later years are derived from Microsoft's published doubling rule rather than published sterling prices. Confirm against your own licensing agreement. Adrian Hollister writes on digital sovereignty, cyber security and AI governance at AltLibre. This article is published under CC BY-SA 4.0.
