Blog › Article
Windows 10 and Cyber Essentials after end of support
Windows 10 reached end of support on 14 October 2025. Since then, a Windows 10 machine in scope fails Cyber Essentials unless it's enrolled in Microsoft's Extended Security Updates programme — and ESU buys time, not a solution.
Why Windows 10 fails by default
Cyber Essentials requires every operating system and application in scope to be supported by its vendor, meaning the vendor still provides security updates. After end of support, Windows 10 no longer receives them, so it can't meet the requirement to apply high-risk updates within fourteen days. An unsupported machine in scope is a failure regardless of how well everything else is run.
Extended Security Updates: the temporary route
Microsoft's Extended Security Updates programme continues to supply critical and important security updates to enrolled Windows 10 machines for a limited period after end of support. IASME accepts ESU for Cyber Essentials: a Windows 10 device correctly enrolled in ESU, and receiving its updates, is treated as supported.
The conditions matter:
- Version 22H2. Machines must be on Windows 10 22H2 to be eligible.
- Enrolment, not intention. A machine that could be enrolled but isn't is unsupported.
- Updates actually applied. ESU only helps if its updates are installed within fourteen days, like any other.
- Evidence. You need to be able to show that ESU is in place for each machine, particularly for a Cyber Essentials Plus audit.
- A time limit. ESU runs for a limited number of years depending on the edition, bought a year at a time. When it ends, the machine is unsupported again.
The options for each machine
| Option | When it fits |
|---|---|
| Upgrade to Windows 11 | The hardware meets Windows 11's requirements. The cleanest answer. |
| Replace the machine | The hardware can't run Windows 11 and is due for replacement anyway. |
| Enrol in ESU | Replacement isn't possible yet and the machine is on 22H2. Temporary. |
| Remove or isolate | The machine is removed from use, or moved into a separate subset with no internet access at all. |
Where estates get caught out
- The machine nobody counted. A Windows 10 PC in a warehouse office or on a reception desk, left off the upgrade plan because nobody knew it was there.
- ESU bought but not activated. Enrolment needs activating on each machine. A licence purchased centrally doesn't protect a machine that never activated it.
- Machines not on 22H2. Older Windows 10 versions aren't eligible, however much ESU is bought.
- Personal devices. A home worker's own Windows 10 laptop with work email on it is in scope, and nobody bought ESU for it.
Treat ESU as a deadline, not a fix. Each year of ESU is time to replace or upgrade what's left. The organisations that struggle are the ones that treat it as permanent and meet the end of the programme with the same machines.
Quick answers
Can a Windows 10 machine pass Cyber Essentials?
Only if it's on version 22H2, enrolled in Extended Security Updates, and its updates are applied within fourteen days.
Do I need to prove ESU is in place?
You should be able to, particularly for Cyber Essentials Plus, where an assessor may test the machine.
What if a Windows 10 machine can't be upgraded?
Enrol it in ESU while you replace it, remove it from use, or move it into a separate subset with no internet access.