Glossary
ESU (Extended Security Updates)
Also called: Windows 10 Extended Security Updates
In one sentence
A paid Microsoft program that keeps delivering critical security fixes to Windows 10 PCs for a limited time after official support ended.
Windows 10 reached end of support on October 14, 2025. After that date, Microsoft stopped releasing free security updates. Extended Security Updates is the paid bridge: organizations can buy ESU one year at a time for up to three years, ending in October 2028, and enrolled PCs keep getting critical and important security fixes.
ESU is deliberately a stop-gap. Microsoft’s pricing for businesses increases each year, it includes security fixes only (no new features and no general technical support), and it ends for good after year three. Some cloud scenarios — such as Windows 365 Cloud PCs and Azure Virtual Desktop — receive ESU at no extra cost, per Microsoft.
For a practice or small business, the real question is which PCs to upgrade and which to replace. ESU makes sense for a machine you genuinely can’t move yet — for example, a PC tied to a piece of imaging equipment whose software isn’t certified for Windows 11 — while you plan. A Windows 10 PC with no ESU that holds patient or client data is a known, documented risk your risk assessment should address.
Example: an office has twelve Windows 10 PCs. Eight upgrade free to Windows 11; three are too old and are replaced; one runs X-ray software that isn’t certified yet, so it’s enrolled in ESU and isolated on its own VLAN until the vendor’s update arrives. Check TPM compatibility first, and read our Windows 10 end of support guide. Check Microsoft’s ESU page for current terms.
Related terms
- TPM (Trusted Platform Module)A security chip (or chip-level feature) in a computer that stores encryption keys and checks the computer hasn’t been tampered with.
- Patch managementPatch management is the ongoing process of installing security updates on operating systems, applications and devices — on a schedule, with tracking, so nothing is left unprotected.
- EndpointAny device that connects to your network or data — laptops, desktops, phones, tablets and servers — and is used by a person or runs business software.
- Security risk assessmentA security risk assessment is a structured review of where your sensitive data lives, what could go wrong with it, how likely and harmful that would be, and what you'll do about it.
- VLAN (virtual local area network)A way to split one physical office network into separate, isolated networks so devices in one group can’t freely reach devices in another.