Windows 10 End of Support and ESU: Protecting HMIs, SCADA Servers and OT Systems

Frequently asked questions

• Is disconnecting legacy Windows machines (Windows 10/7/XP) from the network enough?

  Air gapping reduces exposure, but does not eliminate risk. Removable media, maintenance laptops and other “temporary” connections can still reintroduce malware. For OT, isolation should be paired with layered controls and continuous monitoring to maintain defensibility.

• Is upgrading Windows 10 to Windows 11 a viable option to remain compliant?

  It depends on whether operational applications and processes support the newer operating system. When they do, upgrading is the most direct path to maintaining compliance and security. However, in many OT environments, critical applications or equipment are tightly coupled to the existing OS, making upgrades difficult, costly or operationally risky.

  In particular, such upgrades may:

  • Break vendor software.
  • Violate validation, for example, with GxP, FDA 21 CFR Part 11, and others.
  • Invalidate support contracts.
  • Introduce operational or safety risk.

  In these cases, organizations must continue running legacy systems until a full platform or equipment upgrade is feasible. That’s why secure operation for unsupported operating systems remains essential in OT: The cost and risk usually lie not in the computer itself but in the industrial equipment it controls.

• What trends are emerging with Linux and other embedded OSs on devices such as PLCs and RTUs?

  There is increased adoption of Linux-based and customized embedded operating systems across PLCs, RTUs, gateways, HMIs and other industrial devices. These platforms are becoming more common as vendors modernize hardware and introduce more connectivity, computing power and automation. However, these systems still face long lifecycles, limited patch windows, vendor-controlled update schedules and risk tied to firmware and supply chain. The needs remain the same as with legacy Windows systems: Stay ahead of emerging threats, apply strong hardening practices and ensure these devices are protected even when patching or updates are limited.

• Does the same cyber protection approach for securing legacy OT systems apply to rail, aviation and maritime environments?

  Yes. OT systems across rail, aviation, maritime and energy share common constraints. So, the same core principles for securing legacy OT systems (layered controls, segmentation, continuous monitoring and resilience planning) apply.

  In the maritime sector specifically, cyber requirements are now formalized through IMO Resolution MSC.428(98), which mandates incorporating cyber risk management into safety management systems, and through IACS UR E26/E27, which establish cyber resilience requirements for newbuild vessels contracted on or after July 1, 2024.

• How should Microsoft Extended Security Updates (ESU) be factored into a long-term OT security strategy?

  ESUs provide temporary access to critical security patches after the end of support. However, they are time bound (typically limited to three years), the cost increases significantly each year, and they only address OS-level vulnerabilities and not the broader architectural risks or the vulnerabilities within the industrial applications themselves. In OT environments, ESUs should be viewed as a "bridge" to buy time for a migration, not a replacement for layered controls like segmentation, allowlisting and robust resilience planning.

• What compliance standards apply to Windows 10 end of support in OT environments?

  Organizations running Windows 10 past end of support in OT environments should evaluate impact against IEC 62443 (industrial cybersecurity), FDA 21 CFR Part 11 (validated systems), NERC CIP (critical infrastructure) and ISA-95 (enterprise-control integration) — the applicable standards depend on industry and region.