Blog
The ESU decision: buying time honestly
Windows 10 support ends on 14 October. Extended Security Updates will keep unmigrated devices patched, at $61 a device and doubling every year. ESU is neither a scandal nor a strategy: it is a bridge with a toll. Here is how to decide, device by device, whether to pay it.
With weeks to go until Windows 10 end of support, most estates we see fall into an uncomfortable middle: the migration is under way, but it will not finish by 14 October. For those devices Microsoft offers Extended Security Updates. The programme deserves neither the outrage it attracts nor the complacency it invites. It deserves arithmetic.
What $61 actually buys
Commercial ESU costs $61 per device for Year 1, purchased through volume licensing, and covers you to 13 October 2026. What you get is security updates rated Critical and Important, and nothing else: no new features, no non-security fixes, no design changes, and no technical support beyond the updates themselves. Devices must be on Windows 10 22H2 to enrol at all, which is the first and simplest eligibility check to run.
There are cheaper doors into the same room. Enrolling devices through cloud management, Microsoft Intune or Windows Autopatch, drops Year 1 to $45 per device. Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop get ESU at no extra cost, as do physical devices used to access a Windows 365 Cloud PC. If you are already managing devices in the cloud, the toll is a quarter lower before you negotiate anything.
The toll doubles, and it is cumulative
Year 2 costs $122 per device. Year 3 costs $244. The full three-year bridge is $427 per device, which is more than the residual value of most of the hardware it would protect. And the programme is cumulative: join in Year 2 and you pay for Year 1 as well. There is no discount for arriving late and no route that gets cheaper over time.
The pricing is not an accident. It is Microsoft telling you, in dollars, that ESU is a bridge and not a destination.
The doubling structure does one useful thing: it forces a date into the conversation. Any business case for ESU that does not include the year you stop paying is not a business case, it is a deferral.
Who should buy it
There are honest reasons to pay. A line-of-business application that fails on Windows 11, with a vendor fix promised for 2026, is a legitimate blocker: $61 is far cheaper than breaking a working process. A hardware fleet that fails the Windows 11 requirements but is due for natural refresh in the first half of 2026 is another: one year of ESU costs less than dragging the capital spend forward and writing off serviceable machines. Regulated organisations that must evidence continuous patching cannot simply run unsupported, so for their stragglers ESU is not optional, it is the compliance position. And specialist devices tied to certified configurations, from clinical workstations to industrial controllers, often cannot move on anyone's preferred schedule.
What these cases share is specificity: a named blocker, a named owner, and a date the blocker dies.
Who should not
If most of your estate is Windows 11 capable and nothing is blocking it, ESU is paying twice: once for the licence and again for the migration you still have to do. Across five thousand devices, Year 1 alone is over $300,000, money that funds a serious amount of migration engineering instead. Buying ESU to avoid making a decision is the worst version of this, because the indecision doubles in price in October 2026.
Nor is ESU a way to keep Windows 10 alive indefinitely. The commercial programme ends after three years, and the surrounding ecosystem will erode faster than the patches: application vendors are already qualifying releases against Windows 11 first. Microsoft has committed to security updates for Microsoft 365 Apps on Windows 10 into 2028, which softens the edge but does not change the direction.
The honest framework
Three questions, answered per device, settle almost every case. Is the device eligible for Windows 11? If yes, migrate it; ESU on capable hardware is rarely defensible. If not, is there an application blocker with a vendor date attached? If yes, ESU until that date, and hold the vendor to it. If not, when does the refresh cycle replace the hardware? If inside Year 1, ESU bridges the gap; if beyond, the refresh probably needs to accelerate, because Year 2 pricing punishes drift.
The output is a segmented estate: devices migrating now, devices on ESU with an exit date, and devices being replaced. Our discovery tooling builds exactly this per-device picture, hardware eligibility, application dependencies and refresh age together, so the ESU purchase order contains a count you can defend rather than a guess. Buy the bridge if you need it. Just write the date you get off it on the same page as the price.
Deciding your ESU count before 14 October?
We build the per-device evidence, eligibility, app blockers and refresh dates, that turns an ESU renewal into a migration plan with an end date.