Windows 10 ESU: Budgeting the Bridge Before the Refresh
Extended Security Updates buy time, not a solution — and the pricing is built to make waiting the expensive option.
By Uniqcli Team · · 6 min read
Procurement Guidance
Windows 10 ESU Is a Bridge, Not a Plan
Windows 10 reached end of support in October 2025, and Extended Security Updates (ESU) exist to buy fleets time to finish a hardware refresh — not to replace one. The program is structured so that time gets more expensive the longer an organization holds on to it: per-device pricing steps up each renewal year, and the math that looked defensible in year one stops working by year three. Treating ESU as a standing line item rather than a countdown is the single most common budgeting mistake procurement teams make with it. This piece walks through how the pricing escalates, how to find the point where refreshing beats renewing, which devices are actually worth bridging, and the procurement mechanics for buying exactly as much time as a fleet needs without quietly doubling total cost of ownership along the way.
How Windows 10 ESU Pricing Escalates by Design
Microsoft's commercial ESU program is priced to expire even where the calendar allows renewal. The published structure starts near $61 per device in the first year and doubles in each subsequent year, landing around $244 per device by year three — a roughly fourfold increase in cumulative per-device spend across the program's life, before any volume-licensing or cloud-management adjustments are applied.
That escalation isn't a pricing accident; it's the incentive mechanism. Microsoft wants ESU to be a tolerable one- or two-year cost and an obviously bad three-year one. Procurement teams that model ESU as a flat annual fee — the same number every budget cycle — will find themselves justifying a renewal decision in year three that no longer pencils against a straightforward refresh.
The practical implication: model ESU cost cumulatively, not per year. A fleet of 500 devices bridged for three years isn't a $61-per-device decision three times over — it's a commitment that front-loads the appearance of savings and back-loads the real cost, and the back end lands in a budget cycle that's easy to underestimate today.
Budgeting the ESU-to-Refresh Crossover
The crossover point — where cumulative ESU spend meets or exceeds the cost of refreshing the device outright — depends on the device's remaining useful life and its refresh price point, not just the ESU fee schedule. A device with two or three years of legitimate service life left can often be bridged through year one or two of ESU more cheaply than replacing it early. A device already past its practical refresh window is a poor ESU candidate regardless of what year one costs.
Build the crossover model at the device-class level, not the fleet level. Standard office laptops, ruggedized field units, and fixed-function kiosks each carry different refresh costs and different tolerance for staying on an unsupported-but-patched OS, so a single fleet-wide ESU-versus-refresh number will be wrong for most of the devices it's applied to.
Run the model against the full three-year ESU window even for a one-year renewal decision. A device that clears the crossover threshold in year one but would fail it in year two needs a refresh commitment lined up now, not a decision deferred to next year's budget cycle under the assumption ESU will still be the cheaper option.
Which Devices Are Worth Bridging
Not every unsupported device belongs in the ESU budget. The strongest candidates share three traits: they have genuine remaining service life, they run workloads or line-of-business software with a defined refresh or compatibility timeline, and no faster or cheaper compliance path — network isolation, application-level controls — closes the same exposure for less.
The weakest candidates are devices already flagged for replacement on an existing refresh schedule, low-value endpoints where a lightweight replacement costs less than a single year of ESU, and anything handling regulated or sensitive data where 'patched but unsupported' isn't a posture the organization's compliance obligations will accept regardless of price.
A useful screening question for each device class: if ESU pricing were flat instead of escalating, would this device still be worth bridging? If the answer is no, the device belongs in the refresh queue now — the current pricing only makes the decision more urgent, not less obvious.
Procurement Mechanics: Buying Time Without Doubling Cost
The mechanical trap in ESU procurement is renewing the whole fleet on the same cycle out of administrative convenience. Staggering ESU coverage to match each device class's actual crossover point — rather than renewing everything annually as a single line item — keeps the escalating per-device cost from compounding across devices that didn't need a second or third year in the first place.
Pair every ESU purchase with a funded refresh line for the same device class, even if the refresh doesn't execute until the following cycle. An ESU renewal made without a parallel refresh commitment tends to become next year's ESU renewal by default, which is exactly the outcome the escalating pricing is designed to make expensive.
Procurement should also confirm eligibility and enrollment mechanics before budgeting a renewal: ESU purchased through a volume-licensing or cloud-managed path can carry different terms and device-management prerequisites than a device-by-device purchase, and enrollment gaps between coverage years leave a device unsupported and unpatched during the lapse — a compliance exposure with no ESU price attached because there's no ESU coverage in force.
ESU Budgeting Checklist
Before renewing ESU for any device class, confirm the following.
- Cumulative three-year ESU cost is modeled, not just the current-year fee
- Crossover point against refresh cost is calculated per device class
- Every ESU line item has a paired, funded refresh commitment
- Devices already on an existing refresh schedule are excluded from renewal
- Enrollment method (volume licensing vs. cloud-managed) is confirmed for eligibility
- Coverage continuity is verified so no device lapses unpatched between renewal cycles
- Regulated or sensitive-data devices are screened against compliance tolerance for unsupported OS status
- Lower-cost compliance alternatives (isolation, app-level controls) are ruled out before bridging
Frequently asked
How much does Windows 10 ESU cost per device?
Commercial ESU pricing starts near $61 per device in the first year and doubles in each subsequent renewal year, reaching roughly $244 per device by year three. Actual figures depend on licensing path and volume terms, so confirm current pricing before budgeting.
How many years can you buy Windows 10 ESU?
The commercial ESU program runs up to three years past end of support. There is no renewal path beyond that window, which is why a device still needing coverage in year four has to be refreshed rather than bridged further.
Is Windows 10 ESU worth it for older devices?
Only if the device has genuine remaining service life and a defined refresh timeline. For devices already due for replacement, a year of ESU spending often costs more than simply moving the refresh forward.
Does Windows 10 ESU cost more every year?
Yes — the commercial program is structured to roughly double the per-device fee each renewal year, which is a deliberate incentive to complete the refresh rather than treat ESU as ongoing support.
What happens if a device's Windows 10 ESU coverage lapses?
A lapsed device stops receiving security patches immediately and has no ESU coverage until re-enrolled, which can require meeting current-year eligibility terms again. That gap is a compliance exposure independent of any ESU price.
Related resources
Go deeper
Fleet deployment and staging
Imaging, staging, and rollout for refresh cycles — so replacement devices arrive configured and ready to deploy across the fleet.
Learn moreWorkplace modernization
Endpoint, identity, and device-lifecycle solutions built around refresh cycles rather than one-off replacements.
Learn moreBrowse the catalog
Source replacement endpoints, laptops, and desktops for the devices that don't clear the ESU-versus-refresh crossover.
Learn moreModel your ESU-versus-refresh crossover
Get a quote scoped to the device classes worth bridging and the ones ready to replace now.