Windows 10 stopped receiving free security patches on October 14, 2025. For businesses that couldn't move every device to Windows 11 by then, whether because of line-of-business software that isn't certified yet or hardware that doesn't meet Windows 11's TPM 2.0 requirement, Microsoft's answer is a paid, three-year Extended Security Updates (ESU) program for commercial customers, separate from the shorter consumer enrollment option.
The commercial pricing is straightforward and, according to Microsoft's published licensing terms, cumulative: $61 per device for Year 1, doubling to $122 for Year 2, and $244 for Year 3. The catch is in that word cumulative. Microsoft's licensing rules require the earlier years to be purchased before the current year, so a business that skips Year 1 and enrolls in Year 2 doesn't just pay $122, it pays $183 per device minimum to get current. Wait until Year 3 and full coverage runs $427 per device. Several licensing partners report that window for buying Year 1 on its own closes around October 13, 2026, roughly one year after the commercial program opened; check the exact date with your Microsoft licensing partner or CSP, since enrollment terms are set by Microsoft and worth confirming directly rather than assuming from a blog post.
The bill only grows from here
Run the comparison for a business with, say, 15 devices still on Windows 10. Enrolling all 15 in Year 1 now costs $915. Waiting a year and enrolling in Year 2 instead costs $2,745, because Year 1 has to be purchased retroactively alongside it. There is no version of this where delay is the cheaper option: the price for coverage you didn't have doesn't disappear, it accumulates and compounds with the next year's higher rate.
This isn't a reason to buy ESU reflexively. It's a reason to make the decision on purpose, now, instead of by default next year. For a device that can move to Windows 11 with a straightforward upgrade, doing that is usually cheaper than three years of ESU. For a device that genuinely can't, because the hardware is fixed or the software vendor hasn't certified Windows 11 yet, enrolling in Year 1 while it's still available as a standalone purchase is the cheaper of the two paths that involve staying on Windows 10 at all.
Why this is still everyone's problem a year later
The reasons a business still has Windows 10 devices in service tend to be ordinary ones: a piece of practice management, accounting, or shop-floor software that hasn't been certified on Windows 11, a fleet of machines a few years too old to meet the hardware requirement, or simply "it still works fine" applied to a PC nobody's gotten around to replacing. None of those reasons make the underlying exposure smaller. An unpatched operating system accumulates publicly documented vulnerabilities that show up in the same vulnerability scanners attackers run against any exposed network, and that risk doesn't check what industry the device belongs to. A receptionist's PC and a production workstation carry the same unpatched OS underneath, and both are equally reachable once something else on the network is compromised.
Clear takeaway
Inventory what's still running Windows 10 this week. Move anything that can reasonably reach Windows 11 there, since ESU is a bridge, not a destination. For devices that genuinely can't move yet, enroll in ESU Year 1 now rather than later: the fee doesn't shrink if you wait, and Microsoft's cumulative licensing means delay is never the cheaper option.
Actions to take this week
- Inventory your device fleet and flag anything still running Windows 10, including machines that might be easy to overlook, like a back-office workstation or a conference room PC.
- For devices that meet Windows 11's requirements, plan the upgrade this quarter rather than treating ESU as the default.
- For devices that can't move yet because of hardware limits or software certification, enroll in ESU Year 1 through your Microsoft licensing partner or CSP now, and confirm your exact enrollment deadline directly with them.
- Budget for the eventual hardware refresh now rather than treating ESU as permanent. The per-device price doubles every year of the three-year program, on purpose, to push toward replacement rather than indefinite extension.
Brotherly Technology helps small and mid-sized businesses across our Northwest Georgia, metro Atlanta, and Chattanooga footprint sort out which devices need to move to Windows 11, which are worth an ESU year, and which have been due for retirement for a while now.
Sources: