As the end-of-support date for Windows 10 approaches – set for 14 October 2025 – many organisations are facing a familiar dilemma: what to do with devices that can’t yet be upgraded.
For businesses still relying on Windows 10, Microsoft’s Extended Security Updates (ESU) programme offers a temporary lifeline. But what exactly is ESU, and is it the right solution for your organisation?
In this article, we’ll explore what Microsoft ESU is, why it exists, and how it can help businesses stay secure and compliant while they transition to newer systems.
A Safety Net for Legacy Systems
Microsoft ESU – short for Extended Security Updates – is a paid subscription service that provides critical and important security patches for Windows operating systems after their official support ends.
It’s not a new concept; Microsoft has offered ESU for previous versions of Windows, including Windows 7. Now, with Windows 10 nearing its sunset, ESU is back on the table.
The idea is simple: if your organisation isn’t ready to upgrade to Windows 11 by the deadline, ESU allows you to continue receiving essential security updates for up to three additional years.
This helps protect your systems from vulnerabilities and ensures you remain compliant with security standards like Cyber Essentials.
What You Get – and What You Don’t
It’s important to understand that ESU is not a full extension of support. It doesn’t include new features, design changes, or non-security updates. Nor does it offer general technical support.
What it does provide is a continuation of critical and important security updates – the kind that protect against malware, ransomware, and other threats.
Only devices running Windows 10 version 22H2 are eligible, so if your systems are on an earlier version, you’ll need to update them before enrolling in ESU.
A Time-Limited Offer
ESU is available for three years beyond the end-of-support date, with each year sold separately. The pricing increases annually, starting at around £61 per device for the first year. This incremental cost is designed to encourage organisations to move forward with their upgrade plans rather than rely on ESU indefinitely.
The timeline is clearly defined:
Year 1: 15 October 2025 – 13 October 2026
Year 2: 14 October 2026 – 12 October 2027
Year 3: 13 October 2027 – 10 October 2028
Skipping a year isn’t an option – you must purchase each year in sequence to remain eligible.
Who Should Consider ESU?
Not every business will need ESU. If you’re already on track to upgrade to Windows 11, you can likely ignore it altogether. But for organisations with legacy applications, hardware refresh cycles that extend beyond 2025, or complex upgrade dependencies, ESU can be a vital tool.
It’s particularly useful for sectors like healthcare, manufacturing, and finance, where specialised software may not yet be compatible with Windows 11.
In these cases, ESU provides breathing room – a way to maintain security while working through the upgrade process.
Getting Started with ESU
Enrolling in ESU is relatively straightforward. Licences can be purchased through Microsoft’s Volume Licensing Programme or via your IT supplier.
If your organisation uses cloud-based environments like Windows 365 or Azure Virtual Desktop, ESU may be included at no extra cost.
Once you’ve secured the licences, your IT team will need to deploy activation keys and configure update settings to ensure your devices continue receiving patches.
Is ESU Worth the Investment?
That depends on your organisation’s circumstances. ESU isn’t cheap, and over three years, the costs can add up. But when weighed against the risks of running unsupported systems – including data breaches, compliance failures, and reputational damage – it may be a worthwhile investment.
It’s also worth considering the operational impact. Unsupported devices can become a liability, especially if your business holds certifications that require up-to-date security measures. ESU helps you maintain continuity while preparing for a full migration.
How can ITC Service help with ESU?
Navigating ESU can be complex – especially for organisations with large device estates or limited internal IT resources. That’s where we can help.
As a trusted Microsoft partner, we can help assess your current infrastructure, identify which devices require ESU, and manage the licensing and deployment process from start to finish.
Whether you need support with compliance, patch management, or planning your migration to Windows 11, ITC provides tailored solutions that align with your business goals. Their team of experts ensures you stay protected while making the transition as smooth and cost-effective as possible.
Looking Ahead
Microsoft ESU is a stopgap, not a solution. It’s designed to give organisations time to upgrade, not to delay the inevitable.
If your business is still running Windows 10, now is the time to audit your device estate, identify upgrade blockers, and make a plan.
Whether you choose ESU or move directly to Windows 11, the key is to act early. Waiting until the last minute could leave your systems exposed – and your business at risk.
