Microsoft sunset Windows 10 last October. Eight months later, half the IT teams I talk to are still cleaning up the migration — and the half that finished are now dealing with regressions on the version they upgraded to. A "patch" used to be a calendar event. In 2026 it's a risk decision, and the teams treating it like a calendar event are the ones taking outages they didn't budget for.
The story#
Three things are happening at once, and they're tangled together in a way that's confusing the conversation.
The first is the Windows 10 hangover. Microsoft ended free support for Windows 10 on October 14, 2025. Companies that didn't finish migrating in time had three choices: pay for Extended Security Updates (ESU — Microsoft's paid program for staying secure on Windows 10 past its sunset), refresh the hardware, or accept the risk of running unpatched. Commercial ESU started at $61 per device for Year One, and the price doubles every year after — $122 in Year Two, $244 in Year Three. A 500-device fleet that punted to ESU is staring at roughly $30,500 this year, $61,000 next year, $122,000 the year after. That is not "buying time cheap." That is a payment plan with a balloon at the end.
The second is the hardware floor. Windows 11 requires TPM 2.0 (a security chip on the motherboard — Windows 11 requires it and a lot of pre-2018 hardware doesn't have one) and an 8th-generation-or-newer Intel CPU, or the AMD equivalent. Canalys put the global count of Windows 10 devices that can't meet that floor at roughly 240 million. On top of that, the new Copilot+ tier — Microsoft's AI-PC class with an NPU (neural processing unit, a chip that runs AI models on the device itself) — adds another refresh ladder above the Windows 11 minimum. So even the companies that did refresh in 2024 are getting pitched on a second refresh now if they want the AI features Microsoft is leaning into.
The third is the patch quality problem on Windows 11 24H2 itself — the version most companies upgraded to. The 24H2 release cycle has been rough. A January 2025 security update broke audio for users with external USB DAC headphones. April 2026's monthly update (KB5083769 and KB5082063) was confirmed by Microsoft to wrongly trigger BitLocker recovery prompts on Windows 11, Windows 10, and Windows Server 2025 — meaning users showed up Monday morning to a recovery key screen on devices that were working Friday afternoon. Microsoft only fully resolved it with KB5089549 in May. There's a public list of "Resolved issues in Windows 11, version 24H2" on Microsoft Learn that is, frankly, longer than anyone wants it to be. Windows Latest counted more than 20 major update problems across 2025 alone.
Here's what that means in practice. The old IT default — "patch within 24 hours of release" — used to be a reasonable security control. In the current Microsoft release cycle, it's a coin flip. Half the time you close a real vulnerability. The other half you push a KB regression (a software bug introduced by the patch itself — the fix breaks something that was working) to your entire fleet before anyone has had time to see it coming. The good IT teams I'm watching in 2026 are not patching faster. They are patching smarter, on a schedule that catches Microsoft's misses before the misses catch the company.
Hot take#
Wait before blindly applying patches. Stay on the leading edge, not the bleeding edge.
Bleeding edge means you're a Day-1 patcher. Patch Tuesday (the second Tuesday of every month when Microsoft ships its security updates) drops, and your fleet has the new code by Wednesday. Whatever broke in that release, it broke on you first. You're paying for Microsoft's QA in production outages. Leading edge means you're still patching well inside any reasonable security SLA — within two weeks — but you're letting somebody else's fleet eat the first wave of regressions before yours does. You're the second mouse, not the first.
The mechanic that makes this work is patch ring discipline. A ring is just a group of devices that gets the update on a different schedule. Three rings is enough for most mid-market companies. Pilot ring is your canary group — a small set of IT-internal machines (your own laptop, the helpdesk team, a couple of test servers) that takes Patch Tuesday on Day 1. If something breaks on those ten boxes, you find out Wednesday, not the day your CFO calls about BitLocker. Early adopter ring is roughly 10% of the org — a deliberately mixed sample of business roles, hardware models, and software stacks — that gets the patch on Day 3 to Day 7, after the worst Day-1 issues have surfaced in public incident reports. Broad ring is everybody else, deployed on Day 10 to Day 14, after the vendor's own resolved-issues page has caught up and your early adopter ring has been quiet for several business days.
If your IT team is still running "patch within 24 hours" as a security control, you're not measuring security — you're measuring outage frequency. The 2026 control is "patch within 14 days, with a ring discipline that catches regressions before the broad deploy." Same SLA window the auditors care about. A tenth of the Monday-morning chaos.
Curated links#
- Extended Security Updates (ESU) program for Windows 10 (Microsoft Learn) — Microsoft's own page on what ESU covers, who's eligible, and how the pricing escalates each year. The reference document if you're building a board paper on the cost of not migrating.
- Resolved issues in Windows 11, version 24H2 (Microsoft Learn) — Microsoft's running log of things their own updates have broken on 24H2. Bookmark it. The length is the argument.
- Windows 11 had 20+ major update problems in 2025 (Windows Latest) — Year-in-review of the 24H2 patch regression history. Useful for handing to an executive who still thinks "Microsoft auto-update" is a settled question.
- April 2026 BitLocker recovery bug — KB5083769 / KB5082063 (Notebookcheck) — The clearest write-up of the recent BitLocker incident, what triggered it, and the May fix (KB5089549). The specific case study for why Day-1 patching is a coin flip.
- Create a deployment plan — Windows Update rings (Microsoft Learn) — Microsoft's own ring-deployment guidance. The official version of what's described above, with the Autopatch ring sizes (Test, First, Fast, Broad) for teams that want a more granular four-ring model.
What's next#
Issue #6 ships in two weeks — and the deep version of the argument above lands as a paired blog around the same time, with the full ring rollout calendar, a sample IT change-management memo, and the spreadsheet template we use with clients to model ESU-vs-refresh-vs-Windows-11 over a three-year window.