Windows 10 lost official support on 14 October 2025. Since then, laptops running "the ten" no longer receive security patches — and yet in most SMEs coming to us this year, part of the team is still on Windows 10 "because it works and why change it". It works until the first accounting software breakpoint, until the first insurer's audit, and until the first piece of ransomware that finds itself a known, unpatched hole.
This article is about how a 10–50 person SME can migrate to Windows 11 at the company's pace, not in a panic — without signing a 60-thousand invoice "because every supplier suddenly has a deal on". We're writing from the perspective of companies we've helped sort this out in the last six months.
What October 2025 actually changed
Support ended, but the system didn't explode. Windows 10 still boots in the morning and still prints invoices. Three things did change, though — and each of them, if ignored, costs more than the migration itself.
- No more security patches. Every new vulnerability in Windows 10 is published, discussed and exploited — with no patch on your side. For attackers, it's a list of addresses.
- A growing list of apps that "don't work on Win10". ERP, tax and accounting software vendors have started requiring Windows 11 for their new versions. Comarch, enova365 and most WMS vendors already flag it in their 2026 requirements.
- Cyber insurance and customer audits. NIS2 questionnaires and most cyber policies ask directly: "are all workstations under active vendor support?". Answering "no" means a higher premium, exclusion from cover, or being disqualified as a supplier by a large customer.
This isn't a "we still have a year" situation. It's an "every month without a plan raises your risk" situation — but also "you don't have to do it tomorrow in a panic".
What it looked like at one of our clients — 34 people, 28 laptops, 12 problems
At one of our clients, a 34-person logistics company in Western Poland, the starting picture was this: 28 laptops in the company, all Windows 10 Pro, 2–6 years old. A compatibility scan showed that 16 of them met Windows 11 requirements "out of the box", and 12 did not — mostly missing TPM 2.0, a few with too old a processor (Intel 7th gen, which Microsoft doesn't allow on Win11).
Their existing IT vendor's first offer: "let's replace those 12 laptops, PLN 4,500 net apiece, plus rollout, licences and configuration — PLN 78,000 total, ready in a month". Management nearly signed it.
We did a short audit of those 12 machines with them. The result: 7 laptops were actually used only occasionally (warehouse, reception, visitor desk), so a cheap PLN 2,500 device or a hand-me-down from another employee would do. 3 laptops were less than 3 years old and simply needed TPM enabled in BIOS (the chip was there, just switched off). That left 2 units for actual replacement. The migration cost dropped from PLN 78,000 to PLN 19,500, and the rollout took 6 weeks instead of 4 — but with no outages and no lost data.
This isn't a story about "the cheap version of the same thing". It's a story about the default "let's replace everything" offer being fat in the middle almost every time.
Three realistic paths for every laptop
In practice, every single device has one of three paths. The key is to deliberately pick a path per laptop, not "let's swap the fleet".
- Path 1 — in-place upgrade to Windows 11. The laptop meets the requirements (TPM 2.0, supported CPU, 4 GB RAM min., 64 GB disk). Back up the data, run the upgrade via Windows Update or the installer, check the apps. Cost: PLN 0 hardware, 1–2 hours of IT time per unit. Typically covers 60–70% of the fleet in SMEs with laptops from the last 4 years.
- Path 2 — device replacement. The laptop doesn't qualify and isn't worth babying, because the employee uses it 8 hours a day for heavy work (ERP + Excel + 20 browser tabs). A new business laptop: PLN 3,500–5,500 net. The old one moves down the food chain (reception, warehouse) or goes to certified recycling.
- Path 3 — Extended Security Updates (ESU) for 1–3 years. Paid security patches for Windows 10, officially from Microsoft. Prices start around USD 60 per device for year one and rise in subsequent years. Only makes sense for devices that have to live a bit longer (e.g. a workstation attached to a production machine whose software vendor won't support Win11 until next year).
There's a fourth path worth remembering: move the user onto Windows 365 Cloud PC or AVD and keep the old laptop as a "terminal" to a cloud desktop. Rarely pays off financially in an SME, but in specific scenarios (remote work from Ukraine, seasonal staff, heavy apps on weak hardware) it can be a clean answer.
A decision matrix — pick a path in 15 minutes per laptop
Before you start negotiating quotes, put four columns in a spreadsheet for every employee and their device. It takes 15 minutes per laptop and saves tens of thousands of złoty.
- Windows 11 compatibility. Run Microsoft's free "PC Health Check" or use Microsoft's list of supported CPUs. Mark YES/NO. For a handful of machines, check the BIOS — TPM 2.0 is often shipped disabled.
- Device role. "Heavy" (ERP + all-day work) or "light" (reception, warehouse, kiosk)? Heavy + incompatible hardware = replacement. Light = rotate a hand-me-down in.
- Age and condition. A 5+ year old laptop with a swelling battery and a worn-out keyboard is due for replacement regardless of Win11. You're buying new hardware "because of the migration", but you'd do it in a year anyway.
- Critical deadline. When does a patch or an app actually run out? For most SMEs the deadline isn't "December 2025" but "when our accounting software stops working". Order the queue by that, not by hardware age.
Once the table is filled in, 80% of decisions are obvious and countable. You end up with 2–3 edge cases worth discussing with the IT vendor — and those are what you actually discuss, not the whole fleet at once.
How to run it without paralysing the company
A Windows 10 → 11 migration isn't a "let's do it all over a weekend" project. It's an exercise you run at the pace of 4–8 weeks, in waves of 5–10 devices, starting with the least critical.
- Wave 0 — yourself. The first device migrated: the IT person's laptop, or someone from IT who knows the apps. Test the upgrade, note the issues, check printers, VPN, Comarch. A week of work.
- Wave 1 — 3–5 willing "pilots". People who don't panic at the sight of an error. Do the upgrade, they work for a week, you collect notes. Fix whatever broke.
- Waves 2–4 — the rest of the company. 5–10 devices per week. Always after hours or on a weekend, always with BitLocker backup, always warning the employee in advance that they might need 10 minutes in the morning to finish setup.
- Wave 5 — hardware to replace. New laptops staged via Autopilot/Intune, the user gets a ready device, the old one comes back to IT. Data lives in OneDrive/SharePoint, or gets moved with a migration script (User State Migration Tool or the Azure AD profile).
The point of that sequence: when something breaks, it doesn't break at the CEO's desk. The first breakage is discovered by IT or a pilot. Not by accounting on day 25 of the month.
Traps SMEs walk into
We've seen a few repeat mistakes this year. Writing them down so nobody's surprised.
- "Let's ignore TPM, it's not really important." It is. Windows 11 actually requires it — the workarounds (Rufus, registry hacks) work today, but any large feature update can wipe them out. That's not a line of defence you want in a business.
- Migrating without testing the printer and scanner. Drivers for older multifunction devices (Konica, Ricoh, Xerox from 2018) sometimes don't work on Windows 11. Test on one laptop before migrating the whole accounting department.
- Forgetting old specialist software. An 8-year-old invoicing app, a scale driver, a label printing tool — check compatibility before you migrate the workstation that uses them. In roughly 20% of SMEs, this is the moment where you have to decide: modernise the app, replace the scale, or keep one station on ESU.
- Buying hardware "without the Pro version". Windows 11 Home doesn't join a domain, doesn't have managed BitLocker, doesn't have Group Policy. Business = always Pro (or Business/Enterprise via volume licensing). A few hundred złoty between Home and Pro is the stupidest place to save money.
- Ignoring Autopilot/Intune for new hardware. If you're buying 5+ new laptops, provisioning them by hand takes 2 hours per device. Autopilot (even the basic version) cuts that to 20 minutes and removes the "this one got configured differently" risk.
Where to start tomorrow
If Windows 11 has been hanging over your company but nobody has the time to untangle it, do this — in order:
- Send a survey today: "how many laptops do you have, how many are on Windows 10". You'll have the number in 30 minutes.
- Run PC Health Check on 3–5 random units. You'll see your compatibility rate — with our clients it ranges from 45% to 80%.
- Fill the four-column matrix from the section above. 15 minutes per laptop. The rest defaults to "in-place upgrade" — that's free.
- Cost the replacement only for the units where it's actually justified. Almost always less than you assumed.
- Schedule waves 0 and 1 this month. The rest across the next quarter in waves of 5–10.
Windows 11 isn't a revolution. It's just a mandatory update you're better off having behind you before the first customer audit and before the first vulnerability that starts being weaponised. You do it at the company's pace, not in a panic.
If you want someone to walk through that spreadsheet with you and leave with a clear plan after one meeting — we help SMEs do this kind of exercise regularly. The first conversation is free and takes half an hour.
You don't have to replace half your fleet. You have to decide, in 15 minutes per laptop, which of the three columns each one belongs in.