The Extended Security Updates Trap

Part 2 ended on a very human instinct. Once you understand that end of support opens a silent, widening security gap and that you can’t move an entire fleet by the deadline, the sensible-sounding move is to keep the patches flowing a little longer and buy time. Microsoft has an answer ready for exactly that instinct: the Extended Security Updates program. It sounds like the responsible middle path — pay a fee, stay patched, deal with the migration later. Read the fine print and a different picture emerges. ESU is a bridge with a toll that climbs, a hard end, and gaps you can fall straight through.

What Extended Security Updates actually are

ESU is a time-boxed patching bridge, not a support renewal, and Microsoft draws the boundaries narrowly:

• Critical-only patches. ESU delivers security updates rated Critical by the Microsoft Security Response Center — nothing else. No new features, no functional or reliability fixes, no customer-requested changes (Microsoft).
• No technical support. ESU does not restore product support. Help is limited to installing and activating the ESU patches themselves, not to the product you’re running (Microsoft).
• A hard three-year cap. ESU is available for a maximum of three years past end of support (Microsoft). There is no Year Four. When the window closes, the paid option is gone and the product is simply unsupported.

Put plainly: you are paying to keep the worst holes closed while the product stands still. Nothing improves. The floor just stops dropping for a little longer.

The price is engineered to push you off

The defining feature of Extended Security Updates pricing is that it rises every year — on purpose, to make renewing more painful than moving.

The clearest published example is the Windows 10 ESU program, where Microsoft states the mechanics plainly: $61 USD per device for Year 1, and the price doubles every consecutive year, for a maximum of three years (Microsoft). Ride all three and a device costs roughly four times as much to keep patched in the final year as in the first.

ESU year (Windows 10 pattern)	Per-device cost
Year 1	$61
Year 2	~$122 (2×)
Year 3	~$244 (4×)

Two details sharpen the curve beyond the headline rate:

• ESU is cumulative. Skip Year 1 and enroll in Year 2 and you owe Year 1 as well — coverage backfills, it does not start fresh (Microsoft). You cannot wait out the cheap early years and buy in late for less.
• It expires. Because the program ends at three years, every year on ESU is a year of runway burned with the migration still ahead of you.

For Windows Server and SQL Server, the mechanism differs but the trajectory is identical: historically the annual ESU cost has been a large share of the full product license, climbing year over year. SQL Server 2016 ESU is billed through Azure Arc on a pay-as-you-go basis (Microsoft), scaling with core count rather than a flat per-device fee — but still climbing, still capped, still cumulative in spirit. The 2016 database reaches end of support on July 14, 2026; already-past versions like SQL Server 2014 (out July 9, 2024) can carry Critical-only patches only to July 8, 2027 before the bridge itself ends.

The escalation is the message. The bridge gets more expensive precisely as the pressure to leave it grows.

The gap most people miss: not everything gets a bridge

Here is the detail that turns ESU from an expensive option into an outright trap for part of the estate. ESU does not exist for every product.

• Windows, Windows Server, and SQL Server have offered ESU programs. For these, buying time is at least possible — at a rising price.
• Office 2016 and Exchange Server 2019 have no ESU program at all. Both reached end of support on the same October 14, 2025 as Windows 10, and for both there is simply no paid extension to buy (Microsoft Product Lifecycle). The software becomes unpatchable in place on the deadline, full stop.

So an organization that mentally files “we’ll just buy ESU for a year” as its universal safety net has, without realizing it, left the office suite and the mail server with no net at all. For those, the supported paths are forward-only: Office moves to Microsoft 365 Apps or Office LTSC 2024; Exchange moves to Exchange Server Subscription Edition or Exchange Online. There is no version of “pay and wait.” Part 8 of this series walks that no-bridge cliff in full; the point to carry now is that ESU coverage is uneven, and assuming it exists where it doesn’t is how teams get caught flat-footed.

Why it’s a trap, not a deal

ESU is not a scam. It is a legitimate and sometimes necessary bridge. It becomes a trap the moment it is treated as a destination instead of a countdown, and the logic that catches teams out is worth spelling out:

• The bill compounds while the value flatlines. Each renewal costs more and buys nothing new — no features, no support, no reduction in technical debt. You are paying an increasing price for the same diminishing thing.
• The work doesn’t shrink. Paying for ESU does not make the eventual migration smaller. The pinned applications, the stored procedures, the undocumented logic — all of it is still there in Year 3, except now with less runway and a hard wall behind it.
• The risk keeps accruing. Critical-only patching leaves everything below “Critical” unaddressed, and an out-of-support system in a regulated path stays a compliance finding the whole time. ESU narrows the exposure; it does not remove it.
• There’s no escape hatch at the end. When the three years are up, the deferred choice is the same choice — now made under more pressure, with more accrued risk, at the top of the cost curve.

The honest framing is the cost of standing still. ESU doesn’t save money against modernizing; it spreads and inflates the cost of not modernizing, and hands you a fixed deadline to migrate anyway.

When ESU is the right call

There is a legitimate use, and it deserves to be named: buying the time to migrate properly. A single year of coverage that lets a careful, slice-by-slice migration run to completion — instead of a panicked big-bang cutover the week support ends — is money well spent. Modernizing off an out-of-support product is not one risky switch; it is a sequence of small, reversible steps, and those steps can run during an ESU bridge year, each modern slice proven to behave identically to the legacy before it carries live traffic. Used that way, ESU is the runway for the move. The trap is renewing into Year 2 and Year 3 with no migration underway — because the program was priced assuming you would. If you want to put real numbers against your own estate, a 30-minute discovery call sizes the rising ESU bill against a planned move, on evidence rather than a sales pitch.

Where this leads

This part read the fine print on buying time: Extended Security Updates rent Critical-only patches at a price built to climb, capped at three years, cumulative, and — for Office and Exchange — not offered at all. But even for the products that do get a bridge, even with ESU bought and the platform patched, the thing that actually strands the estate hasn’t moved an inch. That’s because the platform was never really the blocker. Part 4, Why “Just Upgrade” Doesn’t Fix It, turns to the reflex on the other side — swapping the old operating system or database for the current one — and shows why it fails for the same underlying reason: the problem was never the platform.