Windows 10 Security Issues: The Lingering Threats

Post Views: 32

Windows 10’s lingering presence poses significant security risks as it nears full obsolescence, with 16.9% of devices still using the outdated OS.

The Lingering Presence of Windows 10

The lingering presence of Windows 10 is emerging as a critical security concern as the operating system approaches full obsolescence. Data from Lansweeper indicates that Windows 11 now operates on 78.8% of Windows devices following Microsoft’s cessation of support for Windows 10 on 14 October 2025. Despite this shift, 16.9% of devices continue to use the outdated platform, which no longer receives security patches. This creates a growing exposure to unaddressed vulnerabilities.

Microsoft’s Extended Security Updates (ESU)

Microsoft’s consumer Extended Security Updates (ESU) program offers a temporary mitigation for eligible Windows 10 devices, extending security patches until 12 October 2027. However, this option requires payment and does not apply to enterprise, Long-Term Servicing Channel (LTSC), or domain-joined configurations. In the European Economic Area (EEA), users can access free ESU until 14 October 2026 without enabling cloud-based features. Outside this region, consumers must pay for ESU, redeem Microsoft Rewards points, or activate Windows Backup to maintain protections.

Industry-Specific Challenges

Certain industries continue to rely heavily on Windows 10 due to hardware and software constraints. Small and medium-sized businesses (SMBs) report 21.4% of devices running the outdated OS, compared to 16.6% in large organizations. Financial limitations hinder migration efforts, leaving many entities vulnerable. Sectors dependent on certified or embedded hardware, such as healthcare, pharmaceuticals, consumer retail, and manufacturing, exhibit the highest prevalence of Windows 10. These systems often interface with specialized equipment, kiosks, and industrial machinery that cannot be upgraded due to hardware restrictions and vendor certification requirements.

Security Risks and Vulnerabilities

Security risks associated with Windows 10 are significantly higher than those for Windows 11. On average, each Windows 10 device hosts 1,903 active Common Vulnerabilities and Exposures (CVEs), compared to 652 for Windows 11. Of these, 66.6% are classified as high or critical severity, while 2.4% are known to be actively exploited. Although some LTSC editions of Windows 10 remain under separate support agreements, regulatory frameworks mandate that organizations either maintain supported software or document and manage risks tied to unsupported systems.

Cyber Insurance and Compliance

Cyber insurers are increasingly scrutinizing the presence of outdated operating systems, potentially leading to higher premiums, coverage restrictions, or claim rejections in the event of breaches. Approximately 2.8% of Windows 10 systems lack the hardware required for Windows 11 upgrades, necessitating full replacements. These devices are concentrated in consumer retail, transportation, and manufacturing sectors, where specialized equipment like point-of-sale terminals and embedded controllers is designed for long-term use.

Broader System Vulnerabilities

The challenge extends beyond Windows 10, as 18.7% of Windows devices run operating systems that have already reached end-of-support, including Windows 7, 8.1, and XP. An additional 22.2% will become unsupported within six months, elevating the total share of vulnerable systems to 40.9%. The expiration of consumer ESU on 12 October 2027 will exacerbate the problem, as devices relying on this extension will transition to unsupported status without automatic migration. This means that two out of every five Windows machines will either be obsolete or soon face similar risks.

Call to Action for Organizations

Organizations must prioritize migration strategies to mitigate exposure to evolving threats and compliance penalties. Proactive steps are essential to address the growing security risks associated with outdated systems and ensure long-term operational resilience.