Windows 10 ESU pricing for businesses starts at 61 dollars per device and doubles each year, reaching 122 in year two and 244 in year three. The detail that changes the decision is that the years are cumulative. A firm that skips year one and enrolls in year two does not save the first year, it pays for both. So the usual instinct of deferring a cost until you have to face it produces the single most expensive path available, and it does so quietly, because nothing bills you until the moment you finally enroll. We have run this arithmetic for a lot of estates this year, and most firms are still treating it as a decision they can make later.
The Five Numbers That Settle This
Put these against your own device count before anyone debates whether Windows 11 is ready.
- 61, 122, 244 dollars per device. Years one, two and three of the business program, doubling annually.
- Back-years are cumulative. Enroll late and you pay the years you sat out, so delay increases total cost rather than deferring it.
- October 12, 2027 is the end of the road. The extension moved the date. It did not remove it.
- The consumer 30 dollar option is not available to you. Business devices go through volume licensing at the figures above.
- Your blocker is hardware, not preference. Most estates that cannot move are held by a processor generation or a firmware setting, and those are two different problems with two different costs.
Our note on the IT costs firms miss when budgeting covers where this usually lands in a plan.
Why Windows 10 ESU Rewards Deciding Early
The cumulative structure means the cheapest version of every outcome belongs to the firm that decides now, whichever outcome it chooses. That is unusual. Most IT spending decisions can be deferred at no cost beyond the risk you carry meanwhile, which is why deferral is the default management response to an uncomfortable quote. Here, deferral is itself a purchase. A firm that spends a year deciding and then enrolls has bought a year of coverage it did not use, at a price that also went up. A firm that decides now either enrolls at the lowest rate available or commits the same money to a refresh that ends the problem permanently. Both are better than the middle path, and the middle path is where most firms currently are.
Count Devices by Upgrade Eligibility, Not by Age
Split your estate into machines that can take Windows 11 today, machines blocked by a firmware setting, and machines blocked by hardware, because those three groups have completely different costs and most inventories do not distinguish them. The first group needs scheduling, not money. The second group is often blocked by a security module or boot mode that is present but switched off, which is a technician visit rather than a purchase, and it is regularly mistaken for a hardware failure. Only the third group genuinely needs replacing. We routinely find that the population which “cannot upgrade” is a third smaller than the business believes once somebody checks properly. The counterargument is that checking every device takes time a small team does not have, which is fair, and the answer is to sample. Check twenty machines across your common models and you will know which category dominates without touching all two hundred.
Compare Against Refresh, Not Against Zero
The right comparison for ESU is not against doing nothing, it is against the replacement you will eventually buy anyway, discounted for the time value of deferring it. A device you were going to replace in eighteen months costs you one year of ESU to defer, which at 61 dollars is often good value for spreading capital expenditure. A device you would otherwise keep for four more years is a different calculation, because you are looking at year one plus year two plus year three, and by then you have spent a meaningful fraction of a replacement machine on keeping an old one patched. Run it per group rather than per estate. Our cloud migration planning guide covers the adjacent question of what belongs on a local device at all, which sometimes removes the machine from the calculation entirely.
What Happens If You Simply Do Nothing
Running unsupported Windows is not an immediate outage, it is a slowly compounding exposure that shows up first in places most firms do not associate with the operating system. Nothing stops working on the deadline. The machines boot, the applications run, and for a while nothing visibly changes, which is exactly why this decision drifts. What changes is that each new vulnerability in the platform stays open on those devices permanently, and the population of known-unpatched flaws only grows. Alongside that, the practical consequences arrive through third parties rather than through Microsoft, and they arrive on their own schedule.
Your Insurer and Your Clients Will Ask Before Your Users Notice
Cyber insurance questionnaires and client security reviews both ask whether you run unsupported operating systems, and answering honestly gets more expensive than the ESU fee in many cases. This is the consequence that surprises firms, because it does not feel like a technical risk. A renewal questionnaire asks a direct question. Answer yes and you face a loaded premium, a coverage exclusion, or a remediation condition with a deadline shorter than the one you were trying to avoid. Answer no and you have misrepresented a material fact on an insurance application, which is a considerably worse position than an unpatched laptop. Client security reviews work the same way in regulated supply chains. The objection that plenty of firms run unsupported systems quietly and nothing happens is true right up to the renewal or the review, which is precisely when the cost lands and the timeline is no longer yours.
Compliance Frameworks Treat It as a Control Failure
Any framework requiring supported software turns an unsupported estate into a finding, and findings carry remediation timelines set by somebody other than you. If you hold obligations under a security framework, a client contract, or a regulatory regime, the supported-software requirement is usually stated plainly and is not open to interpretation about residual risk. The reasonable counterpoint is that a well-segmented unsupported device with restricted network access can be genuinely lower risk than a fully patched machine with broad access, and a thoughtful assessor will hear that argument. Our experience is that this works as a compensating control for a small number of machines with a documented rationale, such as a device tied to instrumentation that cannot be upgraded, and it does not work as a strategy for forty laptops. Our business continuity practice handles those isolated exceptions regularly, and they look nothing like an estate-wide deferral.
Building the Plan Backward From October 2027
Work backward from the deadline with realistic procurement and deployment rates, because the constraint for most firms is not budget but how many machines a small team can actually cut over per week. A two-person team migrating five devices a week needs forty weeks for two hundred machines, before holidays, before the week everything else goes wrong, and before the finance department’s month-end when nobody may touch anything. That arithmetic usually shows the project needs to start considerably earlier than the budget conversation assumes. Our note on the signs your IT support is failing covers the capacity question honestly, since a team already at capacity will not absorb this on top.
Sequence by Risk, Not by Convenience
Migrate the machines with the most exposure first rather than the ones that are easiest, because the ordering decides what your risk looks like halfway through rather than at the end. Devices used by people who handle payments, hold administrative rights, travel with the machine, or work with regulated data should move first. Devices in a fixed location with a narrow role can wait. This ordering feels wrong to technicians, who naturally want to clear the easy wins and build momentum, and there is a legitimate argument that early momentum keeps a long project alive. Split the difference: take a handful of easy machines first to prove the process, then switch to risk order and stay there. What you want to avoid is finishing with every high-risk device still unmigrated because they were the awkward ones.
Budget the ESU You Will Actually Need, Not Zero
Assume a portion of the estate will still be on Windows 10 at the deadline and buy ESU for that portion deliberately, rather than planning for a clean finish and enrolling in a panic. Every large migration leaves a tail: the machine attached to a production line, the laptop belonging to somebody on leave, the workstation running software whose vendor has not certified the new platform. Planning for that tail is realistic rather than pessimistic, and it costs far less than discovering it in the final month, when your only option is a late enrollment that carries the cumulative back-years. There is a counterargument that budgeting for failure guarantees it, and that teams given an ESU safety net will migrate more slowly. That is a real management risk. Handle it by naming the specific machines expected to be in the tail rather than a percentage, because a named list stays small and a percentage grows. Our emergency support work and local IT support teams both see the version of this that gets left too late, as does our disaster recovery practice when an unsupported machine is the one holding something nobody had backed up.
Decide Who Signs Off on the Tail Before It Forms
The machines still on Windows 10 at the deadline will be there because somebody said they could not move, and that decision needs a named owner and a review date or it becomes permanent by default. In every estate we have worked through, the tail is not a technical residue, it is a collection of individual exemptions granted at different times by different people for reasons that were good at the time. A production machine tied to instrumentation. A workstation running a vendor application awaiting certification. A laptop belonging to somebody who was mid-project when their slot came up. Each is defensible on its own. Collectively they are an unsupported estate nobody chose.
Write each exemption down with three fields: who approved it, why, and when it will be revisited. That is the whole mechanism, and it works because it converts an unreviewable state into a list somebody reads quarterly. The reasonable objection is that this is bureaucracy applied to a technical problem, and that the machines will move when the blockers clear regardless of whether anyone logged them. Our experience says otherwise, because blockers rarely clear on their own. A vendor certifies the new platform and nobody notices for a year, since the person who raised the exemption has moved on and nothing is watching for the answer. The review date is what turns that into a five-minute check instead of a discovery made during the following year’s budget round.
Frequently Asked Questions
How much does Windows 10 ESU cost a business?
Sixty-one dollars per device in year one, 122 in year two, and 244 in year three under volume licensing. The consumer options, including the thirty dollar purchase, are not available for business devices.
Can we enroll later and skip the early years?
No. The fees are cumulative, so enrolling in year two means paying year one as well. Delay raises the total rather than deferring it.
When does Windows 10 support actually end?
October 12, 2027 with extended security updates. The extension moved the date rather than removing it, and the program ends there.
Do we need new hardware for Windows 11?
Some machines do, many do not. A large share of devices that appear ineligible are blocked by a firmware setting rather than by hardware, which is a technician visit rather than a purchase. Check before you budget.
What if a vendor has not certified our software for Windows 11?
Name those machines specifically and plan ESU for them rather than for a percentage of the estate. A named list stays small and gives you something concrete to push the vendor on.
Who You Are Taking This Advice From
Mindcore has moved a lot of estates across this kind of deadline, which means we have seen both failure modes: the firm that refreshed everything a year early and spent capital it did not need to, and the firm that reached the last quarter with sixty machines and no options. We inventory by upgrade eligibility rather than by age, sequence by exposure, and name the tail machines early, and the figures above come from plans we have costed this year rather than from a licensing page. Matt Rosenthal, who leads Mindcore, keeps the firm focused on decisions a business can actually fund in the year it makes them, which here means comparing ESU against the refresh you were going to buy anyway rather than against an ideal. You know which machines cannot move. Our job is to make sure that list is real and short.
Your Next Move Before the Deadline
Get the count first, split three ways: upgradeable today, blocked by a setting, blocked by hardware. Sample twenty machines across your common models rather than auditing everything, because the proportions are what you need and they hold. Then price the two paths for each group, comparing ESU against the replacement you were going to make anyway rather than against doing nothing. Work backward from October 2027 at a migration rate your team can genuinely sustain, and if that arithmetic does not fit, you have found the real constraint and it is people rather than money. Name the specific machines you expect to still be running Windows 10 at the end, and buy ESU for those deliberately and early, because the cumulative pricing punishes exactly the late decision that a hopeful plan produces. The firms that handle this well are not the ones with the biggest budget, they are the ones who did the count while there were still options. If you want somebody to run the eligibility split and cost both paths with you, book a free strategy call and we will start with your device list.
