The second year of the Windows 10 Extended Security Updates programme began on 14 October 2026. Under Microsoft's pricing rule, the per-device annual fee doubles every consecutive year.
Windows 10 reached end of support on 14 October 2025. For organisations that still need security patches, Microsoft offers the Extended Security Updates (ESU) programme — and its second year began on 14 October 2026. With it, the per-device cost has doubled.
How the programme works
According to Microsoft's own documentation, commercial customers buy ESU through Volume Licensing at $61 USD per device for Year One, and "the price doubles every consecutive year". That puts Year Two at $122 per device and Year Three at $244. The programme runs for a maximum of three years, which closes the window in October 2028.
Two details catch organisations out. First, ESU is cumulative: an organisation that skipped Year One and wants to join in Year Two has to pay for Year One as well. Second, it is sold by the year — partial periods such as six months are not available.
- Devices must be running Windows 10 version 22H2.
- ESU covers critical and important security updates only.
- New features, non-security fixes and general technical support are excluded. Support is limited to activation and installation issues with ESU itself.
- Windows 10 instances on Windows 365, Azure Virtual Desktop and Azure virtual machines receive ESU at no additional cost.
Why it matters
A lot of smaller companies bought a year of ESU at the end of 2025 on the reasoning that they could manage for another twelve months. That year is up. Two real costs are now on the table: a licence fee that has doubled per device, and the risk carried by a hardware estate that was never refreshed. For a 40-device office, Year Two ESU alone comes to $4,880 — money that leaves no asset behind when the year ends.
The sharper issue is what happens outside the programme. A Windows 10 machine with no ESU coverage stops receiving patches, and over time becomes exposed to vulnerabilities that are publicly known and actively exploited. When those machines sit on the same network as servers, NAS devices and backup systems, a single endpoint becomes the way in.
What we recommend at Kamer Bilişim
- Inventory your fleet and split it three ways. Which machines are Windows 11 capable (TPM 2.0, supported CPU), which are not but still serviceable, and which were due for replacement anyway? In most offices a substantial share can be upgraded to Windows 11 at no licence cost, leaving ESU spend for the minority that genuinely cannot move.
- Treat ESU as a bridge, not a destination. Because the price doubles annually, Year Three approaches the cost of a new machine in most scenarios. Budget ESU only for devices tied to a specific application or a production machine that cannot be replaced in the short term.
- Isolate what you cannot replace. Where a Windows 10 machine is bolted to a production line or a specialised peripheral, move it onto its own VLAN, restrict its internet access, and use firewall rules to limit what it can reach in the server segment.
If you would like to go through your device inventory together — which machines can move to Windows 11, and which need an ESU or replacement plan — you can reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.
Sources: Computerworld, 6 October 2026 — "Windows 11 gains ground as price hike looms for Windows 10 security updates"; pricing rule and programme scope per Microsoft Learn, Windows 10 Extended Security Updates documentation.
Source: Computerworld