Cyber Essentials and Cyber Essentials Plus Explained
Cyber Essentials is the UK Government backed scheme that shows your business has the basic security controls in place. Here is how it works, what it costs and how to prepare.
Key takeaways
- Windows 10 support ended on 14 October 2025. Without Extended Security Updates, PCs get no more security fixes.
- Year one of commercial Extended Security Updates covers devices to 13 October 2026. Year two runs to 12 October 2027 and year three to 10 October 2028.
- Microsoft's published price for organisations doubles each year, and you must pay for earlier years if you join late.
- Extended Security Updates are a short term bridge. The real fix is upgrading or replacing PCs with Windows 11.
On 14 October 2025, Windows 10 reached end of support. Plenty of businesses were not ready, and many bought Microsoft's paid Extended Security Updates (ESU) to keep older PCs patched while they caught up. That first year of cover ends on 13 October 2026. If you still have Windows 10 PCs in the business, this is the moment to decide what happens next, rather than drifting into a second year by default or, worse, losing security updates without noticing.
What end of support actually means
Microsoft's Windows 10 ESU documentation is clear about what stopped on 14 October 2025: technical support, feature updates and quality updates, including security fixes. Windows 10 PCs did not stop working. They still start up and run your software. The problem is that every new security flaw discovered since then stays unfixed on any PC that is not enrolled in ESU.
That matters because attackers actively look for unpatched systems, and because many of the things businesses rely on assume supported software:
- Cyber Essentials requires software to be licensed, supported and kept up to date with security updates. An unsupported operating system without ESU will normally fail. Our guide to Cyber Essentials explains the requirements.
- Cyber insurance proposal forms commonly ask whether you run unsupported software. Check your policy wording, as described in our article on cyber insurance.
- Software vendors gradually stop supporting their own products on Windows 10.
The Extended Security Updates programme and its dates
ESU is a paid, yearly subscription that delivers critical and important security updates to enrolled Windows 10 PCs. According to Microsoft's lifecycle FAQ on Extended Security Updates, the programme for organisations runs for a maximum of three years:
| ESU year | Coverage ends | Microsoft's published price structure |
|---|---|---|
| Year 1 | 13 October 2026 | 61 US dollars per device through volume licensing |
| Year 2 | 12 October 2027 | The price doubles from year 1 |
| Year 3 | 10 October 2028 | The price doubles again; this is the final year |
A few points from Microsoft's documentation are worth knowing:
- The price rises each year. Microsoft lists year one at 61 US dollars per device and says the price doubles every consecutive year. UK pricing depends on how you buy and is quoted excluding VAT, so ask your licensing provider for a current figure.
- Cover is cumulative. If you join in year two, you also have to pay for year one. Joining late is not a way to save money.
- It is bought by the year. You cannot buy a few months.
- PCs must be on Windows 10 version 22H2, the final release, and the editions that qualify include Pro, Enterprise and Education in commercial use.
- ESU does not include new features or general technical support. It is security updates only.
- Some cloud scenarios are included at no extra cost. Microsoft says Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop get ESU without an extra charge, and Windows 10 devices used to connect to Windows 365 Cloud PCs are entitled to ESU with an active Windows 365 licence.
Microsoft's own lifecycle FAQ describes ESU as "a last resort" and a temporary bridge, not a long term solution.
What changes on 13 October 2026
If your Windows 10 PCs are enrolled in year one of ESU, they are covered up to and including 13 October 2026. After that:
- If you have bought year two and the new licence is activated on each PC, security updates continue until 12 October 2027.
- If you have not, those PCs stop receiving security updates and are in the same position as any unsupported Windows 10 PC.
Year two is a separate licence, so do not assume it renews automatically. Check with whoever manages your licensing that year two has been purchased and that the activation key has been applied to every PC that still needs it. If you are unsure, check today.
What to do now if you still run Windows 10
1. Take stock
List every Windows 10 PC, who uses it, what it runs and whether it is enrolled in ESU. Remote management tools can produce this list in minutes.
2. Check which PCs can upgrade
Microsoft lists the minimum requirements for Windows 11 as:
- A compatible 64 bit processor running at 1 GHz or faster with at least 2 cores
- 4 GB of memory and 64 GB of storage
- UEFI firmware with Secure Boot capability
- Trusted Platform Module (TPM) version 2.0, a security chip used for encryption and secure sign in
- DirectX 12 compatible graphics and a 720p display larger than 9 inches
Many PCs bought in the last few years meet these requirements and can be upgraded for free. The processor requirement is the one that rules most older machines out. Bear in mind that the minimum is just that. A PC with 4 GB of memory will run Windows 11 slowly, so upgrading memory or replacing the PC may be the better choice.
3. Upgrade, replace or bridge
- Upgrade eligible PCs to Windows 11 now, after checking your key business software supports it.
- Replace PCs that cannot upgrade or are near the end of their useful life. Our guide on when to replace business computers can help.
- Buy year two of ESU only for PCs that genuinely cannot be moved yet, such as a machine running specialist software awaiting a vendor update, and set a date to retire them.
- Isolate any PC that must stay on Windows 10 without ESU, for example by keeping it off the internet and away from email, and plan to replace it.
4. Put it in the roadmap
Spread replacement costs over the next year in an IT roadmap rather than facing them all at once next October when year two ends.
A quick Windows 10 checklist
- We know how many Windows 10 PCs we still have and who uses them.
- Each one is either enrolled in ESU year two, scheduled for upgrade or scheduled for replacement.
- Year two ESU has been purchased and activated where needed, before 13 October 2026.
- Our key business software has been checked for Windows 11 support.
- We have a budget and dates for replacing PCs that cannot run Windows 11.
- Unsupported PCs without ESU are isolated from email and the internet.
How Cyber Fits can help
We help businesses in Sunderland and across the North East check which PCs can run Windows 11, plan upgrades with minimal disruption and source replacement hardware. See our IT hardware and IT projects pages, or book a free IT review and we will give you a clear list of what needs doing.
Frequently asked questions
When did Windows 10 support end?
Microsoft ended support for Windows 10 on 14 October 2025. Since then, only PCs enrolled in the paid Extended Security Updates programme receive security updates.
When does Windows 10 Extended Security Updates year one end?
According to Microsoft's lifecycle FAQ, year one for organisations ends on 13 October 2026. Year two runs to 12 October 2027 and year three, the final year, to 10 October 2028.
Can we buy Windows 10 ESU year two without year one?
No. Microsoft says ESU is cumulative, so if you join in year two you must also pay for year one.
Will my Windows 10 PC stop working after support ends?
No. It will keep working, but without Extended Security Updates it receives no security fixes, which makes it increasingly risky to use for email, browsing and business data.
What are the main Windows 11 hardware requirements?
Microsoft lists a compatible 64 bit processor with at least 2 cores, 4 GB of memory, 64 GB of storage, UEFI with Secure Boot capability, TPM 2.0 and DirectX 12 compatible graphics.
Written by the Cyber Fits team
IT support and cyber security, Sunderland
Our guides are written by the team who support businesses across the North East every day. If anything here raises a question about your own setup, ask us.