Windows 10 end of support: the UK business action plan
Security updates have stopped. What that actually means for risk, compliance and insurance, and how to plan the upgrade.
By the Telappliant team
Windows 10 no longer receives security updates. For UK businesses this is not a cosmetic upgrade prompt: it changes your risk profile, your Cyber Essentials position and, in many cases, your insurance cover.
What end of support means in practice
The operating system keeps working. What stops is security patching, which means every vulnerability discovered from now on stays open permanently on those machines. Attackers actively scan for unsupported estates precisely because the fix will never arrive.
The compliance and insurance consequences
- Cyber Essentials requires supported, patched software; unsupported Windows fails the assessment
- Most cyber insurance policies contain a supported-software condition
- Client and public sector security questionnaires ask the question directly
- ICO expectations around appropriate technical measures assume supported systems
Work out what you have before you buy anything
Audit the estate first: device model, age, CPU generation, TPM presence, RAM and disk. Most machines from the last five years upgrade in place. The exceptions cluster around specialist workstations, machines attached to production equipment, and whatever is running in the back of the warehouse.
Options for hardware that cannot upgrade
- Replace the device, which is usually cheapest over a three-year view
- Move the workload to a Windows 365 Cloud PC and keep the old machine as a thin client
- Buy Extended Security Updates as a bridge, accepting the annual cost escalates
- Isolate genuinely unavoidable legacy machines on a segmented network with no internet access
A rollout that does not generate a support queue
- Test line-of-business and sector-specific applications before touching users
- Pilot with a mixed group including your most demanding users, not the most patient
- Standardise the build with Intune so every machine comes back the same
- Schedule by team, communicate the date, and keep a rollback device available
- Retire old machines securely with certified data destruction
Turn the refresh into an improvement
An estate-wide rebuild is the cheapest moment you will ever get to fix disk encryption, remove local admin rights, enforce device compliance and standardise your endpoint protection. Doing it later means touching every machine twice.
