With the end of security updates for Windows 10 imminent, it’s a critical time for businesses to address a major security risk: remote employees still using this operating system. Despite the deadline, as at August 2025, it is believed that Windows 10 still powers a significant 42% of all desktop PCs.

The reasons for not upgrading typically fall into three categories:

1. Incompatible Hardware: The computer doesn’t meet the minimum hardware requirements for Windows 11.
2. User Resistance: The user simply doesn’t want to upgrade, often due to privacy concerns with Windows 11’s increased data collection and the requirement for a Microsoft account.
3. Lack of Knowledge: The user isn’t sure how or why to perform the upgrade.

While personal users can choose to accept the security risks on their home PCs, the situation is different for remote employees. When any employee uses their personal, unsupported Windows 10 computer to access company resources, it creates a significant security vulnerability for the business.

Why would Windows 10 be problem for businesses?

Allowing an employee to work on an outdated, unsupported PC is a serious risk. Even if they’re only connecting to a remote server, their login credentials and connection details could be exposed to a hacker who gains access to their machine. This could then allow that hacker to breach the company’s network.

The risk is even greater if the employee is downloading or working with business files directly on their Windows 10 PC. After the support deadline, any unpatched vulnerability on that machine could be exploited, potentially giving an attacker direct access to sensitive company data.

Forcing an employee to upgrade their personal PC can be a difficult conversation, but it’s essential for protecting your business. The potential cost of a data breach far outweighs the awkwardness of that conversation, or the cost of providing company-owned equipment that does meet specification to upgrade to the latest standards.

It’s crucial for companies to have clear policies and procedures for handling remote work to prevent these security gaps.