If you're still running Windows 10 anywhere in your environment, mark October 13, 2026 on your calendar. It's not the original end-of-support date (that already passed in October 2025), but it's arguably the more important one for anyone who used the Extended Security Updates program to buy time.
What ESU Actually Covers
The Extended Security Updates program lets individuals and organizations keep receiving security patches for Windows 10 devices past the standard end-of-support date. It's important to be clear about what that does and doesn't mean: ESU delivers critical and important security updates only. It does not restore feature updates, usability improvements, or broad technical support. It's a bridge, not a continuation of normal support.
Why October 13 Is the Real Deadline
Year 1 of the ESU program ends on October 13, 2026. Here's the part that catches people off guard: if you don't enroll before that date, you don't just lose the option to join Year 1. Organizations that enroll late are required to purchase prior years of coverage before they can get current-year protection. In plain terms, waiting doesn't just risk running unpatched. It makes ESU itself more expensive once you finally do enroll.
After that window closes entirely, there is no further path to security updates for Windows 10 through any program. At that point, unpatched Windows 10 machines are simply exposed, permanently.
Why This Matters More Than a Typical EOL Date
Every OS end-of-life date creates some urgency, but this one lands at a bad time to be careless about it. AI-assisted attacks are cutting attacker dwell time down and increasing the volume of automated exploitation attempts against known vulnerabilities. An unpatched, out-of-support OS sitting on your network is exactly the kind of easy foothold that gets exploited fast, and 2026's threat data shows attackers are getting to that foothold faster than ever.
For an MSP client base, this isn't hypothetical. Any device still running Windows 10 past October 13 without ESU coverage becomes the weak link in an otherwise well-managed environment, and it only takes one weak link.
What to Do Now
Inventory first. Before anything else, get a clean count of every device still on Windows 10 across your environment, including anything that might have been missed during earlier Windows 11 rollouts, like conference room PCs, kiosks, or older laptops assigned to remote staff.
Check hardware eligibility. Not every Windows 10 machine can run Windows 11 due to TPM 2.0 and processor requirements. Devices that can't be upgraded need a replacement plan, not just a software update plan.
Enroll in ESU now if you need the bridge. If a full migration to Windows 11 won't be done before October 13, enrolling in ESU now avoids the penalty of buying back prior-year coverage later.
Budget for replacement hardware separately from software. For clients with older fleets, this is as much a hardware refresh conversation as a software one.
Ten weeks isn't a lot of runway if you're still carrying a meaningful number of Windows 10 devices. If you haven't had this conversation with your IT provider yet, now's the time. Reach out and we'll run the inventory and put a plan together before the deadline, not after it.
Want this reviewed against your environment?
We'll walk your stack with you and tell you plainly what we'd change first.