As of 14 October 2025, Microsoft has officially ended support for Windows 10.
After a decade of service, the operating system that powered countless school and office devices is now officially out of support. For many schools and trusts across the UK that have not yet upgraded to Windows 11 or another operating system, this is the wake-up call that your organisation is facing a serious cyber security risk that demands immediate attention.
⚠️ Why this matters for education
If your school is still running Windows 10, your devices will no longer receive free security or feature updates. This means any new vulnerabilities discovered after this point will remain unpatched, exposing your systems, data and users to unnecessary risk.
Many schools are in this position not because of neglect, but because their existing hardware cannot run Windows 11. Microsoft’s strict requirements around CPU, memory and TPM (Trusted Platform Module, a small chip that provides hardware-based security and helps enable features like encryption and secure boot) have made upgrading difficult, particularly for older devices that still perform well enough for classroom use.
The National Cyber Security Centre (NCSC) has consistently warned that running unsupported software creates a direct cyber security threat. Their guidance on Obsolete Products highlights that systems no longer supported by vendors will remain vulnerable to exploitation because no further security patches are issued.
This links directly to the Department for Education’s Meeting digital and technology standards in schools and colleges guidance, which explains how schools should plan, maintain and secure their technology infrastructure.
Ignoring these standards risks non-compliance with DfE expectations, weakens your security posture and undermines the resilience of your school’s digital environment.
🚨 The risks of staying on Windows 10
Continuing to use Windows 10 beyond its end-of-life date introduces serious operational, financial and reputational risks for schools and trusts. A successful cyber attack on an unsupported system could cause:
• Disruption to teaching and learning – Ransomware or malware could lock staff out of files, systems and lesson resources.
• School closure – Many schools hit by major attacks have had to close temporarily while systems are rebuilt and data restored.
• Loss of sensitive data – Including pupil information, safeguarding records, payroll and financial systems (e.g. The recent attack on the Kido nursery chain).
• Reputational damage – Loss of trust from parents, staff and the wider community if confidential data is leaked or systems fail.
• Regulatory fines – Potential action from the Information Commissioner’s Office (ICO) under data protection law if the school is found to have neglected its duty to protect personal information.
• Increased insurance premiums or denial of cover – Many cyber insurance policies exclude claims where unsupported software is in use.
• Long-term recovery costs – Rebuilding networks and restoring data can cost tens of thousands of pounds, not including lost teaching time and staff hours.
The NCSC’s Cyber security in schools and colleges guidance reinforces that strong patch management and timely updates are essential to protecting systems. Running out-of-support software directly violates this principle.
🧭 The options from today
Here are the most practical steps schools and trusts can take next.
1️⃣ Upgrade to Windows 11
If your hardware meets the requirements, plan your rollout now. Prioritise key systems and ensure compatibility with your MIS, classroom tools and safeguarding platforms. This supports the DfE’s standard for having devices that meet modern performance and security requirements.
2️⃣ Extended Security Updates (ESU)
Microsoft’s Extended Security Updates provide paid protection for up to three more years, but this is only a temporary measure. It offers short-term cover, not a long-term solution. Use this time to prepare your migration plan, secure funding and move towards a fully supported platform.
3️⃣ ChromeOS Flex
For many schools, ChromeOS Flex is the real game-changer. It allows you to repurpose older Windows 10 devices into fast, secure, cloud-managed machines that integrate seamlessly with Google Workspace for Education. It’s simple to deploy, cost-effective and ideal for the browser-based workflows that are now common in schools.
ChromeOS Flex stands out because it is designed with security, simplicity and sustainability in mind. It updates automatically in the background, isolates each process for protection through sandboxing, and can be managed remotely through the Google Admin Console. It boots fast, runs efficiently on older hardware and delivers consistent performance over time. Most impressively, there has never been a successful reported ransomware attack on ChromeOS Flex, giving schools real confidence in its reliability.
If you want to explore how to deploy ChromeOS Flex in your school, take a look at my step-by-step guide: bit.ly/FlexHowTo2025.
4️⃣ Virtualisation and app streaming
If your school still relies on a few Windows-only applications, consider virtual desktops or app streaming as a temporary measure. This approach helps contain risk while maintaining access to legacy systems. It also aligns with the DfE’s wider emphasis on using secure, cloud-based solutions that are scalable, cost-effective and accessible from anywhere, as outlined in the Cloud solution standards for schools and colleges.
🧩 Your action plan
Every school and trust now needs a clear and time-bound strategy to phase out Windows 10 safely and responsibly. The goal is not only to reduce cyber risk but also to modernise your IT environment in line with DfE expectations and NCSC guidance.
Here’s how to approach it:
• Audit your application landscape – Identify which systems and tools are Windows-only, which can run cross-platform, and which are already browser-based. Understanding your digital footprint helps you prioritise upgrades and plan realistic replacement timelines.
• Segment and secure legacy devices – If you must keep Windows 10 devices temporarily, isolate them on a separate network or VLAN, restrict administrative privileges, and disable external access wherever possible. Follow the NCSC’s guidance on obsolete products to contain risk and limit the impact of potential compromise.
• Develop a clear migration strategy – Create a roadmap with milestones, cost forecasts, device refresh cycles, and staff training. Link this to the DfE’s Digital leadership and governance standards, ensuring leaders understand how digital planning connects directly to school improvement and risk management.
• Communicate with leadership and governors – Cyber security is not just an IT issue. Make sure senior teams understand the potential operational and financial impact of unsupported systems, and the benefits of moving towards a modern, secure, cloud-first infrastructure.
• Invest in ongoing EdTech training – Technology is only as effective as the people using it. Provide regular, high-quality training for staff so they can confidently use new systems, understand how to protect data and apply secure working practices. Building digital capability across the workforce is good professional practice and ensures technology is used effectively and safely in every classroom.
• Align your cyber security posture – Review your practices against the DfE’s Cyber security standards for schools and colleges. Focus on strong patch management, multi-factor authentication, off-site backups and tested incident response planning. These are critical to safeguarding learning continuity and protecting sensitive data.
This plan should form part of your broader digital strategy, combining infrastructure renewal, cyber resilience and staff development. Schools that take this proactive and people-centred approach will not only reduce risk but also create lasting value and confidence in how technology supports learning.
💬 Looking ahead
Schools should not be running Windows 10 beyond this point without a defined and funded refresh plan in place. This is not about panic. It’s about proactive digital strategy.
For newer hardware, Windows 11 remains the logical path forward. For older fleets, ChromeOS Flex provides a sustainable, secure and affordable alternative that keeps learning moving and devices out of landfill.
If you are relying on ESU, make sure you have a clear exit plan. This will become a costly strategy and temporary measures have a tendency of becoming permanent problems if left unchecked. You cannot keep kicking the can down the road and hope the issue will go away. Eventually, you will reach a dead end.
If your school or trust needs help reviewing its devices, applications or migration options, I can help you design a roadmap that keeps teaching running smoothly while maintaining compliance, cyber security and alignment with DfE standards. Please feel free to get in touch.
Let’s make sure your IT just works.
#EdTech #Microsoft #Windows #Windows10 #Windows11 #ChromeOSFlex #CyberSecurity #DfEStandards #DigitalStrategy #DigitalTransformation #ITjustworks ✅