The Cost of Running Out of Support: What End-of-Life Systems Actually Do to an IT Bill and a Risk Profile

The short answer: End of support is a price, not a warning. Microsoft lists Windows 10 ESU at US$61 per device for Year One, doubling each year for up to three years, and cumulative: a device first enrolled in Year Two costs 61 + 122 = US$183 for one year of cover. Deferring the decision compounds the cost.

Every IT budget contains a line that says "replace when we can". It is easy to carry forward, because nothing visibly breaks on the day a vendor stops supporting a product. What changes is what the business has stopped receiving: security fixes, technical help and the guarantee that new software will keep working alongside the old.

This report asks what that costs, and it picks the one part of the answer that has a published price. Windows 10 reached the end of support on 14 October 2025, and Microsoft sells a paid extension with a list price, a doubling rule and a cumulative-purchase rule written down in its own documentation. That makes the central number here a vendor's list price, not an analyst estimate. Around it we set what the same evidence says about the costs that never appear on a renewal quote, the security exposure, and the places where out-of-support software stops being a risk you choose and becomes a requirement you fail.

A disclosure. Brocent is a managed IT provider, and lifecycle management is work we sell. We have tried to offset that by tying every figure to a named source, by working the arithmetic in the open, by labelling our own observations as ours, and by including the case where running a system out is the correct commercial answer.

Key findings

• Microsoft prints the price of staying put. Its Learn documentation, last dated 17 November 2025, states that Windows 10 ESU for organisations costs US$61 per device for Year One through Microsoft Volume Licensing, that "the price doubles every consecutive year, for a maximum of three years", and that the minimum purchase is one licence.
• The program is cumulative, and that is the part buyers miss. The same page says that "if you decide to purchase the program in Year Two, you have to pay for Year One too, as ESUs are cumulative." Applying the doubling rule, a device first enrolled in Year Two costs 61 + 122 = US$183, and one first enrolled in Year Three costs 61 + 122 + 244 = US$427 if Microsoft's cumulative rule is extended to Year Three. The Year Two and Year Three figures are our arithmetic from Microsoft's rule, not prices Microsoft prints.
• ESU buys security updates, not support. Microsoft states that technical support is not included, that there are no new features or customer-requested non-security updates, and that devices must be on Windows 10 version 22H2 with specific prerequisite updates before a licence key will activate.
• The security argument can be made without a statistic. CISA's Known Exploited Vulnerabilities catalogue lists named, dated entries that CISA itself flags as affecting products that could be end-of-life, including Internet Explorer, a Windows ActiveX component and D-Link routers, and it tells owners of end-of-life SharePoint Server 2013 and earlier to disconnect them from the public internet.
• Where a regulator or scheme has written the rule down, it is stricter than most budgets assume. Singapore's Cyber Essentials mark, in the April 2025 second edition, says assets that have reached their end-of-support date "shall be removed", with a documented, senior-management-approved exception path for cases where continued use is necessary.

"End of support" is a price, not a warning

Vendors and trade press tend to describe end of support as a date. That framing treats it as an alarm: something happens on the day, and you should have prepared. The more useful framing is that end of support starts a meter. From that day, every month a device stays in service is either a month of unpatched exposure or a month of paying for an extension.

For Windows 10, Microsoft has written the meter down. The Microsoft Learn page "Extended Security Updates (ESU) program for Windows 10" carries a last-updated date of 17 November 2025, and we re-read it on the day this report was drafted. It states, as first-party fact:

• Windows 10 support ended on 14 October 2025.
• ESU for organisations can be purchased through Microsoft Volume Licensing "at $61 USD per device for Year One".
• "The price doubles every consecutive year, for a maximum of three years."
• The minimum licence purchase is one licence, and ESU must be bought by the year; partial periods cannot be bought. Year One starts in November 2025.
• ESU covers critical and important security updates for PCs enrolled in the program. It does not include new features, customer-requested non-security updates or design change requests.

Two further details shape the real bill. First, the unit is the device, not the user and not the fleet, so the cost scales with the number of machines you cannot or will not retire. Second, the price is the list price for the Volume Licensing channel. Reseller margin, local taxes, currency and any agreement-specific discounts sit on top of it or beneath it, and Microsoft's documentation does not print them.

What Windows 10 devices do after support ends is not in dispute either. Microsoft's own FAQ says the PCs "will continue to work". The question is not whether the machines run. It is what you are paying, or risking, to keep them running.

Why deferring the decision compounds it

The rule that deserves the most attention is the cumulative one. Microsoft's FAQ answers the obvious question, whether a company can skip the first year and join later, in a single sentence: if you purchase in Year Two, "you have to pay for Year One too, as ESUs are cumulative."

Combined with the doubling rule, the arithmetic is simple, and it is worth setting out because the intuitive reading is wrong. The intuitive reading is that waiting a year postpones the bill by a year. The documented reading is that waiting a year raises the entry price.

• Enrol in Year One: US$61 per device for the first year of cover.
• Enrol first in Year Two: US$61 + US$122 = US$183 per device. Microsoft requires the Year One amount to be paid even though the device was not enrolled during Year One.
• Enrol first in Year Three: US$61 + US$122 + US$244 = US$427 per device, for a single year of cover.
• Stay enrolled for all three years: the same US$427 per device in total, spread across three years of cover.

The Year Two and Year Three amounts above are our calculation. Microsoft's page prints the Year One price and the doubling rule, and we have applied the rule. A third-party reseller catalogue or a volume-licensing agreement may show different rounding or a different price, so a purchase decision should use the figure in the agreement.

A worked example, with the caveat stated

To make it concrete, take a hypothetical estate of 50 Windows 10 devices that cannot be upgraded this year. This is an illustration of arithmetic, not a prediction about any real company, and it uses Microsoft's US-dollar list price before reseller margin, tax or discounts.

• Enrolled from Year One: 50 × US$61 = US$3,050 for the first year.
• Enrolled first in Year Two: 50 × US$183 = US$9,150 for the first year of actual cover.
• Enrolled first in Year Three: 50 × US$427 = US$21,350 for the first year of actual cover.

The same fleet costs three times as much to cover for its first protected year if the decision slips from Year One to Year Two, and seven times as much if it slips to Year Three. The numbers do not argue for buying ESU. They show that "we will decide next budget year" is a financial decision with a price attached.

There is one more timing fact. Microsoft says Year One starts in November 2025, which means the second ESU year begins in the autumn of 2026, around the time this report is published. We have not located an authoritative page that states the Year Two coverage dates in a form we can quote, so check the dates in your own licensing agreement.

The costs that never appear on the renewal quote

The licence line is the smallest part of what an out-of-support estate costs, because it only addresses the vendor's side. The other costs sit on yours, and the evidence for each comes from Microsoft's own documentation, not from a survey.

Support is not included and compatibility drifts

Microsoft states plainly that technical support is not part of ESU. Its documentation says the ESU "only includes support for the license activation, installation, and possible regressions of the ESU itself", and that to get technical support for even those issues, an organisation must have an active support plan. More generally, Microsoft's Windows lifecycle FAQ says that once an operating system reaches end of support, "customers will no longer receive technical assistance, software updates, or security fixes." So the extension buys one of those three things. Microsoft adds that the longer an unsupported system stays in service, "the possibility increases that new programs and hardware will not be performant on an older OS", which shows up as unbudgeted small projects: a business application release that will not install, or a peripheral with no driver.

Administration is real work

Enabling the extension is a procedure, not a switch. Microsoft's guidance on enabling ESU, last dated 21 April 2026, requires each device to be on Windows 10 version 22H2 with a named cumulative update and a separate ESU licensing preparation package, and requires a Multiple Activation Key retrieved from the Microsoft 365 admin center by someone holding a specific volume-licensing role. Each ESU year has its own activation ID, devices need access to Microsoft's activation servers or a manual phone-activation procedure, and reimaged machines may need an increase to the key's activation limit. None of that is hard for a team that does it daily, but it recurs every year, and a device that misses the prerequisite update does not receive the updates it was paid for.

One application can hold the fleet back

Windows 11 has hardware minimums that many Windows 10 machines may not meet: Microsoft lists a compatible 64-bit processor, 4 GB of memory, 64 GB of storage, Secure Boot-capable UEFI firmware and TPM 2.0. A machine that fails any of them cannot be upgraded in place, so it becomes a refresh item or an ESU line. Separately, a single legacy application that will not run on the newer operating system can pin otherwise capable machines to the old one.

The security half of the bill

The security argument is usually made with an aggregate statistic. We do not use one, because we could not find a primary source measuring what share of incidents involve out-of-support products. What can be shown honestly, with named entries, is that attackers do exploit products their vendors have stopped supporting, and that the public catalogue tracking exploitation says so.

The Known Exploited Vulnerabilities (KEV) catalogue is maintained by the US Cybersecurity and Infrastructure Security Agency (CISA). Its page says CISA "maintains the authoritative source of vulnerabilities that have been exploited in the wild", and advises that "organizations should use the KEV catalog as an input to their vulnerability management prioritization framework." We downloaded the catalogue's machine-readable file on the day this report was drafted; it was version 2026.10.13, released on 13 October 2026, and held 1,741 entries.

Rather than count anything, we read individual entries whose own text mentions end-of-life status. Each can be looked up by its CVE identifier:

• CVE-2025-53770, CVE-2025-49704 and CVE-2025-49706 (Microsoft SharePoint Server). Added to the catalogue in July 2025. The required action reads, in part: "Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions." The entry for CVE-2025-53770 records known ransomware campaign use.
• CVE-2010-0249 (Microsoft Internet Explorer). Added in May 2026. The entry says the impacted product "could be end-of-life (EoL) and/or end-of-service (EoS)" and that users "should discontinue product utilization."
• CVE-2013-3918 (a Windows ActiveX component). Added in October 2025, with the same end-of-life wording.
• CVE-2022-37055 (D-Link routers). Added in December 2025, with the same wording. Network equipment ages out too, and an edge device is the first thing an attacker meets.

Three cautions apply. The catalogue lists vulnerabilities, not victims, so it shows that exploitation exists, not how common it is. CISA's wording is hedged ("could be end-of-life"), and we have kept it hedged. And the due dates in the catalogue are deadlines for US federal agencies; for everyone else the catalogue is guidance. The practical reading is narrow: a paid extension reduces exposure to operating-system vulnerabilities, and does nothing for the applications, firmware and appliances in the same estate that have their own end-of-support dates. For patch cadence and governance, a different question, see our guide to patch management and what auditors check in Asia-Pacific. This report covers what happens when there is nothing left to patch.

Where out-of-support becomes a blocker, not a risk

Cost and exposure are risks a business can choose to carry. A different category is where a scheme, standard or regulator has written the rule down and an out-of-support asset fails it. These are market- and scheme-specific, so we set them out separately.

Singapore: the Cyber Essentials mark

The Cyber Essentials mark is published by the Cyber Security Agency of Singapore (CSA). The edition we read is the second edition, published in April 2025, so check CSA's site for any later issue before relying on the clause numbers. The document says the mark is designed for organisations "with limited IT and/or cybersecurity expertise and resources", that the organisation completes a guided self-assessment and is then independently assessed by a certification body, that "for the organisation to be certified for the Cyber Essentials mark, it shall meet all requirements", and that a certification remains valid for two years.

Three clauses bear directly on this report:

• The inventory should carry the end-of-support date. The asset-management clauses say the hardware inventory should include an "End of support (EOS) date" for each asset, and that the software inventory should include "EOS date" as well. They also recommend reviewing the inventory at least twice a year.
• End-of-support assets "shall be removed". Clause A.2.4 (f) states that "Unauthorised hardware and software assets, or those that have reached their respective EOS dates shall be removed."
• There is an exception path. Clause A.2.4 (g) says that where continued use of EOS assets is necessary, "the organisation shall assess and understand the cybersecurity risk, obtain approval from senior management and monitor it until the asset is replaced."

Elsewhere in the document, the software-update clause says that Internet-of-Things devices such as cameras and printers "that are not receiving any software patches or updates" should be removed or replaced, and the malware-protection clause says that only fully supported web browsers and email client software should be used where those are in scope. Both are written as recommendations ("should"), not obligations ("shall"), so we do not treat them as blockers.

So the accurate summary is not "an old system means no certificate". The scheme requires an organisation to know its end-of-support dates, remove assets past them, and document, approve and monitor any that stay. An undocumented legacy server is a finding; a documented one with an owner, a risk assessment and a replacement date is the process working. We cannot say how individual certification bodies apply their judgement in practice.

Hong Kong: data security obligations

For Hong Kong we can be less specific, and we say so. The Office of the Privacy Commissioner for Personal Data (PCPD) issued a Guidance Note on data security measures for information and communications technology on 30 August 2022. The PCPD reported that it received 68 data breach notifications in the first seven months of 2022, about a quarter of which involved vulnerabilities of information and communication technology systems of data users. Data Protection Principle 4 of the Personal Data (Privacy) Ordinance requires data users to take all practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use.

We could not open the Guidance Note itself during this research, because the PCPD website blocked automated access, so we do not state what it says about unsupported software or how a regulator would treat an unsupported system. An organisation holding personal data on such systems should read the Guidance Note directly and take advice on how the "all practicable steps" standard applies to its facts.

Payment card environments: all three markets

The Payment Card Industry Data Security Standard applies wherever card data is handled, so it is not specific to Hong Kong, Singapore or the United States. The PCI Security Standards Council's published summary of changes lists a new requirement in version 4.0, 12.3.4, "to review hardware and software technologies in use at least once every 12 months", described as a best practice until 31 March 2025. After that date it is part of assessments. We could not obtain the full text of the requirement, so we report only what the Council's summary says.

What an inherited estate actually looks like

This section is Brocent's own qualitative observation, drawn from taking over IT estates for clients. It contains no counts, no percentages and no averages, and it should be read as experience, not data.

When we take over an estate, the problem is rarely a single obviously old machine. It is a pattern that repeats:

• The machine that cannot take the next operating system because of one application. The hardware is fine. A line-of-business program, often old and often bought once, does not run on anything newer, and the whole machine is pinned to it.
• The appliance in service because nobody owns its renewal. A firewall, a switch or a storage array sits in a cabinet. Its support contract lapsed when the person who bought it left, and nothing in the organisation's calendar records an end-of-support date for it.
• The "next budget year" loop. A replacement was costed, deferred, and carried forward. Each year it is slightly more expensive and slightly more urgent, and each year it is deferred again.
• The estate that nobody has aged. There is no list. Ages and dates live in the head of one person, and when that person leaves, so does the lifecycle plan.

Refresh now, ESU and refresh later, or run it out: compared

The right answer depends on the device, what it touches and what it holds. The comparison uses the Windows 10 case, where the prices are published; the same logic applies to servers and appliances, with different dates.

The options side by side

• Refresh now. Replace or upgrade the device before more time passes. Cost: the hardware and the migration labour, once. Strength: no recurring extension line, and a supported platform for years. Weakness: capital is needed up front, and a rushed migration can cost more than a planned one. Best for: devices that fail Windows 11's minimum requirements anyway, and devices that handle sensitive data or sit at the edge of the network.
• Buy ESU and refresh later. Pay the extension while a planned replacement is scheduled. Cost: US$61 per device in Year One, rising on Microsoft's doubling rule. Strength: it turns an emergency into a schedule and buys security updates for the operating system. Weakness: it is cumulative, so a late start costs more, and it includes no technical support. Best for: a mixed estate where a managed rollout will take most of a year, and where enrolment starts in Year One.
• Move the workload to a cloud desktop. Microsoft states that ESU is available at no additional cost for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop and Azure virtual machines, and that Windows 10 endpoints connecting to Windows 365 Cloud PCs are entitled to ESU for up to three years with an active Windows 365 subscription licence. Cost: the subscription or hosting. Strength: it separates the old endpoint from the supported desktop. Weakness: it replaces one recurring cost with another and needs connectivity. Best for: a few applications or users who need a supported desktop but whose devices cannot be upgraded.
• Run it out, segmented. Keep the device in service without updates, isolated from the rest of the network and from the internet, with an owner, a written risk acceptance and a retirement date. Cost: the isolation and monitoring effort. Strength: it can be the correct commercial answer for an isolated, single-purpose device, such as a machine that drives one piece of equipment and holds no sensitive data. Weakness: it is only sound while the isolation is real and while the acceptance is reviewed. Best for: specialist equipment controllers and test benches. Never for: an internet-facing device, a device that holds personal data, or one that sits on the corporate network.

"Run it out" is not a failure mode when it is a recorded decision with an owner and an end date. It has the same shape as the Singapore exception path above: assess, approve, monitor, replace. What it cannot be is the default produced by nobody deciding.

Servers and hardware are separate decisions

For servers, storage and network equipment, the equivalent choice is often between a refresh and third-party maintenance, where an independent company supports hardware after the manufacturer stops. We have no public data on how often that route is chosen, so we offer only the decision rule: price the maintenance, price the replacement, and write down which one you chose and for how long.

Server dates are worth knowing now. Microsoft's lifecycle table lists Windows Server 2016 mainstream support as ended on 12 January 2022 and extended support as ending on 13 January 2027. The same table for Windows Server 2012 R2 lists extended support as ended in October 2023, with the third and last year of paid Extended Security Updates having ended on 14 October 2026. Exchange Server 2019's extended support is listed as ending in October 2025. These are specific products and dates; do not generalise one product's date to another.

Building a lifecycle register you will actually maintain

Every option above depends on a document most organisations do not have: a dated list of what they own and when each item stops being supported. Singapore's Cyber Essentials mark describes the fields: for hardware, model, asset type, warranty information, location, owner, vendor contact and end-of-support date; for software, name, publisher, version and EOS date. It is a practical template in any market, because it was designed for organisations without a dedicated security team.

A register that survives staff changes has a few properties:

• One owner per asset, by name. A device with no owner is a device with no renewal.
• A date, not a status. "Old" is not a field. "Support ends 13 January 2027" is, and it can be sorted.
• Dates sourced from the vendor. Take them from the vendor's lifecycle page and record the page and the day you read it. Microsoft's pages, for example, carry their own last-updated date.
• A review twice a year, and a trigger when anything is bought or retired. The Singapore document recommends a bi-annual review. That is the minimum, not a target.
• A decision against every item inside twelve months of its date. Each one gets one of the four outcomes above, with an owner and a date. An item with no decision is the real finding.
• A line in the budget before the date, not after it. The cumulative rule above is the financial case for this one.

On our side, every Brocent plan lists patch management and a named vCIO with a technology roadmap. We do not claim a lifecycle register is a separately promised deliverable, and we publish no figure for what it saves. Current list prices are below, generated from the same data as the pricing page so they do not go stale here. They are per user per month while ESU is per device, so we do not compare them. United States prices cover plan tiers only.

For the full breakdown of what each plan includes, see Brocent managed IT support and pricing. For the other half of this question, what happens when the number of apps, devices and vendors grows faster than headcount, see our research on the hidden operating cost of IT sprawl. And for what the end of the curve looks like in practice, when a device has to leave service safely, see the worked example of secure IT asset disposal and decommissioning for a Singapore manufacturer.

What this report does not claim

A research report is only as useful as its limits are clear. These are ours.

• It does not quantify how widespread out-of-support systems are, or how often they are breached. We found no primary source for either in Hong Kong, Singapore or the United States. The KEV entries show that exploitation is real, not how common it is.
• The Year Two and Year Three ESU figures are our arithmetic from Microsoft's Year One price and doubling rule, as a US-dollar list price excluding reseller margin, tax and discounts. The 50-device fleet is hypothetical. Your agreement is the authority on what you pay.
• The Singapore clauses come from the April 2025 second edition of the Cyber Essentials mark. Check CSA's current publication.
• The Hong Kong section is deliberately thin, and we found no readable source on insurance outcomes, so we make no claim on either.
• The Brocent observations are ours. They are qualitative, come from taking over client estates, and are not a sample.

Frequently asked questions

How much does Windows 10 Extended Security Updates cost per device?

Microsoft states US$61 per device for Year One for organisations buying through Volume Licensing, with the price doubling every consecutive year for a maximum of three years. Applying that rule gives US$122 for Year Two and US$244 for Year Three, but those two figures are our arithmetic, not prices printed on Microsoft's page. List price excludes reseller margin, tax and discounts.

Can we skip the first ESU year and buy later?

You can, but you pay for the years you skipped. Microsoft's documentation says that if you purchase in Year Two you have to pay for Year One as well, "as ESUs are cumulative." A device first enrolled in Year Two therefore costs US$183 in list price, and one first enrolled in Year Three costs US$427, for one year of cover.

Is it safe to keep running a system that is past its end-of-support date?

It depends on what the system touches and holds, and the honest answer is "only with a recorded decision". CISA's Known Exploited Vulnerabilities catalogue contains entries that CISA flags as affecting products that could be end-of-life, and in at least one case it tells owners to disconnect end-of-life, public-facing servers. An isolated device that holds no sensitive data, with an owner, a written risk acceptance and a retirement date, is a defensible exception. An internet-facing or personal-data-bearing device usually is not.

What does Singapore's Cyber Essentials mark say about end-of-support assets?

In the April 2025 second edition, clause A.2.4 (f) says assets that have reached their end-of-support dates "shall be removed", and clause A.2.4 (g) allows continued use only if the organisation assesses the risk, obtains senior-management approval and monitors the asset until it is replaced. The scheme also expects the inventory to record each asset's end-of-support date. Check CSA's current edition before relying on the clause numbers.

When do Windows Server 2016 and 2012 R2 lose support?

Microsoft's lifecycle table lists Windows Server 2016 extended support as ending on 13 January 2027. For Windows Server 2012 R2, extended support ended in October 2023, and the third and last year of paid Extended Security Updates ended on 14 October 2026. Confirm dates for your own edition on the vendor's lifecycle page, since each product has its own.

Is a cloud desktop a way around the ESU price?

For some workloads, yes. Microsoft states that Windows 10 virtual machines in Windows 365, Azure Virtual Desktop and Azure virtual machines receive ESU at no additional cost, and that Windows 10 endpoints connecting to Windows 365 Cloud PCs are entitled to ESU for up to three years with an active subscription. It moves the cost into a subscription and depends on connectivity, so it is a trade, not a saving by default.