Roughly three in ten business PCs are still running Windows 10, according to recent data from StatCounter and hardware makers like HP. For a lot of owners, that number has been easy to ignore. Nothing visibly breaks when an operating system ages out of support, the machine still boots, email still opens, invoices still go out. But October 13 is the date that changes the math, and it is worth putting on the calendar now rather than finding out about it from a vendor invoice.
What actually happens on October 13
Windows 10 reached the end of free security updates in late 2025. Microsoft’s Extended Security Updates program gave businesses a one year bridge, roughly 61 dollars per device, to keep getting critical patches while they planned a migration. That first year ends October 13, 2026. Year two of ESU does not just continue at the same rate, pricing doubles to around 122 dollars per device, and anyone who skipped year one and wants in now has to pay for both years at once. Year three, for the businesses that need to go that far, climbs again.
None of this is a cutoff in the sense of the machine stopping working. It is a cutoff in the sense of the machine no longer getting fixes for newly discovered vulnerabilities, while it keeps running your accounting software, your client files, and your email. The device still works fine, it just stops being defensible.
Why this is a bigger deal than it looks
For most consumers, an aging laptop is a personal risk. For a business, it is different. An unsupported, unpatched machine on your network is a weak point that insurers, auditors, and attackers all treat the same way: as the easiest door in. If your business carries cyber insurance, expect renewal questionnaires to start asking directly about patch status and supported operating systems. If you operate under any kind of compliance framework, CMMC, NIST 800-171, HIPAA, the expectation of running currently supported, patched systems is baked into the standard, not an optional nice to have.
Massachusetts businesses in particular should treat this as a forcing function rather than a line item. Our security stack and monitoring work with clients runs on the assumption that every endpoint is current and patchable, because that is what keeps detection and response actually effective. An unsupported OS undermines that foundation no matter how good everything else around it is. It also tends to be one of the first things flagged in a compliance readiness review, well before anyone gets to the more complicated controls.
Three paths forward, and how to choose
Every Windows 10 device in your business falls into one of three buckets right now:
- Upgrade in place. If the hardware meets Windows 11’s requirements and has the performance headroom to actually run it well, not just technically qualify, upgrading is usually the cheapest long term option.
- Replace the hardware. Older machines that meet Windows 11’s minimum specs on paper but struggle in practice are often better retired. Factor replacement into your Q4 or 2027 budget rather than waiting for a failure to force the decision.
- Pay for ESU, deliberately. For a small number of devices running specialized software that cannot move yet, a planned, time boxed ESU purchase can buy the right amount of runway, as long as it is a decision rather than a default.
The mistake we see most often is treating this as one decision for the whole fleet. It is not. It is a device by device inventory question, and the businesses that handle it well are the ones who did the inventory in September rather than November.
If you are not sure which of your machines are still on Windows 10, or what that means for your insurance renewal or compliance posture, that is exactly the kind of gap worth closing before it closes itself. Schedule a free security assessment with Cloud9 and we will tell you plainly where you stand.