Microsoft has warned that devices running unsupported versions of Windows may stop receiving security updates after a planned Windows Update certificate rotation next year. For businesses still relying on legacy Windows installations, the announcement is a practical reminder that unsupported endpoints can turn into unmanaged security risks, even when they appear to be functioning normally.

What happened

According to Microsoft's announcement, systems running outdated and unsupported Windows versions may no longer be able to receive updates through Windows Update after the company's certificate rotation next year. Certificate changes are part of how update services verify trust and deliver software securely, but older operating systems that are no longer supported may not have the required compatibility to continue receiving updates.

The key point is that this affects unsupported Windows versions. Microsoft is not announcing that currently supported Windows releases will broadly lose security protection. Instead, the warning highlights an additional operational consequence for organisations that have delayed OS upgrades beyond the supported lifecycle.

Why it matters for European businesses

For SMEs and larger organisations alike, endpoint security depends heavily on timely patching. If a device can no longer receive security updates, its exposure to known vulnerabilities increases over time. That can raise the risk of malware infections, ransomware incidents, phishing-related compromise and lateral movement inside corporate networks.

This matters particularly for European businesses with mixed IT estates, older line-of-business applications or branch-office devices that are easy to overlook. In many companies, legacy PCs remain in use because they still support specialist software, warehouse equipment, point-of-sale systems or internal operational tools. A certificate rotation does not create the underlying problem by itself, but it can expose systems that are already outside support and therefore outside normal security maintenance.

There is also a compliance and governance angle. Businesses operating under stricter customer security requirements, cyber insurance conditions or sector-specific controls may find it harder to justify unsupported endpoints in production environments. Where security frameworks require reasonable patch management and supported software, outdated Windows devices can become a clear audit concern.

Who may be affected

• SMEs with older PCs that have not been upgraded to currently supported Windows versions.
• Organisations using legacy business software that depends on older Windows environments.
• Retail, logistics and industrial businesses with specialist terminals, kiosks or operational devices that are updated less frequently.
• IT teams managing distributed endpoints across multiple sites, subsidiaries or remote workers.
• Regulated or security-sensitive businesses that need stronger evidence of patching and supported infrastructure.

What companies should consider

• Identify unsupported Windows devices across the business, including office PCs, remote laptops, virtual machines and specialist devices.
• Confirm support status for each Windows version in use rather than assuming that a functioning device is still eligible for security updates.
• Review upgrade plans now for endpoints that cannot move to a supported release easily, especially where hardware replacement may be needed.
• Check business-critical applications for compatibility with supported Windows versions to avoid last-minute operational disruption.
• Segment or isolate legacy systems that cannot yet be replaced, reducing their exposure to the wider network and internet where possible.
• Update asset management and patch policies so unsupported operating systems are flagged as a business risk, not only an IT maintenance issue.
• Work with IT or managed service providers to plan remediation before the certificate rotation creates a hard update delivery problem.

For many businesses, the practical message is straightforward: if a Windows device is already outside support, the time to deal with it is before update delivery becomes another failure point. Companies that depend on legacy systems should treat this as a prompt to review endpoint inventory, upgrade roadmaps and compensating security controls.