Windows 10's last consumer patch

The consumer Extended Security Updates programme for Windows 10 ends today. Free support ended a year ago; the paid consumer bridge covered the twelve months since. Commercial customers can pay for up to two more years.

For everyone else, today is the last patch.

what actually changes#

Nothing, immediately. The machines keep working. That is precisely the problem — there is no visible event, so there is no prompt to act.

What changes is that every vulnerability discovered from tomorrow onward stays unpatched, permanently, on those machines. And the population is large enough that it is worth attacker attention on its own.

the reason this is messy#

Windows 11's hardware requirements — TPM 2.0 and a supported CPU list — mean a substantial number of machines that are functionally fine cannot run the supported OS. Not slow. Not lacking memory. Missing a security chip.

The security argument for the requirement is real: a hardware root of trust enables virtualisation-based security and credential protection that genuinely reduce whole categories of attack.

The consequence is also real: hundreds of millions of working computers become either unpatched internet-connected machines or electronic waste, and the second outcome has an environmental cost nobody has priced.

Both things are true. The uncomfortable part is that they were both foreseeable in 2021.

what to do with the machines#

Commercial ESU, if the fleet is large and the applications are pinned. Priced per device per year, escalating deliberately.

Replace, the intended path, and the one with the highest cost and the clearest outcome.

Linux, genuinely viable for a larger share of cases than it was five years ago — particularly developer machines, kiosks, and anything running one application or a browser. The blocker remains what it has always been: a specific Windows-only application, or hardware with Windows-only drivers.

Isolate. If a machine must keep running Windows 10 — a lab instrument, a machine tool controller, a device whose vendor is gone — the answer is network segmentation. No internet access, a restricted VLAN, no shared credentials with anything that matters. This is the realistic outcome for a lot of industrial equipment and it should be a deliberate architecture rather than an oversight.

for developers specifically#

Decide your minimum supported version, and say so. If your application still claims Windows 10 support, that claim now includes an unpatched OS. Most organisations will drop it over the next year; doing it deliberately, with a published date, is better than doing it accidentally.

Test on Windows 11, particularly anything touching credential storage, code signing, driver interaction, or the TPM. Behaviour differs and the differences are not always documented.

Check your telemetry for what your users are actually running before you decide. The answer is frequently surprising in both directions.

the pattern worth noticing#

This transition was not forced by capability. The hardware is fast enough. It was forced by security architecture — a specific primitive the new threat model requires and old machines lack.

That is going to happen again: with memory tagging, with pointer authentication, with whatever hardware mitigation becomes table stakes next. The useful planning assumption is that hardware lifespan is now set by the security roadmap rather than by performance, and that the window is shorter than the machine's useful life.

Which is worth pushing back on with vendors, because the environmental arithmetic of a five-year replacement cycle for hardware that works is not obviously the right trade — and nobody is being asked to justify it.