Windows 10 stops receiving security updates (also known as end of life) on October 14, 2025 (unless devices are in the Microsoft’s Extended Security Updates “ESU” program). Microsoft 365 Apps (Word, Excel, etc.) will still receive security updates on Windows 10 until October 10, 2028, but the operating system itself remains unsupported.

Microsoft provides several ways to confirm which version of Windows your device is running. For more information, please visit: What version of Windows am I running? (microsoft.com)

• After support ends, new security flaws won’t be fixed, which makes these devices easier to break into.
• Some software and drivers may stop supporting Windows 10, which can make it harder to keep these devices monitored and other components updated.
• ESU provides security fixes only (no feature updates or regular support), so it’s a short-term bridge, not a long-term solution.

• Older, unsupported devices are easier starting points for attackers to gain access and move into other research systems, risking code, datasets and draft manuscripts.
• The Government of Canada highlights the need to safeguard research from theft and interference; keeping outdated systems increases that exposure.

• Research agreements often require “reasonable” or “industry-standard” safeguards, responsible handling of non-public/confidential data, and regular/timely security updates (including flaw remediation).
• Using an unsupported system may conflict with these requirements, may require notifying the sponsor or data provider, and in some cases could be a material breach.

1. Identify

   • List any Windows 10 devices used in your project (including lab instruments and shared workstations).
   • Note who uses them and what project data/systems they access.

2. Triage

   • Decide for each device: Upgrade to Windows 11, use ESU for a short time, or limit network use until retirement.
   • Prioritize systems that handle confidential/sensitive data or have strict sponsor terms.

3. Confirm

   • Check your agreements for “supported systems,” “regular security updates,” or similar language.
   • If Windows 10 must remain temporarily, ask the sponsor/data provider if ESU plus extra mitigations (e.g., strong sign‑in, encryption, limited network access) are acceptable.
   • Confirm with local IT or Information Security that any replacement device or mitigation meets the agreement’s requirements.

4. Implement

   • Upgrade to Windows 11 or move project data to a supported, secured device that still receives updates.
   • For any temporary Windows 10 devices: apply mitigations (e.g., strong sign‑in, least access, encryption, limited network connectivity) and set a retirement date.
   • Document your plan, timelines, and who’s responsible; inform your team/partners as needed.

Your local IT contact information can be found at services for faculty & divisions or on your departmental/divisional website.

The Research Information Security Program is available for consultations and other support services.