Why do unsupported Windows 10 devices create ongoing security risk?

Why unsupported Windows 10 devices stay risky even after the end-of-support date

Unsupported Windows 10 devices do not become safe simply because they still boot and run business apps. The operating system remains exposed to newly discovered flaws, and that exposure compounds over time as attackers can assume a growing backlog of unpatched weaknesses. The practical issue is not only known vulnerabilities, but the absence of a regular remediation path.

That is why end-of-support changes the security posture of the endpoint itself. A device that cannot be kept current stops behaving like a managed asset with a known patch baseline and starts behaving like a standing exception that requires compensating controls, tighter monitoring, or retirement.

For most organisations, the risk is less about a single dramatic failure and more about the accumulation of unresolved exposure across a fleet. Once an endpoint misses routine security updates, every new Windows weakness that would normally be corrected becomes an additional opportunity for exploitation, persistence, or lateral movement.

What changes in the threat model when patching stops

The threat model shifts because the attacker no longer needs a zero-day to target the device. They can work from a widening field of publicly known vulnerabilities that remain uncorrected on the unsupported system. That makes the endpoint a more predictable target, especially if it still has user sessions, local admin rights, browser access, cached secrets, or VPN reach.

Unsupported devices are also harder to trust in downstream decisions. If the endpoint cannot be brought back to a current security state, it becomes difficult to treat its telemetry, access requests, and local data as reliable. In practice, the lack of patchability can turn a normal workstation into a useful beachhead for credential theft, malware persistence, or movement to adjacent systems.

Where the device is exposed to the internet, remote work, or shared environments, the risk grows faster. An unsupported laptop used for privileged work is not just vulnerable itself, it can become the first step in compromising the accounts and systems that user can reach.

How to judge whether the exposure is acceptable or not

The key question is not whether the device still functions, but whether it can still be defended to the standard the business needs. If the answer depends on unsupported software remaining in production, then the organisation is accepting a residual risk that tends to increase over time rather than decay.

That judgement should take account of device criticality, user privilege, data sensitivity, network reach and whether the endpoint can be isolated from higher-value systems. A kiosk or tightly segmented appliance may be easier to contain than a daily-use workstation with broad internal access, but both still require a deliberate decision and a finite exit plan.

When the unsupported device is tied to sensitive credentials or privileged workflows, the risk is usually disproportionate to the convenience of keeping it alive. In those cases, the control question is not “can we stretch this hardware a little longer?” but “what business function justifies the widening exposure, and for how long?”

Risk and Threat Considerations

Unsupported endpoints create a predictable attack surface because the defender loses the normal update cycle that closes newly disclosed weaknesses. That increases the odds of exploitation, especially when the device remains connected to corporate identity, email, remote access, or internal application paths.

Failure mechanism: The operating system remains deployed after regular security updates stop, so vulnerabilities accumulate faster than they can be remediated. Attackers can then target a stable, known platform with older, uncorrected flaws and use the endpoint as a foothold for credential access or lateral movement.

Impact: The device can become a durable compromise point, exposing user data, cached secrets, and network access. In a fleet context, the bigger consequence is not one broken laptop, but a growing class of endpoints that no longer meet the organisation's minimum security baseline.

Practitioner Guidance

What to verify: Confirm which Windows 10 devices remain in use, what business role each one serves, and whether any hold privileged access, sensitive data, or remote connectivity. If a device cannot be patched to a supported state, treat it as an exception requiring explicit owner sign-off and a dated retirement or upgrade plan.

Decision rule: If the device can reach production systems or store sensitive credentials, prioritise upgrade or replacement ahead of discretionary hardware refresh cycles. If patching must wait, narrow network access, remove unnecessary privileges, and increase detection and response coverage until the device is retired.

Practitioner takeaway: The security problem is not that Windows 10 is old, it is that unsupported endpoints stop improving while attacker pressure keeps rising, so delay only makes sense when the exposure is actively contained and time-bound.

Related resources from NHI Mgmt Group

• Why do connected devices create ongoing security risk even when organisations believe they are well protected?
• Why do lost healthcare devices create both security and workflow risk?
• Why do missing KB details create security risk even when devices seem up to date?
• Why do unmanaged devices create both security and budget risk?