Windows 10 security updates just doubled. Decide device by device

On October 14, the second year of Microsoft's paid security updates for Windows 10 began, and the price per device doubled. Many businesses bought year one as a bridge while they finished replacing older PCs. If those PCs are still in service, the bridge just got more expensive, and it will double again next October. This is a good moment to decide, device by device, what you are actually paying to keep.

What changed on October 14

Windows 10 reached end of support on October 14, 2025. Since then, the only way for a business PC to keep receiving security patches has been the Extended Security Updates program. Microsoft's ESU program page sets the price for organizations at $61 per device for year one and says the price doubles every consecutive year, for a maximum of three years. That puts year two at $122 per device and year three at $244.

Microsoft's lifecycle FAQ lists the coverage years. Year one ended October 13, 2026. Year two runs to October 12, 2027, and year three ends October 10, 2028. After that, there is no further paid option for these editions.

Joining late costs more than you might expect

The program is cumulative. Microsoft states that if you buy in year two, you have to pay for year one too. A device that skipped year one and enrolls now costs $183 to cover, not $122. Coverage is also sold by the year only, with no partial periods. If you plan to retire a machine in February, you still pay for the full year.

It is also worth being clear about what the money buys. ESU covers critical and important security updates. It does not include new features, non-security fixes or general technical support. Devices must be running Windows 10, version 22H2, to qualify. Paying for ESU keeps a PC patched. It does not keep it current.

Other deadlines are stacking up

Windows 10 PCs are not the only clock running. According to Windows Central, Windows 10 Enterprise LTSB 2016 and IoT Enterprise 2016 LTSB also reached end of support on October 13, 2026. These editions often sit in places nobody thinks about: kiosks, shop-floor stations, lab equipment and point-of-sale systems. The same report notes that Windows Server 2016 reaches end of support on January 12, 2027, less than three months from now.

Office is moving too. Microsoft's Microsoft 365 Apps guidance says Windows 10 devices receive feature updates only until Version 2608, then stay on that version with security updates through October 10, 2028. If a problem occurs only on Windows 10, Microsoft says it will ask you to move to Windows 11.

Sort every remaining device into one of four buckets

Start with an accurate count. Pull the list from your endpoint management or asset tools, then confirm it with the people who use the machines. For each device, decide which of these applies:

• Upgrade in place. The hardware supports Windows 11 and the applications have been tested. This is usually the cheapest path.
• Replace. The hardware is not eligible or is near the end of its useful life. Compare the cost of a new device with two more years of ESU, plus the support time an aging PC consumes.
• Move to a hosted desktop. Microsoft says ESU is available at no additional cost for Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop, and that Windows 10 devices connecting to Windows 365 Cloud PCs are entitled to ESU with an active subscription. That can make sense for some roles, but price the subscriptions, network and support honestly.
• Keep and pay, on purpose. Some machines run software or equipment that cannot move yet. Pay for ESU on those, document why, and set a retirement date.

The bucket that causes trouble is the fifth one nobody names: devices that are simply forgotten. They stop receiving patches quietly, and they tend to show up again during a security incident or a cyber insurance review.

Questions to ask your IT provider this quarter

How many Windows 10 devices do we still have, and which bucket is each one in? Which did we pay year one for, and which are now unpatched? Are any LTSB 2016 or Server 2016 systems still running, and what is the plan for each? What is the total cost of year two ESU compared with replacement or hosted desktops for the same devices? Who owns the retirement date for every exception?

If your managed IT provider or internal team cannot answer these quickly, that is useful information in its own right. It usually points to a gap in who owns the asset list.

How StrategIQ IT can help

Before founding StrategIQ IT, Brian spent years as the enterprise customer accountable for technology, and then built a practice on the partner side around what he wanted as a buyer. We can help you build the device inventory, compare upgrade, replacement, hosted desktop and ESU costs side by side, and evaluate managed or co-managed IT providers to carry the work. We are vendor-agnostic by design. Our partnerships span more than 200 providers, and in most cases StrategIQ is paid by whichever provider you choose, so we have no reason to steer you to one platform. Working through us does not raise your price. Our technology overview checklist is a practical place to start the inventory. If end-of-life planning keeps landing on nobody's desk, our fractional CIO / CTO service provides ongoing senior technology leadership to own the roadmap, budget and renewals. Scope, fees and how StrategIQ is paid are explained before you proceed. The first 20-minute conversation is free.