Extended Security Updates (ESU): What They Cost and Why They're a Trap

When a Microsoft product reaches end of support, the sales conversation that follows is rarely about migrating — it is about Extended Security Updates. ESU is the paid program that keeps an out-of-support product patched for a while longer, and on the surface it sounds like the safe, low-effort choice: pay a fee, keep getting security updates, deal with the migration later. The pricing is built to make that feel reasonable in Year One and painful by Year Three. Understanding how it works is the difference between buying time and walking into a bill that compounds.

What ESU actually is

Extended Security Updates are a time-boxed bridge, not a support contract. The boundaries are set by Microsoft and they are narrow:

• Critical-only patches. ESUs deliver only security updates rated Critical by the Microsoft Security Response Center (MSRC). No new features, no functional improvements, no customer-requested fixes (Microsoft).
• No technical support. ESU does not include general product support. Help is limited to issues with installing and activating the updates themselves — not with the product you are running (Microsoft).
• A hard three-year cap. ESUs are available for a maximum of three years past the end-of-support date (Microsoft). There is no Year Four. When the window closes, the paid option is gone and the product is simply unsupported.

In other words, you are paying to keep the worst holes closed while the product itself stands still. Nothing improves; the floor just stops dropping for a little longer.

How the pricing is engineered to escalate

The defining feature of ESU pricing is that it rises every year — deliberately, to push you toward migrating rather than renewing.

The clearest published example is the Windows 10 ESU program, where Microsoft states the price plainly: 61 USD per device for Year One, and the price doubles every consecutive year, for a maximum of three years (Microsoft). A device costs roughly four times as much to keep patched in Year Three as it did in Year One.

ESU year	Relative cost (Windows 10 pattern)
Year 1	baseline (e.g. 61 USD/device)
Year 2	2× Year 1
Year 3	4× Year 1

For Windows Server and SQL Server, the mechanism differs but the trajectory is the same: historically the annual cost has been a large share of the full product license price, escalating year over year. SQL Server 2016 ESUs in particular are billed through Azure Arc on a pay-as-you-go basis (Microsoft), so the cost scales with your core count rather than a flat per-device fee — but it still climbs.

Two details make the escalation sharper than the headline rate:

• ESUs are cumulative. If you skip Year One and try to enroll in Year Two, you pay for Year One as well — coverage backfills, it does not start fresh (Microsoft, Windows 10 ESU). You cannot wait out the expensive early years cheaply.
• They expire. Because the program ends at three years, every year you spend on ESU is a year of runway gone with the migration still ahead.

Why it’s a trap, not a deal

ESU is not a scam — it is a legitimate and sometimes necessary bridge. It becomes a trap when it is treated as a destination instead of a countdown. Here is the logic that catches teams out:

• The bill compounds while the value flatlines. Each renewal costs more, and you get nothing new for it — no features, no support, no reduction in technical debt. You are buying the same diminishing thing at an increasing price.
• The work doesn’t shrink. Paying for ESU does not make the eventual migration smaller or easier. The stored procedures, the integration jobs, the undocumented logic — all of it is still there in Year Three, except now you have less time and a hard deadline.
• The risk keeps accruing underneath. Critical-only patching leaves everything below “Critical” unaddressed, and an out-of-support system in a regulated path stays a compliance finding the whole time (PCI DSS, SOC 2, HIPAA all expect patchable systems). ESU narrows the exposure; it does not remove it.
• There is no escape hatch at the end. When the three years are up, the choice you deferred is the same choice — now made under more pressure, with more accumulated risk, and at the top of the cost curve.

The honest framing is the cost of standing still. ESU does not save money against modernizing; it spreads and inflates the cost of not modernizing, and it hands you a fixed deadline to migrate anyway. The Legacy Cost Calculator is built to put both sides of that comparison on one page — the rising ESU and maintenance bill against the cost of a planned move.

When ESU is the right call

There is a legitimate use for ESU, and we’ll name it: buying the time to migrate properly. A single year of coverage that lets you run a careful, slice-by-slice migration — instead of a panicked big-bang cutover the week support ends — is money well spent. The trap is renewing into Year Two and Year Three with no migration underway, because the program was designed assuming you would. Use ESU as the runway for the move, not as a substitute for it.

The way off

Modernizing off an out-of-support product is not a single risky cutover — it is a sequence of small, reversible steps that can run during an ESU bridge year. A strangler facade lets the legacy and modernized paths run side by side; we move one slice of behavior at a time, and before any slice carries live traffic, we prove it behaves identically to the legacy, reconciled record by record. AI-accelerated discovery captures what the system actually does — including the logic nobody documented — under senior-engineer review, so the migration finishes before the ESU clock runs out rather than racing it. For a database specifically, the SQL Server migration guide walks the options in depth.

Where to start

The decision is an economic one, so start by sizing it: map your estate against the support dates with the Software EOL Checker, weigh the rising ESU bill with the Legacy Cost Calculator, and take a discovery call to turn the comparison into a plan — on evidence, not a sales pitch. Reach the team at sales@modernlift.ai.