On October 14, 2025, Microsoft will stop issuing security updates for Windows 10—leaving hundreds of millions of PCs exposed to new threats unless their owners act. The company has offered a one-year Extended Security Updates (ESU) bridge for $30 per device, with a few free enrollment routes, but taking it means linking your PC to a Microsoft account and still only buys time. For everyone still on Windows 10 version 22H2, the next 90 days are a triage sprint: inventory your hardware, decide what can upgrade, and lock down what can’t.

The Day the Patches Stop

After October 14, Microsoft will no longer deliver routine security fixes for Windows 10 through Windows Update to devices not enrolled in an ESU program. That includes Critical and Important patches for the kernel, drivers, and core components—the kind that plug holes attackers actively exploit. Feature updates and cumulative quality rollups also cease. Standard technical support from Microsoft disappears too.

A PC won't suddenly brick, but the protective maintenance layer that has shielded it every Patch Tuesday for a decade evaporates. Each uncovered vulnerability after that date becomes a standing invitation to malware, ransomware, and data theft.

What does continue? Microsoft 365 apps (Word, Excel, etc.) will receive security updates through October 10, 2028, and Microsoft Defender antivirus definitions will keep flowing for years, according to Microsoft’s published lifecycle timelines. But these app-level and anti-malware updates are narrow shields—they can’t patch the operating system itself. Attackers often chain exploits across unpatched OS surfaces and user applications. As first reported by BizzBuzz, the staggered support timelines create a false sense of safety for users who assume that Defender alone will keep them secure.

ESU: A $30 Stopgap—But Far From a Solution

Microsoft’s consumer ESU program offers a one-year lifeline: security-only patches through October 13, 2026, for devices that enroll and meet the prerequisites. The price is $30 per license, though Microsoft has carved out two free enrollment paths: you can sync your Windows Backup settings to a Microsoft account at no extra cost, or redeem Microsoft Rewards points. The license can cover multiple devices tied to the same Microsoft account, according to coverage from BizzBuzz and Microsoft’s support documentation.

Critically, ESU requires a Microsoft account for enrollment—local Windows accounts won’t work. That’s a dealbreaker for privacy-conscious users or organizations that deliberately use local accounts. The device must also run Windows 10 version 22H2 with recent cumulative updates installed. Older builds or untended machines must be brought up to date first, which is still possible until October 14.

ESU is explicitly not a feature update pipeline. It delivers only Critical and Important security patches. Non-security fixes and technical support aren’t included. Think of it as emergency patching for a dying OS, not a migration plan.

Enterprises have their own multi-year ESU programs (up to three years), but per-device costs escalate annually. Small businesses and schools, however, often fall between the consumer and enterprise tracks, making the $30 option their only realistic bridge.

Your Risk Multiplies Without Action

Running an unsupported OS is an accumulating danger, not an instant catastrophe. Without monthly patches, every new vulnerability that Microsoft fixes for Windows 11—and publicly documents—remains open on Windows 10. Attackers reverse-engineer those patches and target the unpatched population. Over months, the attack surface swells. In regulated industries, failure to maintain supported, patched software can trigger compliance violations, audit failures, and insurance gaps. Even home users may see their online accounts or financial data targeted through unpatched browser or kernel exploits.

The environmental and social risks are also material. The Public Interest Research Group (PIRG) has led a petition campaign warning that Microsoft’s hard cutoff could accelerate e-waste, potentially sending hundreds of millions of functional PCs to landfills. While precise tonnage estimates vary, the group’s call for extended free support highlights real-world consequences for users who cannot afford new hardware.

How 400 Million PCs Got Stranded

Windows 10 still commands roughly 45% of desktop Windows installs globally, according to analytics firms like StatCounter. That translates to around 400–500 million devices. The reason they’re not all moving to Windows 11 is simple: hardware requirements.

Windows 11 demands TPM 2.0, Secure Boot, and specific CPU generations (Intel 8th-gen or newer, AMD Ryzen 2000 or newer). Many perfectly functional PCs from 2015–2018 lack these features. Microsoft has not budged on the minimums, citing security benefits like virtualization-based protection and hardware root-of-trust. But for users and small businesses, the cost of a replacement PC—often $500 or more—is prohibitive at scale.

Consumer advocates have pushed for a free extension. While some outlets have reported a specific letter from Consumer Reports to Microsoft CEO Satya Nadella, independent verification of that letter remains elusive at the time of this writing. PIRG’s public campaign, however, is fully documented. Multiple lawsuits have also been filed alleging forced obsolescence and anticompetitive behavior, though those cases will take years to resolve.

What to Do Right Now: A Complete Action Plan

1. Inventory Every Windows 10 Machine You Own or Manage

List each device’s model, processor, TPM version, and current Windows 10 build (must be 22H2 for ESU eligibility). Use the built-in “tpm.msc” console to check TPM, or run “winver” for the build number. For organizations, deploy a free network scanner to gather this data automatically.

2. Check Windows 11 Compatibility

Download Microsoft’s PC Health Check tool from the official site. If the device meets all requirements, your upgrade path is free and straightforward. Before upgrading, back up all important files to an external drive or cloud service, update BIOS/firmware to the latest version from the manufacturer, and install any pending Windows 10 updates.

3. For Eligible PCs: Upgrade Now

Go to Settings > Update & Security > Windows Update and select “Check for updates.” If Windows 11 is offered, you can install it directly. Alternatively, use the Windows 11 Installation Assistant, or create a bootable USB with the Media Creation Tool. The process typically takes less than an hour. Post-upgrade, verify that your apps and peripherals work, and enable BitLocker or device encryption for added security.

4. For Ineligible PCs: Decide on ESU or an Alternative OS

If your PC can’t run Windows 11, you have three practical options:

  • Enroll in ESU (temporary). Update to Windows 10 22H2 and apply all current patches. Then, decide which enrollment route you’ll take: enable Windows Backup sync (free, but requires a Microsoft account), redeem Microsoft Rewards points, or purchase the $30 license. Set a calendar reminder for October 2026—when ESU ends, you’ll face this decision again.
  • Switch to a light Linux distribution or ChromeOS Flex. Distributions like Linux Mint, Ubuntu, or ChromeOS Flex can breathe life into older hardware, offering security updates for years. Be mindful that some Windows apps may not run, and there’s a learning curve. But for basic browsing, email, and document work, it’s a zero-cost alternative that avoids e-waste.
  • Accept the risk (not recommended). If you must keep the device offline or in a highly controlled environment, isolate it from the internet and other network resources. This is only suitable for non-sensitive, non-networked tasks.

5. For Businesses and IT Admins: Build a Triage Matrix

Prioritize devices by role. Critical endpoint? ESU or immediate replacement. Non-critical? Consider Linux or segmented isolation. Commercial ESU for up to three years is available but gets expensive; use it only for legacy systems you cannot migrate yet. Budget for hardware refreshes in the next 12 months, and negotiate trade-in programs with vendors to reduce e-waste.

6. Don’t Forget Your Data and Accounts

Before any OS change, ensure you have a full backup. Also, verify that your digital licenses, product keys, and account credentials are accessible—especially if you’re moving from a local account to a Microsoft account for ESU.

The Outlook: Beyond 2026

After consumer ESU expires in October 2026, there is no further safety net unless Microsoft changes policy. The pressure from advocacy groups, ongoing lawsuits, and potential regulatory scrutiny could force a concession—perhaps a free extension for schools or low-income households. But speculating on that is risky. The smart move is to assume the deadline is final and plan accordingly.

Microsoft’s posture is clear: Windows 11’s hardware-enforced security features represent the future, and the company is unwilling to indefinitely maintain a 10-year-old codebase. For users, the next three months are about practical triage. Inventory. Upgrade where you can. Buy time with ESU where you must. And start evaluating long-term alternatives for hardware that can’t make the jump. October 14 won’t be a digital apocalypse, but for anyone who ignores it, the slow drip of unpatched vulnerabilities will soon become a flood.