Skip to content
Microsoft officially ended support for Windows 10 on October 14, 2025. No more free security patches. No more bug fixes. No more technical assistance. If your bank is still running Windows 10 today, every vulnerability discovered after that date is permanently unpatched, with no fix coming.
And more banks than you might think are still in exactly that position. According to industry estimates, approximately 1 billion PCs are still running Windows 10 heading into 2026, a staggering number given the security and compliance implications. In banking, the stakes are even higher. Regulators, examiners, and cyber insurers are paying close attention to which institutions have addressed this exposure and which haven’t.
Some banks have purchased Microsoft’s Extended Security Updates (ESU) program as a bridge after Windows 10 end-of-life. That’s a better position than running fully unsupported, but ESU is a temporary stopgap with its own expiration date, and the clock on it is already ticking.
Here is where things actually stand, what your community bank needs to know about Windows 10 EOL, and what steps you should be taking right now.
What Does Windows 10 EOL Mean Today?
Now that Windows 10 is past end of life, here’s what it actually means for your bank:
- No more free security patches. Any vulnerability discovered after that date will never be patched on Windows 10, regardless of severity.
- No more feature updates. The OS is frozen at its last release state.
- No more technical support. Microsoft will not assist organizations in troubleshooting Windows 10 issues.
- Devices still function, but they are exposed. Your workstations will boot, your staff can log in, and applications will run. But every day that passes, the number of known, unpatched vulnerabilities grows.
Cybercriminals know this. Attackers actively target operating systems after end-of-life because the attack surface never shrinks. A single unpatched Windows 10 endpoint can serve as the entry point for ransomware capable of locking down your entire network.
One more detail worth flagging: Microsoft 365 Apps, including Outlook, Word, and Excel, also lost official support on Windows 10 as of October 14, 2025. Microsoft will not guarantee those applications perform reliably or securely on Windows 10 going forward. If your staff are using Microsoft 365 on Windows 10 devices, that is an additional layer of exposure on top of the OS risk itself.
What Is ESU, and Why It’s Not a Long-Term Plan
Some banks have enrolled in Microsoft’s Extended Security Updates (ESU) program after October 14, 2025. If that’s your institution, you’ve bought some breathing room, but it’s important to understand exactly what ESU covers, what it doesn’t, and when it expires.
What ESU Covers
ESU provides critical and important security updates only, as defined by the Microsoft Security Response Center’s severity rating system. There are no bug fixes, no feature updates, no new functionality, and no technical support included. Your devices must be running Windows 10 version 22H2 to qualify and must be properly enrolled to receive updates through Windows Update.
What ESU Does NOT Cover
- Non-security bug fixes
- Performance improvements
- Technical support from Microsoft
- Microsoft 365 App support restoration
ESU Deadlines
ESU is structured as an annual subscription with escalating costs, and the pricing is intentionally designed to push organizations toward upgrading rather than staying indefinitely.
The final deadline is October 2028. After that, no further security updates will be available for Windows 10 under any program.
How Does Windows 10 EOL Affect Compliance?
For community banks, the regulatory implications of running end-of-life software are direct and serious.
GLBA Safeguards Rule
The Federal Trade Commission’s updated Gramm-Leach-Bliley Act (GLBA) Safeguards Rule, which took full effect in 2023, requires financial institutions to implement and maintain “reasonable” safeguards to protect customer information. An operating system with no security updates, or a paid patch bridge that is itself expiring, is difficult to reconcile with that standard.
FFIEC IT Handbook
The FFIEC IT Examination Handbook expects patch and vulnerability management as a core component of a bank’s security posture. Banks running Windows 10 without a documented migration plan are likely to draw findings at their next IT examination.
Cyber Insurance
Cyber insurance carriers now ask about end-of-life operating systems in renewal questionnaires. Banks without a credible migration plan may face premium surcharges, ransomware exclusions, or denied coverage. After a breach, a Windows 10 EOL system at the point of compromise creates a material misrepresentation risk if the underwriting application didn’t reflect that exposure.
What Banks Should Do Before ESU Runs Out
Rather than waiting to see how long ESU holds, the time to act is now. Here’s a practical framework for community banks to work through before ESU Year 1 expires in October 2026.
Step 1: Conduct a Thorough Inventory of All Systems
Before you can create a migration plan, you need a complete and accurate picture of every device in your environment. That means identifying all systems still running Windows 10—workstations, teller terminals, back-office machines, any device touching your network—and documenting the operating system version, hardware specs, installed applications, and business function of each.
This inventory is an examiner expectation. FFIEC guidance calls for financial institutions to maintain asset inventories as part of effective IT governance.
Step 2: Budget for Upgrades and Replacements, and Compare the Real Cost of ESU
For systems that meet Windows 11’s hardware requirements, upgrading the OS is typically the most cost-effective path. For older hardware that can’t support Windows 11, replacement may be the right answer.
If a device costs $800 to replace with a Windows 11 machine, and ESU would cost $427 over three years to keep it limping along—plus the ongoing risk exposure, plus potential insurance implications—the math often favors replacement.
Step 3: Check Windows 11 Compatibility
Microsoft has hardware requirements including a TPM 2.0 chip, a 64-bit CPU, and minimum RAM and storage thresholds. Devices manufactured before roughly 2018 are more likely to fall short.
Use Microsoft’s PC Health Check tool to assess each device’s compatibility. Sort your inventory into three buckets:
- Compatible: can upgrade directly to Windows 11
- Incompatible: requires hardware replacement
- Application-dependent: hardware is compatible, but relies on software that has Windows 11 compatibility issues to resolve first
Step 4: Document the Windows 10 EOL Migration Plan for Examiners
Your Windows 10 end-of-life migration plan should be a written, board-approved document. It should include the inventory of affected systems, the timeline for migration by device category, the responsible parties, and the compensating controls in place while migration is underway.
First, this demonstrates to examiners that your institution has identified the risk and is managing it with appropriate governance. Second, it gives your cyber insurer evidence of a credible migration roadmap, which can help in renewal conversations where the carrier is asking about your EOL software posture.
Step 5: Don’t Wait Until ESU Year 2
ESU Year 2 doubles the cost to $122 per device. The banks that navigate this most cleanly are the ones that use ESU Year 1 as the runway to complete their Windows 10 EOL migration—not as permission to delay it. Don’t enter Year 2 without a clear picture of when your last Windows 10 device comes off the network.
Update to Windows 11 With RESULTS Technology
Every bank still running Windows 10 today is operating with an OS that will never receive another free security patch. Those enrolled in ESU have purchased some time, but that time has a fixed expiration and an escalating price tag.
If you’re a RESULTS client, you should already have guidance from our team on where your environment stands. If you’re not yet a RESULTS client and you’re unsure where your bank is on this, let’s talk! We work with community banks every day, and we can help you move from exposure to confidence before your next examination.
Frequently Asked Questions
Is Windows 10 still safe to use after October 14, 2025?
No, not in any meaningful sense for a financial institution. While devices will continue to function, Windows 10 no longer receives security patches, which means every vulnerability discovered after the end-of-life date is permanent.
When does Windows 10 ESU end for commercial customers?
The ESU program runs for a maximum of three years after end of life. Year 1 runs through October 2026. Year 2 runs through October 2027. Year 3, the final year, ends in October 2028. After that date, no further security updates of any kind will be available for Windows 10. There is no extension beyond the three-year ESU window.
Will cyber insurance still cover a bank running Windows 10?
It depends, and that uncertainty is itself the problem. Carriers are now asking about end-of-life operating systems in renewal questionnaires, and banks with significant Windows 10 exposure that don’t have a credible migration plan may face premium increases, exclusions tied to EOL software vulnerabilities, or tighter underwriting terms.
What about core banking applications that still require Windows 10?
Some core banking platforms and specialty software vendors have been slower to certify their applications on Windows 11. If your core system or other critical applications have Windows 10 dependencies, the first step is contacting those vendors directly to ask about their Windows 11 compatibility roadmap and timeline.
Are ATMs and teller workstations affected by Windows 10 end of life?
Yes. ATMs and teller workstations that run Windows 10 are subject to the same end-of-life reality as any other device. Many ATMs run embedded versions of Windows, and the EOL situation for those platforms is managed separately through ATM manufacturers and their software vendors.
