Across the world, IT teams are deep into Windows 11 upgrade projects. Rollouts are planned, budgets are approved, and new devices are on the way. Yet as the calendar races toward October 14, 2025, the reality is becoming clear: many organizations won’t finish in time.

Compatibility issues, hardware lifecycles, legacy applications, and the sheer scale of enterprise environments all mean that thousands of Windows 10 devices will still be in use after support ends. And once support ends, those devices will no longer receive security updates, leaving critical gaps in enterprise defenses.

To bridge that gap, Microsoft has launched the Windows 10 Extended Security Updates (ESU) program.

The ESU timeline

In June 2025, Microsoft announced that ESU would be available to Volume Licensing customers, giving large organizations a structured way to extend support.

On September 1, 2025, ESU became available through the Cloud Solution Provider (CSP) channel. This makes it easier for partners and resellers to deliver ESU directly to their customers.

Finally, on October 14, 2025, support for Windows 10 officially ends. Any device not upgraded or covered by ESU will stop receiving security updates.

What ESU offers

ESU provides up to three additional years of critical and important security updates, nothing more, nothing less. It’s a safety net, not a long-term strategy.

• Coverage: Through October 2028.

• Pricing: $61 USD per device in Year One.

• Cloud management discount: A 25% discount applies when updates are deployed via Microsoft Intune or Windows Autopatch, reducing Year One cost per device to $45.75.

• Eligibility: Only devices running Windows 10 version 22H2.

• Commitment: Annual subscription, if you join in Year Two or Three, you must also pay for earlier years.

• Cloud bonus: Free for Windows 365 Cloud PCs and Azure Virtual Desktop.

ESU is designed to buy time. It keeps critical systems secure while organizations finish their migrations to Windows 11 or Windows 365.

Learn more about ESU →
How to enable ESU in your organization →

The real challenge: knowing where you need ESU

The real challenge isn’t understanding what ESU is, it’s knowing which of your devices actually need it. Many organizations lack a clear picture of:

• How many endpoints are still running Windows 10,

• Which ones are on version 22H2 and eligible,

• Which devices could benefit from the 25% cloud-management discount, and

• Which systems should be prioritized for upgrade or replacement instead of covered.

Without this insight, it’s easy to overspend on unnecessary ESU licenses or worse, leave devices unprotected.

How Bsure Insights helps

This is where Bsure Insights makes a difference. Our platform provides the visibility IT leaders need to make ESU adoption a strategic decision instead of a guesswork exercise.

Customers using Bsure highlight how simple it is to uncover the devices they will not be able to upgrade or replace in time. The process saves them countless hours compared to manual audits, and with that clarity they can focus ESU investment precisely where it is required while planning migrations for the rest of the environment.

With Bsure, you can:

• Discover all devices still running Windows 10, ensuring none slip under the radar.

• Verify ESU eligibility by identifying machines on version 22H2.

• Highlight cost implications, including where Intune or Autopatch management could unlock the 25% discount.

  
  

This visibility allows IT leaders to apply ESU only where it’s truly needed, save costs where it isn’t, and keep every endpoint protected during the transition.

The bottom line

The Windows 10 ESU program is now live through both Volume Licensing and the CSP channel. The deadline is October 14, 2025, don’t wait until the last minute to secure your environment.

With Bsure Insights, you know exactly which devices need coverage, where to optimize costs, and how secure your environment really is.

Be cost-effective. Be secure.