A single unpatched Windows 10 laptop can open the door to the whole estate. The answer is a device-by-device decision, carried out outside working hours.
More than 10 workstations · support contract · remote, on-site and phone support
For decision-makers short on time.
A single unpatched Windows 10 laptop connected to the company network can be the door through which an attack reaches the entire estate. Since 14 October 2025, Microsoft has stopped publishing security updates for that system at no cost. Nothing seems to have changed, the machines boot and Office opens, and that is exactly why so many organisations have not yet acted.
The right way out is an IT estate management decision, taken device by device: move to Windows 11, replace, or buy time with extended updates.
An end-of-life Windows 10 does not switch itself off or flood the screen with warnings. It simply stops receiving patches, features and technical support from Microsoft, and every flaw discovered from then on stays open. Attackers know exactly where to look.
| Option | Suitable when | Watch out for |
|---|---|---|
| Move to Windows 11 | The hardware is compatible: a recent processor (generally Intel 8th generation or AMD Ryzen 2000 and later), TPM 2.0 and secure boot; this covers many laptops bought since 2019 | Older business software, printers without current drivers, card readers and barcode scanners |
| Replace the device | Incompatible computers or those more than six years old | Avoid concentrating the spend in a single month; renew in stages |
| Extended Security Updates (ESU) | Devices that cannot be touched yet, such as the PC controlling an industrial machine or running critical software with no Windows 11 version | Three years maximum, paid per device per year, with a price that doubles annually |
On a compatible device with a valid Windows 10 licence, the upgrade carries no licence cost. Problems appear at the edges: applications and peripherals. Upgrade two or three workstations for users with different profiles first, let them work for a week, and only then move on to the rest.
The usual order starts with devices handling sensitive information, such as the board, finance and HR, followed by the rest. It is the right moment to standardise models, which cuts support costs in the years that follow. Before any purchase, take an inventory: the IT estate audit checklist includes the devices and operating systems section ready to fill in.
Buying ESU for the whole estate just to postpone the decision ends up costing more than a phased renewal.
Windows Server 2016 goes out of support in January 2027; 2012 has been unsupported since 2023. For physical servers running these versions, the options are to replace, virtualise or move to the cloud, as we explain in servers and virtualisation.
Under IT Unlimited contracts, the move to Windows 11 is part of the service, with no separate quote:
No. They keep booting and running programs, but without patches they become steadily more vulnerable to attacks exploiting known flaws.
No. Antivirus reduces the risk, but does not close the vulnerabilities in the system itself.
No, on compatible devices with a licensed Windows 10; the real cost lies in migration time, testing and replacing incompatible hardware.
One to two weeks once the pilot is validated, outside working hours and without stopping operations; replacements depend on equipment delivery times.
We identify which devices migrate, which are replaced and in what order, and carry out the move without stopping the business. Discover our remote, on-site and phone support and request a no-commitment proposal.
More than 10 workstations · support contract · remote, on-site and phone support.
Call +351 211 459 950 * or write to sales@dataroad.pt.
*Call to a Portuguese landline.
Chosen by respected and international companies
![MUN[it]](/assets/img/logos-c/munit.webp "MUN[it]"){kind=small}
★★★★★ 5,0 · 52 Google reviews
The real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…
· 7 min read
Automated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …
· 5 min read
The question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …
· 6 min read
In Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…
· 6 min read
Without documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…
· 6 min read
The risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…
· 5 min read
Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…
· 7 min read
A locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…
· 5 min read
A cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…
· 6 min readNumbers you can verify
Partners and certifications
DataRoad · Cloud and Microsoft 365
The right licences, MFA on every account and backups that actually restore. The cloud stops being an invoice and becomes a tool.
We do IT right.
IT Unlimited reduces risk and shows in writing what changed.
