One in Six Windows Machines Still Runs Windows 10

Windows 10 is proving remarkably hard to kill. Asset tracking firm Lansweeper reckons 16.9 percent of the Windows devices it monitors are still running the older OS. That's down from roughly half a year ago, but the decline has slowed to a crawl. The easy migrations, as Lansweeper puts it, are done. What's left is the awkward remainder that either can't or won't move.

Where the holdouts are hiding

Some sectors are worse than others. Small and medium businesses sit at 21.4 percent. Healthcare and pharma at 23 percent. Retail and consumer devices at 22.7 percent. These aren't slivers of neglected hardware in the back office. They're meaningful chunks of the estate.

The security picture that goes with those numbers is grim. A Windows 10 machine now averages 1,903 active CVEs, against 652 on Windows 11. And only 14 percent of the Windows 10 estate has Extended Security Updates applied. Consumer ESU coverage runs until October 2027, commercial ESU until October 2028. After that, nothing.

The patch diffing problem

There's an uncomfortable dynamic at work here that goes beyond the raw CVE counts. When Microsoft ships a fix for Windows 11, researchers, and attackers, can reverse-engineer it to work out what was broken. If the same flaw exists in Windows 10 and hasn't been patched, the supported OS effectively hands attackers a map into the unsupported one.

Lansweeper's phrasing on this is blunt, and accurate. Every Patch Tuesday from here on quietly increases the exposure of anything still sitting on the old build.

Why the holdouts are holdouts

Most of these machines aren't stuck through laziness. Lansweeper's Esben Dochy points to medical devices, industrial equipment and retail hardware certified to a specific OS version, sometimes by contract, sometimes by warranty. Where the vendor hasn't produced a Windows 11 certified equivalent, paying for Extended Security Updates doesn't really solve the underlying problem. It just buys time.

Other Windows 10 devices are air gapped in corners of the network where the risk has been quietly accepted rather than actively managed. With new PC hardware getting more expensive rather than less, the hard core of holdouts isn't shrinking quickly either.

What's actually useful right now

For anyone running a mixed estate, the practical work isn't dramatic. It's inventory.

• Know exactly which Windows 10 devices are still in the building.
• Know which of those are covered by ESU and which aren't.
• Know which are pinned to a specific OS version by vendor certification, and which are simply overdue for replacement.
• Know which are exposed to the internet, and which live somewhere quieter.

None of that migrates a single machine. But it turns a vague sense of unease into a list you can actually work through, before the ESU clock runs out and the patch diffing gets worse.