A few weeks ago I published a piece about Windows 10 extended security updates and the extension program that most business owners heard about but never actually enrolled in. I want to come back to that one, not to walk it back, but to fill in something I left out.
Nobody gets every detail right on the first pass, including me. What matters is that you check your work, stay current, and say something when the picture is more complete. The core of that issue holds: if you did not enroll in the ESU program, you did not get an extension. You got the headline. But there is a wrinkle I did not address, and for some businesses it is a meaningful one.
What the Windows 10 Extended Security Update Program Actually Covers
Here is what I glossed over. The ESU program for commercial customers is not a single one-year bridge ending this October. Microsoft structured it as three fixed annual periods extending through October 2028. Year One runs through October 13, 2026, at $61 per device. The second year runs through October 2027 at $122 per device and the third year runs through October 2028 at $244 per device. For a business with a legitimate reason to delay a full migration, that runway exists and it is worth knowing about.
The word “fixed” is doing real work in that sentence. These are not rolling windows that start from whenever you decide to enroll. They are calendar periods on Microsoft’s schedule. A business enrolling in Year Two today does not receive a fresh twelve months of coverage. It receives coverage through October 2027, and it must also purchase Year One retroactively to do so. The minimum cost of entry at that point is $183 per device before a single update has been applied.
I also want to be direct about where businesses that never enrolled actually stand. The clock did not pause while you were deciding. Windows 10 lost mainstream support in October 2025. If your machines were not enrolled by then, they have been running without security patches for eight months. That is not a future risk. That is the current state.
For businesses that did enroll, the runway is real but it is not open-ended. You bought time on Microsoft’s calendar, and that calendar is moving.
The Cost of Extending Versus Replacing
Three years of ESU coverage runs $427 per device at full price. A Lenovo ThinkCentre M90t Gen 6, the Ultra 5 225 Processor with 16GB DDR5 RAM and a 512GB SSD running Windows 11 Pro, is $1,299.00 at Lenovo as of this writing, monitor not included. That means three years of patching an aging Windows 10 machine costs you roughly one-third of a current commercial-grade replacement. Across ten devices, you have spent enough to buy three new machines, and at the end of it you still own ten machines that need to be replaced. The ESU program is not an alternative to upgrading. It is a surcharge for delaying it.
When Delaying the Windows 11 Upgrade Is Actually the Right Call
That said, there are real reasons to delay. A production environment where an untested upgrade creates operational risk is a legitimate reason. A business managing a large number of devices that needs to stage the migration to control cost and logistics is a legitimate reason. For those situations, the commercial ESU program exists precisely as the tool to use, and I should have said so in the first piece.
For everyone else, the path forward has not changed. Many machines running Windows 10 meet the hardware requirements for Windows 11 and can be upgraded in place without replacement. That is a short job, not a complicated one. The machines that cannot upgrade in place need to be replaced, and the time to plan that is now, not in September when every IT provider in the region is having the same conversation with everyone who waited.
If you want to know which situation you are in, that is exactly the kind of question worth answering before October makes the timeline uncomfortable.
