The cyber-security impact of Windows 10 support ending

Farid Mustafayev at ThreatLocker outlines a silent and cumulative danger and argues that organisations must start preparing now before it is too late

 

Mark October 14, 2025, in your calendar: That’s the day Microsoft ends free support for Windows 10. On that date, hundreds of millions of computers across the globe will quietly fall off the patch management cliff. Paid Extended Security Updates will be available, but only for those who enrol, and only for critical vulnerabilities.

 

For most businesses, the shift won’t feel catastrophic. At first. Windows 10 will keep running. Apps will still open. Networks will hum along. 

 

But the danger is silent and cumulative. As new vulnerabilities emerge, Windows 10 machines will stand defenceless, with no fixes coming from Redmond.

 

Once support ends, every newly discovered hole becomes permanent. There’s no patch coming. What was once a zero-day in Windows 11 becomes a forever-day in Windows 10. It’s a slow bleed into exploit hell.

 

Unsupported systems are hacker magnets

Unsupported operating systems are irresistible to attackers because the opportunity cost compared to targeting supported versions is practically free. Once Microsoft releases a patch for Windows 11, threat actors must spend valuable time reverse-engineering the binary diff to identify what changed—a process known as patch diffing. If vulnerable code also remains in Windows 10 by the time it’s officially end-of-life (EoL), it becomes a "forever-day": A zero-day with no possible patch.

 

This isn’t hypothetical—it’s operational doctrine. In 2023 alone, Microsoft patched over 1,000 Windows-related CVEs, including 22 actively exploited zero-days. Many affected shared system components are still present in Windows 10—like win32k.sys, splwow64.exe, and legacy COM handlers. Once support ends, any flaw in these shared components will remain live and exploitable indefinitely.

 

We’ve seen the playbook before. After Windows XP reached end-of-life in 2014, attacks surged by over 66%, largely driven by recycled vulnerabilities like CVE-2010-2568 (the same vector Stuxnet leveraged) being re-used in new campaigns. Windows 10, by contrast, accounts for over 65% of enterprise desktop deployments today, making the attack surface not just larger, but exponentially more valuable.

 

Red meat for mass exploitation

Cyber-criminal gangs thrive on scale, and newly unsupported operating systems provide just that. Once an OS reaches end-of-life, every unpatched vulnerability becomes a permanent entry point, and the attacker’s job shifts from discovery to automation. Exploits are written once, then sprayed across millions of machines using commodity tools like Cobalt Strike, Metasploit, or countless custom loaders. Economically, the model is frictionless: A single CVE, even a medium-severity one, can power botnets, ransomware-as-a-service (RaaS) kits, and credential harvesters for years. CVE-2017-0144 (EternalBlue) still shows up in mass scanning data as recently as 2024, years after its patch was released. Unsupported OSes guarantee that exploits like these never go out of style.

 

There are still over 400 million Windows 10 devices in use globally, according to StatCounter, and Microsoft telemetry indicates that hundreds of thousands of them haven’t received a critical patch in the last 18 months. Once support ends, these endpoints become low-effort, high-yield targets, ideal for drive-by exploits, undetected persistence, and lateral movement inside mixed environments.

When 400 million machines stop receiving patches, that’s not an upgrade issue—that’s an internet-wide vulnerability waiting to be indexed.

 

Attackers don’t need to break in: They just need to show up.

 

A soft target inside a hardened perimeter

Even networks with hardened perimeters using next-gen firewalls, endpoint detection and response agents (EDRs), and good security practices can be compromised by one unsupported, unmanaged Windows 10 machine. Why? Because once inside, the attacker doesn’t need to bypass your defences—they just move laterally from within, abusing legitimate tools and forgotten access rights.

 

This isn’t speculative. Tools like Mimikatz, SharpHound, and PowerView are routinely used to harvest cached credentials, enumerate domain privileges, and hop from one endpoint to another. Environments where legacy systems lack updated Event Tracing for Windows (ETW) protections or Credential Guard are especially vulnerable.

 

In fact, according to Microsoft’s Digital Defense Report, lateral movement occurs in over 80% of all targeted intrusions, often within 24 to 48 hours of the initial breach. As EDR products are updated, devices with unsupported operating systems lose protection over time. Those lacking advanced memory protection mitigations in newer OSes make them ideal targets for persistent malware and privilege escalation attacks.

 

Once attackers get a foothold on an unsupported endpoint, they can: 

• Dump LSASS memory for plaintext credentials
• Use token impersonation to act as domain users or admins
• Pivot using WMI, PsExec, or WinRM, all native system features in Windows 

Cyber-insurance won’t cover the risk

Cyber-insurers and regulators leave no quarter for businesses unwilling to update Windows. If your business handles regulated data—HIPAA-covered health records, PCI-regulated payment information, or government-classified or controlled unclassified (CUI) data—you may be in violation of your policy the moment support ends.

 

Cyber-insurance policies often contain clauses requiring that systems be actively supported by the vendor and fully patched to qualify for coverage. Once Windows 10 reaches EoL, it no longer meets that threshold and any incident involving it may be excluded from claims.

 

Consider this: The average cost of a data breach in the healthcare sector reached $10.93 million in 2024, according to IBM’s Cost of a Data Breach Report. For financial services, it was $5.9 million. Without coverage, that cost hits balance sheets directly.

 

From an insurer’s point of view, keeping unsupported systems online isn’t just a security concern: It’s documented negligence.  Cyber-insurers increasingly deny claims when breaches involve unsupported systems. This isn’t theoretical—it’s happening now. 

• Insurers refuse renewals or increase premiums if unsupported systems are detected during audits. Businesses have reported premium hikes of 50%+, non-renewal notices within 30 days, and outright claim denial due to “known vulnerabilities” tied to outdated software.
• A third-party case highlights a manufacturing firm whose policy explicitly excluded coverage for breaches involving "systems running software beyond its support lifecycle"—meaning their outdated Windows 10 setup would invalidate claims. 

In short: When insurers audit or face a claim, unsupported OSes are a massive red flag, not a minor detail. These aren’t legal hypotheticals—they’re actionable policy clauses being enforced today. 

 

Running Windows 10 past October 2025 doesn’t just increase your risk. It may void your safety net entirely.

 

The hybrid network weak link

Modern IT environments are hybrid by design. They blend on-prem Active Directory, Azure AD, SaaS applications, and cloud-hosted infrastructure to enable cost and performance efficiency alike. In this model, trust is transitive. The incident blast radius centred on one unprotected Windows 10 endpoint can reach far beyond the local network.

 

Take a common example: A user signs into Microsoft 365 from an unpatched Windows 10 laptop. No EDR, no Microsoft Credential Guard, and no managed configuration hardening. If that device is compromised, the attacker now has access to valid OAuth tokens, browser session cookies, and cached credentials; all of which can be used to pivot authentication into: 

• Exchange Online and SharePoint (to exfiltrate email messages and attachments)
• Teams and OneDrive (and laterally move via hyperlinks or macros)
• Azure AD and Entra ID (to enumerate account permissions and escalate access)
• Connected SaaS tools (via federated identity or SSO) 

According to Microsoft’s own data, over 40% of ransomware attacks now involve cloud identity compromise. Once inside, attackers often escalate using token theft, conditional access bypasses, or token replay attacks all enabled by that first compromised device.

 

In hybrid networks, legacy systems are weak links in an interconnected chain. Windows 10 becomes not just a local liability, but a cross-cloud risk multiplier.

 

Prepare now, or pay later

October 14, 2025, is the deadline before your attack surface drastically increases. For organisations with hundreds or thousands of Windows 10 machines, the transition to Windows 11 means biting the bullet and investing in a plan. It’s a multi-phase migration that demands careful planning, pilot testing, licensing negotiations, endpoint inventory, and user retraining.

 

And for many, it’s not a clean upgrade. According to Lansweeper’s 2024 survey, only 45% of existing enterprise PCs meet Windows 11’s CPU requirements. More than 60% of virtual machines lack TPM 2.0, hardware-level encryption technology required by Windows 11. Businesses must prepare to go beyond reinstallation and purchase compatible endpoint hardware.

 

This is not a project you complete in a single sprint. At enterprise scale, full OS migrations typically take months assuming the best-case scenarios. Custom applications, driver compatibility issues, or user environment idiosyncrasies can complicate a migration well beyond the best forecasted project plans. For regulated industries, sometimes even longer.

 

Planning now is non-negotiable. IT leaders should already be: 

• Auditing every endpoint
• Flagging unsupported hardware
• Building phased rollout plans
• Securing budget for licensing and hardware replacement
• Hardening and layering security around any systems that must remain on Windows 10 temporarily 

Businesses that treat end-of-life deadlines like an optional upgrade will find themselves victim to a breach. Once support ends, there will be no new patches, no extended lifelines, and no safe delay. Attackers will be ready on day one with automated attacks, scanners, and pre-built exploit chains. The question isn’t if Windows 10 systems will be targeted: It’s how quickly they’ll fall.

 

The last lifeline: Extended Security Updates (ESU)

For organisations unable to fully migrate by October 14, 2025, Microsoft’s Extended Security Updates (ESU) program offers a narrow escape hatch—but not a safety net. ESUs allow Windows 10 devices to continue receiving critical and important security patches for up to three additional years, depending on subscription type. 

• Commercial customers can enrol through volume licensing or CSP channels, at a cost of $61 per device in Year 1, doubling each year thereafter.
• Home users get a single-year extension for $30, or for free by syncing with a Microsoft account or redeeming 1,000 Microsoft Rewards points.
• Devices running in cloud environments (Windows 365, Azure Virtual Desktop) receive ESUs automatically at no additional cost. 

But make no mistake; this is a temporary buffer, not a long-term solution. ESU does not include feature updates, usability fixes, or customer support. It’s a patchwork shield for systems that should have already moved on. 

 

Worse, ESU only covers critical and important vulnerabilities. Exploits categorised as “moderate” or “low”—which threat actors often combine into multi-stage chains—may go unpatched. The result? Organisations still face meaningful exposure, even while paying a premium to stay afloat.

 

As one Microsoft blog post bluntly put it: “Extended Security Updates should be a last resort.”

 

If Windows 10 will linger in your environment, activate ESU, but treat it as a countdown, not a reprieve. The true deadline hasn’t moved. It’s just been delayed, and only if you pay.

 

---

 

Farid Mustafayev is a ThreatLocker Software Developer and Windows Specialist

 

Main image courtesy of iStockPhoto.com and Lazaros Papandreou