Decision guide
Windows 11 or Windows 10, for a business in 2026
For any device that meets the hardware bar, Windows 11 now, because Windows 10 stopped receiving security updates in October 2025 and the only supported alternative is a per-device bridge that is priced to become more expensive every year. For devices that do not meet the bar, the question is not which operating system but whether to replace the device or bridge it briefly on Extended Security Updates with a named exit date. The one answer that has no defensible position is the one most fleets have by default: unenrolled, unpatched, and working fine.
What is actually being compared
- Windows 11
- The supported platform, with monthly security updates, feature updates, and a security architecture that depends on the hardware requirements Microsoft has confirmed will not change.
- Windows 10 on ESU
- Critical and important security updates only, per device, in annual periods to October 2028, at a price that steps up each year and is cumulative. A bridge for devices that cannot move yet.
- Windows 10, unenrolled
- No security updates since October 2025, no support, and no defensible position under DPDP Rule 6, customer questionnaires or cyber insurance. What most fleets are doing without having chosen it.
Side by side
How they differ in practice
| Feature | Feature | Windows 11 | Windows 10 on ESU | Windows 10, unenrolled |
|---|---|---|---|---|
Security updates | Monthly, full coverage | Critical and important only | None since October 2025 | |
Feature updates and new capabilities | Yes | No | No | |
Microsoft support | Yes | No, ESU is updates only | No | |
Hardware requirement | TPM 2.0, Secure Boot, supported processor | None, runs on existing hardware | None | |
Cost model | Included with the device or licence | Per device, escalating, cumulative | Nothing, and that is the problem | |
Duration | Ongoing | Three annual periods to October 2028 | Indefinite, and indefinitely exposed | |
Third-party software support | Current | Being dropped on vendor schedules | Being dropped on vendor schedules | |
DPDP Rule 6 position | Defensible | A documented mitigation | Difficult to describe as reasonable | |
Security questionnaire answer | Yes, supported | A named exception list to explain | No, or a representation you cannot evidence | |
Right for | Every device that can run it | A short list with exit dates | Nothing, by design |
Move to Windows 11 if
- The device meets the hardware bar. TPM 2.0, Secure Boot and a supported processor, which is Intel 8th generation, AMD Ryzen 2000 or later. A scan tells you, and a surprising share of devices that look ineligible only need TPM enabled in firmware.
- You want the security architecture the hardware requirements exist for: virtualisation-based security, hardware-backed credential protection and a firmware baseline Windows 10 could not assume. The upgrade only delivers this if the configuration follows.
- You are answering customer security questionnaires, holding ISO 27001 or SOC 2, or carrying a DPDP obligation, all of which ask whether every endpoint runs a supported operating system.
- You are provisioning new devices. Autopilot with Intune provisions Windows 11 devices without an engineer, and there is no reason to provision a new device onto an unsupported platform.
Bridge on Windows 10 ESU if
- The device cannot meet the hardware bar and cannot be replaced before the current ESU period ends. This is a real category and it should be a short, named list, not the fleet.
- The device runs an application with no Windows 11 path yet, and the vendor has a date. The ESU exit date should match the vendor date, and the alternative of a Windows 365 Cloud PC should be costed first.
- A funded replacement is ordered and delivery falls after the period boundary. A short bridge with the exit date set to the delivery date.
- You can document the risk acceptance: which devices, why, until when, signed by an accountable owner. That is what an auditor or an enterprise customer will accept in place of a clean yes.
Stay on unenrolled Windows 10 if
- There is no scenario in which this is the right answer for a business device that handles email, browses the web, or touches personal data. It is included here because it is what most fleets are actually doing, and naming it is the first step to leaving it.
- The only near-legitimate case is a device that must stay on Windows 10 for a hard application dependency, in which case it belongs on an isolated network segment with no internet and no email, treated as operational technology, with a signed risk acceptance and a review date.
When the other option is right
We are a Microsoft Partner and we sell Windows 11 migrations, so weigh that. Two things against our own interest. First, if a device is capable but has TPM disabled in firmware, the answer is a free setting change, not a replacement, and we will find those before proposing hardware. Second, if your fleet is small and your risk is genuinely low, a short ESU bridge while you plan a sensible refresh is a perfectly reasonable position and we will say so rather than push an immediate rollout. What we will not do is help you describe an unenrolled Windows 10 fleet as acceptable, because it is not, and because the day it goes wrong the question of who said it was fine will be asked.
Whichever you choose, do these first
- Scan the fleet from the device side. Not the asset register. Processor generation, TPM presence and state, Secure Boot and firmware mode. This sorts every device into upgrade, fix, replace or retire, and it is the only input the decision actually needs.
- Apply the firmware fixes before counting anything. Enabling TPM and Secure Boot on capable hardware routinely moves a meaningful share of the fleet from the replace bucket to the upgrade bucket at no cost. Budget after this recount, not before.
- Find out which devices handle personal data and which are internet-facing. Those are the priority whichever path they take, because they carry the DPDP exposure.
- If any device needs ESU, enrol it at the start of the current period, not at the boundary. Cumulative pricing means waiting costs the skipped months for nothing.
- Give every ESU device an exit date at enrolment and align it to a procurement order. An exit date with nothing behind it is an intention.
- Retire the devices nobody uses. Every fleet has them, they need neither upgrade nor ESU, and removing them shrinks every other number.
Questions
Common questions
Not without Extended Security Updates, and only partially with them. Unenrolled devices have received no security patches since October 2025, so every vulnerability disclosed since then remains open on them permanently, and attackers target unsupported operating systems specifically because the exploits are published and work unchanged. Devices on ESU receive critical and important security fixes, which is materially better and still not equivalent to a supported platform, since feature updates, non-security fixes and support have all ended and third-party vendors are dropping Windows 10 on their own schedules.
For most users the visible difference is the interface, which generates a fortnight of questions and then fades. The substantive difference is underneath: Windows 11 is built around the hardware it requires, using TPM 2.0 and virtualisation-based security for credential protection and a firmware baseline that Windows 10 could not assume. That is why the requirements are not negotiable. The catch is that upgrading the operating system and leaving the security configuration at defaults spends the money and skips the benefit, so the migration has to include configuring the posture the platform was designed for.
Technically, by bypassing the checks, and we do not recommend it. The result is an unsupported installation on which update behaviour is not guaranteed, and it produces a fleet you cannot describe honestly to an auditor, an insurer or a customer. Microsoft has confirmed repeatedly that the requirements will not be lowered. For a device below the bar, the supported options are replacement, a short ESU bridge with an exit date, or a Windows 365 Cloud PC that streams a supported desktop to the old hardware.
We do not publish it, and on this topic that is a deliberate choice rather than a house rule. Microsoft publishes the per-device figures directly and changes them at each period boundary by design. What matters more than the rate is the structure: per device, escalating each year, and cumulative so a late joiner pays for the periods it skipped. Enrolling a short named list at the start of the period for one year is a bridge. Enrolling the fleet and renewing into Year 2 is the most expensive way to not decide, and the money would have replaced a meaningful share of the machines it is protecting.
Only a device-side scan can tell you, because eligibility turns on the processor generation, whether TPM 2.0 is present and enabled, and whether the firmware is in UEFI mode with Secure Boot capable, none of which appears in an asset register. The most common finding is capable hardware with TPM or Secure Boot disabled in firmware, which is a free fix rather than a replacement. Intune and Endpoint analytics report most of this already, and a readiness assessment turns it into a sorted fleet with a verdict per device.
No, and it removes one specific way of being non-compliant. Rule 6 of the DPDP Rules requires reasonable security safeguards proportionate to the data you process, and an unpatched operating system is hard to describe as reasonable. A supported operating system with current security updates is a necessary part of a defensible position, not the whole of it. The notice, consent, retention, rights and breach reporting obligations are entirely separate, and neither Windows version has anything to say about them.
References
Official documentation
- Windows 11 requirements, Microsoft Learn
- Windows 10 Enterprise and Education lifecycle, Microsoft Learn
- Extended Security Updates program for Windows 10, Microsoft Learn
Still deciding?
Talk it through with an engineer, not a salesperson
Tell us your situation and we will tell you which option fits, including when that is not us. Initial reply within 4 business hours.