Microsoft has doubled the price of another year of Windows 10 security updates. For CIOs with hundreds or thousands of machines still using the older operating system, that's a sizable increase. But it may be far less than the cost of replacing equipment that still works and that the business still needs.
The second year of Microsoft's commercial Extended Security Updates (ESU) program began October 14 and runs through October 12, 2027. Standard volume-licensing prices have gone from $61 to $122 per device.
For an organization with 1,000 machines enrolled last year, that's $122,000 for this year's coverage. Keeping the same number through year three would cost $244,000, before the program ends October 10, 2028.
Where Windows 10 migration gets stuck
So which Windows 10 machines are worth paying to keep and which aren't?
The answer depends on what they're doing. A PC already in the Windows 11 upgrade queue is one thing. A computer connected to equipment the business relies on every day, with no upgrade available from the manufacturer, is another. And then there are machines that meet Windows 11's hardware requirements, but the applications haven't been fully tested or their vendors haven't certified them for the newer OS.
In findings released in July, IT asset management vendor Lansweeper reported that 16.9% of the Windows client devices it analyzed still ran Windows 10. Yet only 2.8% of those Windows 10 devices failed Windows 11's hardware requirements. Being able to run the newer OS doesn't necessarily mean the applications and business processes are ready for it.
And some obstacles go beyond software compatibility. Lansweeper's Esben Dochy told Computer Weekly in July that changing the OS on medical equipment can require regulatory recertification, for example. Retail equipment subject to warranty or compliance restrictions can present similar problems.
There are exceptions to the standard ESU timetable, too. Some specialized devices run Windows 10 Long-Term Servicing editions that have their own support dates, including some beyond October 2028. CIOs need to know exactly which machines require paid ESU coverage before they start calculating the cost.
When paying for ESU makes sense
Consider 200 Windows 10 devices connected to essential equipment that would cost millions to replace. Assuming those devices already had ESU coverage last year, keeping them covered in year two would cost $24,400 at standard prices. The third year would cost $48,800. That's potentially a lot less than replacing equipment that is still doing its job.
Of course, the ESU bill isn't the whole cost of keeping older systems running. There's maintenance, the work involved in supporting them and the risks that additional security updates can't eliminate.
If the equipment manufacturer has no plans to validate Windows 11, paying Microsoft for another year doesn't solve the eventual replacement problem.
And if the equipment manufacturer has no plans to validate Windows 11, paying Microsoft for another year doesn't solve the eventual replacement problem.
Replacing equipment costs more, too
The other side of this decision is getting more expensive as well. Omdia, a division of Informa TechTarget, found that global PC shipments fell 21% year over year in the third quarter. Higher prices weighed on demand, as did purchases brought forward earlier in the year. One reason computers are getting more expensive is the pressure AI infrastructure demand has put on memory supplies.
CIOs are already adjusting their purchasing plans. Steve Santana, CIO of educational testing organization ETS, told InformationWeek that Lenovo laptop prices had risen about 25% compared with what ETS previously paid. The organization responded by stretching its laptop replacement cycle from four years to six.
ETS had refreshed its Windows 10 laptops ahead of Microsoft's support deadline, so this wasn't an ESU decision. But Santana's experience shows why it can make sense to keep equipment longer when replacement costs are rising.
For CIOs whose remaining Windows 10 machines are tied to specialized equipment, there's potentially even more to consider. Replacing those systems can involve testing, certification and the possibility of taking important operations offline.
The decision to keep them last year might still be the right one. The business still needs the equipment, its applications might not be ready for Windows 11 and replacing everything could cost considerably more than paying for security updates.
Every year the math changes. Coverage gets more expensive, and there's less time to prepare for what happens when buying another year is no longer an option.
But every year the math changes. Coverage gets more expensive, and there's less time to prepare for what happens when buying another year is no longer an option.
Plan ahead without buying ahead
How much preparation CIOs need depends on why a device is still running Windows 10.
Machines already scheduled for Windows 11 may need ESU only until their turn comes. An application vendor that's still testing Windows 11 compatibility could take longer. The harder case is equipment with no foreseeable upgrade path. There, CIOs need to be thinking about replacements well before they're ready to purchase them.
Some decisions can be reconsidered each year. Others call for multiyear budgets, testing and work with the business side to make sure new equipment can do what the old equipment does today.
Two migrations covered by Computer Weekly show how much work may be involved.
A major UK financial institution moved more than 100,000 physical and virtual devices to Windows 11 while assessing 3,000 applications. The migration took a year, and some older applications were placed temporarily in virtual environments while teams worked through compatibility problems.
South Oxfordshire and Vale of White Horse district councils faced a different challenge. As part of a broader IT transition completed in 2025, they upgraded nearly 800 laptops to Windows 11 following two years of preparation. Even with that lead time, a 30-year-old planning application required weeks of testing and database work.
The limits of another ESU year
ESU gives CIOs more time, but there are restrictions on what they're buying. Licenses cover full years, with no partial-year option, and organizations enrolling for the first time in year two must also pay for year one.
The program provides critical and important security updates for eligible machines. It doesn't restore ordinary technical support or bring new features to Windows 10. Some eligible Windows 10 virtual machines running in Microsoft's cloud services can receive ESU without an additional charge.
CIOs and business leaders still have to decide which machines have good business reasons to stay, what replacing them would cost and how much longer they can reasonably be kept in service.
Getting the Windows 10 fleet down is one measure of progress. But so is having a credible plan for the machines that remain — one that preserves their useful life without leaving the business facing an expensive, disruptive replacement when ESU runs out.
James Alan Miller is a veteran technology editor and writer and Lead Editor for CIO News at Informa TechTarget. He directs coverage of enterprise technology strategy, AI, software, data, infrastructure and the decisions shaping how CIOs manage increasingly complex IT environments.
