The good news, and the reason for this post, is that the situation changed in 2026. Microsoft's consumer Extended Security Updates (ESU) programme, which originally ran for one year, now covers Windows 10 through to 12 October 2027. That gives most people breathing room — provided they actually switch it on.

First, find out what you have

Press the Windows key, type winver and press Enter. A small window tells you the edition and version. If it says Windows 10, read on. If it says Windows 11, you are fine — close this and go and have a cup of tea.

Then, still on Windows 10, open Settings → Update & Security → Windows Update. If you see a line offering to "Enroll now" in extended security updates, your computer is eligible and you have not done it yet.

The three routes

Route 1 — Upgrade to Windows 11 (free, if the computer qualifies)

Windows 11 is a free upgrade for any Windows 10 computer that meets the hardware requirements. The requirement people trip over is a security chip called TPM 2.0 and a reasonably recent processor; many machines from 2018 onwards qualify, many from before do not. Microsoft's own PC Health Check app (a free download) gives a yes or no.

If it says yes, this is the right answer for almost everyone: Windows 11 is supported for years to come and the upgrade keeps your files and programs. Take a backup first (our 3-2-1 backup guide explains how), then let Windows Update do it. Allow an hour and do not start it at 5 pm on a Friday.

Route 2 — Enrol in Extended Security Updates (Windows 10 stays, patched until October 2027)

If the computer cannot run Windows 11, or you simply are not ready, enrol in ESU. In the UK there are three ways to do it and all three give the same protection:

• Free, if you sign in with a Microsoft account and allow Windows to back up your settings to that account.
• Free, by redeeming 1,000 Microsoft Rewards points.
• A one-off payment (around £25 in the UK; Microsoft quotes 30 US dollars) — the route to take if you prefer to keep using a local account.

One enrolment covers up to ten computers on the same Microsoft account, which is handy for a household. Enrolment is done from the Windows Update page mentioned above, and you can join at any time until the programme ends.

Businesses use a separate, paid ESU licence per device, and unlike the consumer version the price rises each year — which is Microsoft's polite way of saying "please move".

Route 3 — Replace the computer

If the machine is more than about seven years old, struggling anyway, and cannot take Windows 11, the money is usually better spent on a replacement than on nursing it along. A modern laptop with 16 GB of memory and a solid-state drive will feel like a different world, and it will be supported until well into the 2030s. We can supply and set up machines for both homes and businesses, and move everything across.

What we recommend, by situation

Two things people get wrong

"I have antivirus, so I am fine." Antivirus catches known bad files. It cannot patch a flaw in Windows itself, which is what the security updates do. Both are needed; neither replaces the other.

"I never click on anything dodgy." Unfortunately the most common route in is a website you would consider perfectly normal, or a document that arrives from someone whose own email was compromised. The whole point of updates is that they protect you from things you never see.

For businesses: this is now a compliance question

The 2026 update to Cyber Essentials (the UK government-backed baseline standard) requires that critical and high-risk updates are installed within 14 days of release, and that all software in scope is supported by its vendor. An unenrolled Windows 10 machine fails that test, which in turn can affect insurance and tenders. Our post on what changed in Cyber Essentials this year covers the detail.

The short version

Check winver. If it is Windows 10, either upgrade to Windows 11 today or switch on extended updates today — both are free for most people — and put "replace before October 2027" in the diary. If you would rather someone did it for you, that is a thirty-minute job for us, remotely or on site.

The 2025/26 edition, published on 30 April 2026, found that 43% of UK businesses identified a cyber attack or breach in the previous twelve months — around 612,000 companies. Among small businesses (10–49 staff) the figure was 46%; among medium businesses (50–249 staff) it was 65%. Phishing was by far the most common attack, reported by 38% of all businesses, and it accounted for 69% of the most disruptive breaches. Ransomware, the thing that makes the news, was reported by just 1%.

So if you run a business of 2 to 500 people, the threat you are most likely to face is a person being persuaded to click, type a password, approve a login, or pay an invoice. That is good news, because it is a problem you can do something about without a large budget.

What phishing looks like in 2026

The badly spelled email from a foreign prince is long gone. What lands in inboxes now is:

• A login page that looks exactly like Microsoft 365 or Google Workspace. Often reached from a "shared document" or "voicemail" link. The page is a proxy: whatever you type, including the multi-factor code, goes straight to the attacker.
• Invoice redirection. The attacker has quietly been reading a real mailbox — yours or a supplier's — for weeks. When a genuine invoice is due, a follow-up email arrives with "updated bank details". Nothing about it looks wrong because everything except the sort code is real.
• MFA fatigue. The attacker has the password and repeatedly triggers the approval prompt on someone's phone at 11 pm until they tap "Approve" to make it stop.
• The chief executive on the phone. Text messages or WhatsApp from "the boss" asking for gift cards, a quick transfer, or a change of payroll details. Increasingly, a convincing voice call.
• QR codes in emails and on posters that take the phone — which usually sits outside the company's security tools — to the fake login page.

The common thread: the attack does not break technology, it borrows trust.

What works, in order of effort

1. Multi-factor authentication on everything — and the right kind

If you do one thing, do this. A password alone is no longer a lock. But not all second factors are equal:

• Text-message codes are better than nothing but can be intercepted or phished.
• App-based codes and push approvals are good, especially with "number matching" turned on, which defeats the MFA-fatigue trick.
• Passkeys and security keys (FIDO2) are the gold standard: they are tied to the real website, so a fake login page simply cannot use them. Microsoft 365 and Google Workspace both support them now, and the 2026 Cyber Essentials guidance points firmly in this direction.

Since April 2026, Cyber Essentials requires MFA on all cloud services where it is available. If you want the certificate, this is no longer optional.

2. Make the fake pages harder to reach

Most modern email services can be tuned far beyond their defaults. Turning on the built-in protections — link scanning, attachment sandboxing, impersonation detection for your own senior names and your key suppliers — costs nothing extra in most Microsoft 365 Business Premium and Google Workspace tiers. It is the single most under-used setting we see.

Add SPF, DKIM and DMARC records to your domain. These stop criminals sending email that appears to come from your address, protecting your customers and suppliers and, in the process, your reputation. It is a DNS change, not a project.

3. A payment rule that cannot be phished

Technology does not stop invoice fraud; a process does. Adopt one rule and write it down: any change to bank details is confirmed by phone, using a number you already had, before a penny moves. Not the number on the email. Not a reply to the email. Every finance team we have seen lose money to invoice redirection had no such rule; every one that has the rule has caught an attempt.

4. Training that is short, regular and blame-free

An annual hour of slides does not change behaviour. What does is a few minutes every month or two — a real example that arrived that week, what gave it away, what to do. Simulated phishing emails can help if they are used to teach rather than to catch people out. Someone who is embarrassed for clicking will not report the next one; someone who is thanked for reporting will.

Make reporting effortless: a "Report" button in the email client, or simply forward to a known address. Speed matters. The attacker's window closes the moment IT knows.

5. Limit the blast radius

Assume, one day, someone will click. Then ask what the attacker gets:

• Does that person have administrator rights they do not need? Remove them.
• Is there a shared mailbox with a password everyone knows? Replace it with proper delegated access.
• Are old accounts for people who left still active? Disable them.
• Is there a backup that a compromised account cannot delete? There must be — see our 3-2-1 backup post for the principle; the business version is the same idea with more zeros.

6. Know what you would do

A one-page plan — who to call, how to reset every affected password, how to tell customers, whether you have cyber insurance and what its conditions are — turns a bad afternoon into a manageable one. Only 25% of businesses in the survey had a formal incident response plan (21% of micro businesses), which means most are working it out live, on the day.

What this costs

Less than people expect. Steps 1, 2, 3 and 5 are mostly configuration of things already paid for, plus an engineer's time. Step 4 is a habit. Step 6 is a document. The survey found that most incidents cost businesses little or nothing in direct terms — which sounds reassuring until you are the exception with a redirected invoice, a locked mailbox and a weekend nobody got back. Set against that, it is a very small number.

If you would like us to look at your Microsoft 365 or Google Workspace tenancy and tell you which of these are already on, which are off, and how long the gap would take to close, that is a fixed-price piece of work and we will put the findings in writing. Start with our cyber security overview or just get in touch.

This is not a scare story and it is not a sales pitch for a shiny new system. It is a fixed engineering deadline, and the sooner you deal with it the cheaper and calmer it is.

What is actually being switched off

Two things are going:

• PSTN — the analogue voice network your phone number has historically lived on.
• ISDN — the digital lines (ISDN2 and ISDN30) that many offices used for their phone systems.

Everything that used to ride on those lines moves to an internet-based (all-IP) service instead. Your broadband will still work, but the voice part of the line disappears. Openreach stopped selling new analogue lines back in 2023 (the "stop-sell"), so anything you have now is legacy kit living on borrowed time.

Why waiting costs money

In February 2026 Openreach reported that around 2.8 million lines still had to migrate, more than 500,000 of them serving business premises. To push the stragglers along, the wholesale rental for the old products is being increased in three steps during 2026 — in April, July and a final rise on 1 October 2026. Your provider passes those costs on. In other words, a line you keep until the last minute costs noticeably more every quarter, and then simply stops.

There is a second, quieter cost: engineer availability. Everybody who has not moved will be trying to book installations in the same few weeks. Book now and you pick the date; book in January and you take what is left.

What stops working on the day

The obvious one is the desk phone plugged straight into the wall socket. The less obvious ones are the things nobody thinks about until they are silent:

The trap is that most of these will fail silently. Nothing beeps, nothing flashes; they just stop reporting. That is why the first job on the checklist is an inventory, not a purchase.

The checklist

1. List every socket and every device. Walk the building. Note everything plugged into a phone socket, and every device that "phones home" — alarms, lifts, terminals, intercoms, meters. Photograph labels.
2. Find out what you actually pay for. Your phone bill will list the lines (they may be called WLR, PSTN, analogue, ISDN2e or ISDN30). Many businesses discover lines they forgot existed and have been paying for since a previous tenant.
3. Decide where the voice service goes. For almost every business of 2–500 people the answer is a hosted VoIP system: your numbers move to the cloud, calls run over your broadband, and the handsets (or an app on your mobile) connect over the network. There is no box in the cupboard to maintain.
4. Check the broadband can carry it. A good VoIP call needs roughly 100 kbit/s in each direction with low jitter. Almost any fibre connection is fine; a congested or ageing ADSL line may not be. We test this before we quote, never after.
5. Keep your numbers. Numbers are ported, not lost. Do not cancel the old line yourself — cancel it and the number can go with it. The new provider ports first; the old service is ceased afterwards.
6. Sort the special devices. Alarm, lift and payment kit is handled by the company that maintains it. Give them the date and ask in writing what they will fit. Get the answer before you book the voice migration so both happen in the right order.
7. Plan for power cuts. An old analogue phone kept working when the electricity failed. VoIP does not, unless the router and phone have battery backup. Ofcom requires providers to offer a solution for customers who rely on the line for emergency calls; for a business a small UPS on the router is the usual answer.
8. Train the team for ten minutes. New handsets and apps behave slightly differently — transfers, voicemail, out-of-hours rules. Ten minutes on the day saves a week of grumbling.

What a well-run migration looks like

From the customer's side it is dull, which is the point. Numbers are ported on a chosen day (usually mid-morning, mid-week, so any issue is found while support desks are fully staffed). Handsets have been on desks and tested for a few days beforehand. The old line is ceased a week or two later, once everyone is sure nothing else was hanging off it. The alarm and payment terminal were switched earlier, independently, so nothing depends on everything happening at once.

If a supplier proposes doing all of it on the same afternoon, ask why.

Home users are affected too

The same switch-off applies to home phones. If you or an older relative relies on a landline — especially with a telecare pendant or a phone-line alarm — the provider should be moving you to a digital voice service and must take extra care with vulnerable customers. We wrote about that separately for home users; the short version is that the handset usually plugs into the back of the router instead of the wall.

The honest summary

You do not need the most expensive system, and you do not need it today. You do need to know what is on your lines, and you need a date in the diary well before January. The businesses that find the switch-off painful are the ones who discover their alarm or card machine was on an analogue line the morning after it stopped.

If you would like an engineer to do the inventory with you and tell you plainly what needs to change — and what does not — that is exactly the kind of conversation we are set up for. See our VoIP and landline switch-over page for how we approach it.

Each year the question set is updated and given a name. The current one, Danzell, was published on 13 February 2026 and applies to every assessment account created on or after 26 April 2026. Businesses that already had an assessment account open on that date were given six months to move across, so from late October 2026 everyone is on the new rules.

Most of the changes are tightening rather than new territory. Two of them, though, are now automatic fails — you answer "no" and the assessment stops — and they are the ones catching people out.

Change 1: MFA is mandatory on all cloud services

Previously, multi-factor authentication was required for administrator accounts and strongly expected elsewhere. Under Danzell it is required for every user on every cloud service where the service offers it — Microsoft 365, Google Workspace, Xero, Sage, your CRM, your VoIP portal, your backup console, the lot. Answer "no" for any of them and it is a fail.

Two practical points:

• "Where it is available" is not an escape hatch. Almost every business cloud service offers MFA now; the assessor will expect you to have turned it on, not to argue that it is optional.
• The guidance now explicitly encourages passwordless methods such as passkeys as the preferred approach. They are also the only kind of second factor that a fake login page cannot capture, which we covered in our post on phishing.

Change 2: critical and high-risk updates within 14 days — twice

There are now two separate auto-fail questions on patching:

1. Are operating system and firmware updates rated critical or high-risk installed within 14 days of release?
2. Are application updates rated critical or high-risk installed within 14 days of release?

The 14-day rule itself is not new. What is new is that it is asked as a hard yes/no, twice, and that firmware — routers, firewalls, switches, wireless access points — is called out explicitly. The box in the comms cupboard that nobody has logged into since 2021 is now a certification problem, not just a security one.

It follows that every device and piece of software in scope must still be supported by its vendor. A Windows 10 computer that has not been enrolled for extended updates is unsupported and fails the test outright; our Windows 10 post explains the fix.

Change 3: scope has to be honest and complete

Danzell removes the old character limit on the scope description and requires you to state clearly what is out of scope and why, and which legal entity is being certified. Cloud services are now formally defined and cannot be excluded — if your staff log into it, it is in.

Larger organisations can have individual certificates for each legal entity inside a group scope, which tidies up a long-standing awkwardness for groups of companies.

Change 4: no quiet tidying-up before the Plus audit

For Cyber Essentials Plus (the audited version):

• Your self-assessment answers are locked before testing begins, so they cannot be adjusted once the auditor starts finding things.
• Retests draw a new sample of devices, so fixing only the machines the auditor looked at last time does not work.
• "Point in time" now formally means the date the certificate is issued.

What has not changed

The five control areas are the same: firewalls, secure configuration, user access control, malware protection, and security update management. The scheme still costs a few hundred pounds for the basic certificate (the exact fee depends on your size and the certification body) and a Plus audit on top of that. Certificates still last twelve months.

A short readiness checklist

• MFA on, for everyone, on every cloud service — preferably passkeys or app-based with number matching.
• A list of every device, including firmware on network kit, with an owner and an update process that meets 14 days.
• No unsupported software or operating systems in scope (or a documented, segregated exception that the assessor will accept).
• Local administrator rights removed from day-to-day accounts.
• A written scope: what is in, what is out, why, and which company it is.
• Malware protection and automatic updates verified on every laptop, including the ones that live at home.

Where businesses actually fail

In our experience it is rarely the firewall. It is the three staff who "prefer not to have the app on their personal phone", the accountancy package whose MFA was never switched on because it lives on one person's desktop, the switch that has never had a firmware update, and the two laptops from the old office that still work and are still on Windows 10. Each is a five-minute conversation now and an automatic fail in the assessment.

If you would like a pre-assessment — we go through the Danzell questions with you, fix the obvious gaps and tell you honestly whether you would pass — that is a fixed-price piece of work, and it is far cheaper than a failed assessment and a resubmission. See our managed IT support page or get in touch.

The rule below takes ten minutes to set up and costs less than a takeaway a month. It is the same rule we use for businesses; the numbers are just smaller.

The rule

Keep 3 copies of anything you care about, on 2 different kinds of storage, with 1 copy somewhere else.

• Three copies: the original plus two backups. One backup can fail or be out of date at the exact moment you need it — it happens more than you would think.
• Two kinds of storage: for instance the computer's own drive plus an external drive, or the computer plus a cloud service. Two copies on the same physical drive are one copy with extra steps.
• One off-site: if the house floods, or a burglar takes the laptop and the drive sitting next to it, the copy that survives is the one that was somewhere else — usually a cloud service, sometimes a drive at a relative's house.

Why sync is not backup

This is the misunderstanding that catches most people. OneDrive, Google Drive, iCloud Drive and Dropbox are sync services: they make the same set of files appear on all your devices. That is genuinely useful, and the files are stored on the provider's servers, so a stolen laptop does not lose them. But sync copies mistakes just as faithfully as it copies photos:

• Delete a folder by accident and it is deleted everywhere within seconds.
• Ransomware scrambles your files, and the scrambled versions sync up and replace the good ones.
• A child "tidies" the photo library on the tablet; the tidy-up syncs to the computer.

Most of these services keep a recycle bin or version history for a limited time (typically 30 days), which will save you if you notice quickly. They will not save you if you notice in three months, and they are not designed to restore a whole computer.

A backup, by contrast, is a separate copy that the computer writes to and does not automatically change when you change the original. That is the copy that gives you a way back.

What we actually recommend for a home

Copy 1 — the computer itself

Keep the things you care about in the normal places (Documents, Pictures, Desktop), not scattered across old drives and downloads folders. You cannot back up what you cannot find.

Copy 2 — an external drive with the built-in backup tool

Both Windows and macOS include a perfectly good backup program, and both are switched off until you plug in a drive and say yes.

• Windows: plug in an external drive, open Settings → Update & Security → Backup (Windows 10) or search for File History (Windows 11), and turn it on. It keeps versions of your files as they change, so you can go back to last Tuesday's copy of a document.
• Mac: plug in the drive, and macOS will offer Time Machine. Say yes. It backs up everything, hourly, and restoring a whole Mac from it is a one-screen job.

A 2 TB external drive costs roughly the price of a family cinema trip and is enough for most households. Leave it plugged in if it is a desktop; if it is a laptop, plug it in once a week and let it run while you make dinner. Put a reminder in your phone — this is the step people forget.

Copy 3 — off-site, automatic

For the off-site copy, use a cloud backup service (not a sync service — the distinction above) or, for the more technical, a second drive that lives at another address and is swapped monthly. Cloud backup services quietly copy your files overnight and keep old versions for months or years. The subscription is typically a few pounds a month for unlimited storage from one computer; we can recommend one when we set it up, and we have no commission arrangement with any of them.

If you already pay for Microsoft 365 or Google One, the extra storage that comes with it can serve as the off-site copy for the files that live in OneDrive or Drive — as long as you understand you are relying on that 30-day safety net and keep Copy 2 for anything older.

Phones

Phone photos are the single most-lost category. Turn on iCloud Photos (iPhone) or Google Photos backup (Android) and check it is actually running — open the app and look for the "backed up" tick. Then make sure those photos also reach the computer, so they are included in Copies 2 and 3. A phone backup alone is one copy, on one company's servers, tied to one account you could be locked out of.

Test it, once

A backup nobody has restored from is a hope, not a plan. Once it has been running for a week, pick a file, delete it (or rename it), and get it back from the backup. It takes two minutes and it is the difference between knowing and assuming. Do it again every few months, and after any big change — new computer, new drive, new service.

When you need us

If a drive has already failed, stop using it. Every extra minute a failing drive spins reduces the chance of recovery, and "let me just try one more thing" is how recoverable drives become unrecoverable. Our data recovery service starts with an honest assessment — what is recoverable and what it would cost — before you commit to anything.

And if you would rather someone came and set all of the above up — drive, cloud, phones, the restore test, and a one-page sheet explaining what happens where — that is a single visit, and we will label the drive so you never have to remember which one it is.