Still on Windows 10? That's a Cyber Essentials fail now — here are your real options

Why “it still works fine” doesn't help you

Cyber Essentials' logic is about updates, not usability: unsupported operating systems stop receiving security patches, so every newly discovered flaw stays open forever. The requirement is that all in-scope devices run vendor-supported software — and the v3.3 rules pair this with the 14-day patching auto-fail: you can't patch within 14 days on a system that no longer receives patches at all. A single forgotten Windows 10 laptop that still touches company email or files is in scope, and it fails you.

The ten-minute fleet check

• List every computer that touches organisational data — including home machines used for work and the “spare” under the spare desk (scope follows the data).
• On each: Settings → System → About. Windows 11 → fine. Windows 10 → note it. Anything older → it should not be touching work data at all.
• Check Windows 11 eligibility on the Windows 10 machines (Microsoft's PC Health Check tool): many 2018+ machines upgrade free; many older ones can't because of hardware requirements (TPM 2.0).

Your four options, honestly compared

1. Free upgrade to Windows 11 (eligible hardware)

Cost: nothing but time. If PC Health Check passes, upgrade, verify updates flow, done — the answer for most machines bought since ~2019.

2. Extended Security Updates (ESU) — the paid stay of execution

Microsoft sells ESU for Windows 10, delivering security patches beyond end-of-support (business pricing starts around £45–£50 per device for year one and doubles each year, by design). A device covered by ESU is still receiving vendor security updates, which keeps it defensible for certification during the ESU window — but declare it honestly in the assessment, keep the enrolment evidence, and treat ESU as a bridge to replacement, not a destination: the economics are built to push you off it.

3. Replace the machine

A capable business laptop costs £400–£600. Against three years of doubling ESU fees plus the risk profile of ageing kit, replacement is usually the cheaper answer by year two — and the only one that also fixes the TPM/BitLocker and performance story.

4. Take it out of scope — properly

A Windows 10 machine that genuinely never touches organisational data, on a segregated network, can sit outside scope (the workshop PC running a lathe). “We mostly don't use it” is not segregation — assessors read this one carefully, and so do we.

The order to do things

Inventory → free upgrades first → replace-or-ESU decision per remaining machine (with the doubling cost in front of you) → genuine segregation for anything staying out of scope → then certify. If the inventory itself is the obstacle, the readiness check walks you through it in minutes — and the done-for-you service exists for exactly the organisation whose “IT department” is whoever's least afraid of the router.