Interested in our Cybersecurity Framework?
Visit our article on how to organise an effective cybersecurity strategy to download a copy of our framework.
Ready for the Unexpected?
The first hour after a cyber attack is critical. Make sure your organisation has the plans, processes, and support needed to respond effectively.
Cyber Security You Can Prove
See how Cyber Essentials Plus helps organisations demonstrate their commitment to protecting systems, data, and people.
Interested in a Free Phishing Security Test?
VirtueUK are partners with KnowBe4, the world's largest security awareness training and simulated phishing platform.
If you're interested in assessing the Phish-prone percentage of your users, contact us to arrange a free simulated phishing attack.
If you're interested in assessing the Phish-prone percentage of your users, contact us to arrange a free simulated phishing attack.
Microsoft ended support for Windows 10 on 14 October 2025, meaning the operating system no longer receives security updates, bug fixes, or technical support. While Windows 10 devices continue to function, unsupported systems create significant cyber security, compliance, and operational risks for charities and organisations. For UK charities with 30-400 users, now is the time to assess your estate and develop a migration plan. Options include upgrading eligible devices to Windows 11, purchasing Extended Security Updates (ESU) as a temporary measure, or replacing hardware that no longer meets Microsoft’s requirements.
What Does Windows 10 End of Support Mean?
On 14 October 2025, Microsoft officially ended support for Windows 10. As a result, organisations running Windows 10 no longer receive:
- Security updates
- Bug fixes and quality updates
- New features
- Technical support from Microsoft
Importantly, your computers do not stop working overnight. Users can still log in, access files, and run applications. However, any new vulnerabilities discovered after October 2025 will remain unpatched, leaving those devices increasingly exposed to cyber threats over time.
For charities that rely on Microsoft 365, cloud applications, fundraising platforms, finance systems, and donor databases, continuing to operate unsupported endpoints can introduce unnecessary risk across the organisation.
Why This Matters for UK Organisations
Many organisations view operating system upgrades as an inconvenience. Unsupported devices represent a security, compliance, and operational risk that can affect productivity, customer trust, and business continuity.
Cyber threats continue to grow across every sector. An estimated 612,000 UK businesses experienced a cyber security breach or attack during the previous 12 months, highlighting the importance of maintaining supported and secure technology platforms.
Unsupported operating systems create additional opportunities for cyber criminals to exploit vulnerabilities that no longer receive security updates. When a device is running an unsupported operating system, it becomes significantly easier for attackers to exploit newly discovered vulnerabilities, increasing the risk of downtime, data loss, and financial damage.
Unsupported Systems Create Multiple Risks
Increased Exposure to Cyber Attacks
Unsupported devices no longer receive security patches from Microsoft. This means vulnerabilities remain open indefinitely, giving cyber criminals more opportunities to gain access to systems and data.
Compliance and Governance Concerns
Trustees and senior leadership teams are increasingly expected to demonstrate appropriate cyber governance and risk management. Running unsupported software may raise concerns during audits, Cyber Essentials assessments, data protection reviews, and supplier due diligence exercises.
For charities handling donor information, beneficiary records, financial data, or sensitive personal information, maintaining supported systems forms part of a wider cyber resilience strategy.
Potential Cyber Insurance Implications
Cyber insurers increasingly review an organisation’s security posture before providing cover. Unsupported operating systems may increase premiums, reduce available cover, or create complications during claim investigations.
Software Compatibility Issues
Over time, software vendors stop supporting legacy operating systems. Browsers, security tools, finance applications, and productivity software may stop receiving updates or cease functioning correctly on Windows 10.
Your Options After Windows 10
For most organisations, there are three practical routes forward.
1. Upgrade Eligible Devices to Windows 11
Where hardware supports it, upgrading to Windows 11 remains the most cost-effective option.
Windows 11 offers:
- Improved security architecture
- Enhanced device management capabilities
- Better support for Microsoft 365 environments
- Ongoing Microsoft support and updates
- Stronger protection through Secure Boot and TPM requirements
Most devices purchased within the last few years can be upgraded without purchasing a new Windows licence. Microsoft’s PC Health Check tool can quickly determine eligibility.
For organisations already using Microsoft 365 Business Premium, Windows 11 also integrates effectively with security tools such as:
- Microsoft Defender for Business
- Conditional Access policies
- Intune device management
- Multi-Factor Authentication (MFA)
These are technologies that VirtueUK frequently helps organisations deploy as part of wider cyber resilience programmes.
2. Use Extended Security Updates (ESU) as a Temporary Measure
If certain devices cannot be upgraded immediately, Microsoft offers an Extended Security Updates (ESU) programme.
ESU provides access to critical security updates for a limited period after the end-of-support date. However, it should be viewed only as a short-term bridge rather than a long-term strategy.
ESU does not include:
- New features
- General technical support
- Performance improvements
- Modern security enhancements available in Windows 11
For organisations managing budgets carefully, paying ongoing ESU costs often becomes less cost-effective than replacing ageing hardware.
3. Replace Devices That Cannot Support Windows 11
Some older devices simply do not meet Windows 11 requirements, particularly around:
- TPM 2.0
- Secure Boot
- Supported processors
In these situations, replacing the device is often the most sensible option.
A newer device provides:
- Better performance
- Improved energy efficiency
- Longer manufacturer support
- Enhanced security features
- Greater compatibility with modern cloud services
For many organisations, the hardware refresh can be incorporated into a broader technology roadmap rather than treated as a standalone project.
How VirtueUK Helps Organisations Transition from Windows 10
A Practical Migration Plan
For organisations with 30-400 users, we typically recommend the following approach:
Step 1: Identify Windows 10 Devices
Create an inventory of all desktops, laptops, and shared devices still running Windows 10.
Step 2: Assess Compatibility
Determine which devices meet Windows 11 requirements.
Step 3: Prioritise High-Risk Systems
Focus first on devices used for finance, senior leadership, and privileged administrative access.
Step 4: Upgrade Eligible Hardware
Where possible, move directly to Windows 11.
Step 5: Replace or Ring-Fence Legacy Devices
Where upgrades are not possible, decide whether replacement or short-term ESU coverage is most appropriate.
Step 6: Improve Security Controls
Use the migration period as an opportunity to strengthen:
- Multi-Factor Authentication
- Endpoint security
- Device management
- Email security
- Backup and recovery processes
The Bottom Line
Windows 10 may still function, but it is no longer a supported platform. For organisations responsible for protecting donor information, beneficiary data, financial systems, and organisational reputation, continuing to rely on unsupported operating systems introduces unnecessary risk.
The good news is that most organisations have clear options available. Whether that means upgrading to Windows 11, replacing older hardware, or developing a phased migration plan, acting now is considerably less costly than responding to a preventable cyber incident later.