End of windows 10 support signal urgent action needed from UK organisations as cyberattacks continue to rise
Recent breaches at major UK retailers, combined with the approaching end of life of Windows 10, highlights a critical moment for IT resilience planning
The recent wave of cyberattacks targeting major UK retailers has highlighted the growing security risks associated with organisations running outdated systems and applications and maintaining weak identity verification protocols. These incidents—particularly those involving Marks & Spencer and the Co-Op—have starkly exposed how vulnerable legacy infrastructure and insufficient access controls can be.
In both cases, attackers successfully posed as legitimate employees and manipulated IT help desks into resetting internal passwords, ultimately gaining access to critical systems. The breaches led to serious operational disruption and substantial financial consequences, underscoring the urgent need for organisations to eliminate all areas of potential risks in line with today’s threat landscape.
With the end of Windows 10 support fast approaching, on 14th October 2025, these events serve as a timely warning: continuing to rely on unsupported operating systems not only increases exposure to such attacks but also reflects a broader gap in cyber resilience that organisations must urgently address.
“These attacks are a stark reminder that security breaches often begin with people and their lack of regular training’,” said Roy Charman, CTO Infrastructure at Espria. “When outdated systems are involved, it compounds the problem. Without security updates, patches and support, any known vulnerabilities remain wide open to exploitation.”
Recent data shows that 52% of UK businesses are still operating on Windows 10. After Microsoft withdraws all support in October, these systems will no longer receive security updates or patches—leaving organisations increasingly vulnerable to threats and long-term cyber risk.
“The real concern is not just the deadline—it’s the lack of preparedness,” continued Charman. “Many organisations have yet to assess which of their devices can be upgraded, which need replacing, and what the rollout timeline should look like. Delaying that process leaves very little room to act effectively later.”
“We’re not just talking about technology upgrades; we’re talking about safeguarding day-to-day operations, customer data, and organisational resilience,” he added. “This is a window of opportunity to strengthen security across the board—not just by moving to a supported OS, but by re-evaluating the basics, like password policies, help desk verification protocols, and device hygiene.”
Security experts at Espria advise organisations to take the following steps without delay:
- Audit all devices still running Windows 10 to assess compatibility for upgrade
- Develop a structured migration plan to Windows 11, prioritising systems that handle sensitive data or critical operations
- Strengthen help desk protocols and identity verification processes to reduce the risk of social engineering attacks
- Ensure endpoint protection tools are fully deployed, updated, and aligned with current threat landscapes
With Microsoft’s support deadline now just five months away, organisations are being urged to make the transition a strategic priority.
Charman concluded, “These incidents make one thing clear: attackers aren’t relying on sophisticated hacks—they’re exploiting basic oversights in process and system maintenance, continuing to run Windows 10 past its support deadline isn’t just a technical risk—it’s an open invitation to be targeted next.”
You may be interested in
Critical PHP vulnerabilities: do you know who owns the fix?
When websites and applications sit with different teams and suppliers, the first challenge is knowing who needs to act. Critical vulnerabilities have been disclosed affecting PHP, a technology widely used across websites, web applications and other software products. The technical advice is clear: identify affected systems and apply the available updates. But for many organisations, the first challenge is understanding where PHP is being used, who manages those systems and who is responsible for taking action. To help you identify potential exposure, we have created a PHP Security Checker to determine whether your systems have…
Beyond the Filing Cabinet: What Document Management Actually Saves You
Document Management for Small Offices with DocuWare For many small offices, document management still means a filing cabinet, a shared drive with inconsistent folder names, and a lot of time spent searching for the one contract or invoice somebody needs right now. DocuWare replaces that with a structured, searchable system that sits behind your everyday paperwork. What does DocuWare mean in practice? Giving Office Managers time back For an Office Manager who is often the person holding the whole administrative process together, this is time back. Fewer interruptions to find a document for a colleague,…
Copilot vs. Claude
Why Microsoft 365 Copilot fits every day work A plain-English guide for people trying AI at work: what Copilot does, how it differs from a separate assistant such as Claude and where to start. The short answer Claude is a separate AI workspace. Copilot sits inside the Microsoft apps many teams already use and can work with the emails, files and meetings each person is allowed to access. A separate assistant helps when: Copilot helps when: – You need help creating or developing content from scratch. – The task is focused research, reasoning or code….
Microsoft is changing Copilot billing. Here’s how to stay in control of AI costs
From 1 December 2026, new Microsoft 365 Copilot Business purchases through CSP will come with usage-based billing already configured. At first glance, that might sound like another variable cost for IT and finance teams to manage. But it also gives businesses a practical way to access the next generation of Copilot experiences while retaining control over who can use them, how much they can spend and where that money goes. This matters because Copilot is changing. New experiences such as Copilot Cowork are designed to carry out larger, multi-step pieces of work. That creates more…
Phishing just got personal
AI-powered phishing attacks are becoming harder to detect, with increasingly sophisticated emails bypassing traditional security controls. As a result, organisations are placing greater focus on Human Risk Management, recognising employee behaviour as a measurable cybersecurity risk. SecureLearn, powered by KnowBe4 and fully managed by Espria, helps businesses reduce human risk through continuous security awareness training, phishing simulations, targeted coaching, and board-ready reporting that demonstrates improvement over time.
The Hidden Environmental Cost of Office Printing
Most offices know that reducing paper is good for the environment, but few have visibility over what their printing actually costs in resources: energy, paper, and consumables. A managed print service brings sustainable office printing into focus by measuring what is actually happening, rather than estimating it. Every printer left on standby overnight, every unnecessary colour print, and every cartridge thrown away with usable toner left inside adds up. For a business printing several thousand pages a month, the difference between an efficient and inefficient setup can be significant, both in cost and in environmental…