Recently, Microsoft has been taking many steps to improve the security of Windows and other Microsoft products as a whole. For example, the tech giant recently announced a big change to Entra ID authentication with default passkeys. Plus, it is also introducing AI-enhanced Windows security updates as it highlighted the new update strategy.

Following that, Microsoft has announced that it is preparing to strengthen the security of Windows volume activation too by introducing a new hardware-backed trust model for its Key Management Service (KMS). The enhancement, called KMS Hardware-Secured, will use Trusted Platform Module (TPM)-based attestation to verify that KMS hosts are running on trusted hardware before they can activate Windows devices.

The announcement marks the latest step in Microsoft’s efforts to modernise Windows activation as companies face growing challenges around device identity, software licensing, and the misuse of activation procedures.

KMS, if you are not already aware, is Microsoft’s volume activation technology designed for organisations that need to activate large numbers of Windows devices across a network. Instead of each device connecting individually to Microsoft’s activation servers, a KMS host within the enterprise environment handles activation requests from eligible client devices, thus making deployment easier in such settings.

According to Microsoft, the new KMS Hardware-Secured capability addresses risks from fake or cloned KMS servers, which attackers have used to bypass activation controls. By introducing TPM attestation, Microsoft aims to ensure that only verified KMS hosts running on uncompromised hardware can issue Windows activation licenses.

For anyone who doesn’t know, perhaps, TPM is a dedicated hardware security component that provides a hardware root of trust. TPM basically enables devices to generate and protect cryptographic keys that help ensure the integrity of the platform. Through TPM-based attestation, a device can produce cryptographic proof that it is running on trusted hardware and has not been tampered with. Many Windows security features like Windows Hello, BitLocker, System Guard, and more, rely on TPM.

Under the new activation model, a KMS host first uses TPM-backed attestation to establish its hardware identity, and then Microsoft verifies this attestation before allowing the server to activate Windows devices. The TPM also confirms the integrity of the platform, helping ensure the host has not been compromised. Once verification is complete, the KMS host can securely process activation requests from Windows devices within the organisation.

Hence, businesses using KMS are thus being encouraged to begin assessing their environments ahead of the transition. For virtualised KMS hosts, Microsoft adds that guidance will be provided in the future.

Beginning next month, in August 2026, Windows Server 2025 will introduce readiness messaging to help admins determine whether their KMS hosts meet the new hardware-based security requirements. Status information will be available through the slmgr /dlv command. An eligible device will say “This device is eligible to serve as a KMS host with hardware-based security,” while a non-eligible one will show “This device does not meet the requirements for using KMS host with hardware-based security.”

Finally, Microsoft has confirmed that TPM attestation will become mandatory for KMS Hardware-Secured activation with the next Windows Server Long-Term Servicing Channel (LTSC) release, which likely means Windows Server 2028. As such, the company recommends to begin preparing for the transition process early on. You may find more details on the official blog post here on Microsoft’s Tech Community website.

According to new Lansweeper data, as many as 16.9% of Windows client devices, which equates roughly to a total of one in six overall, still runs Windows 10.

While Windows 11 now accounts for 78.8% of installs and Windows 10’s market share has fallen from about 50% in mid-2025, Lansweeper warns the migration is starting to slow down, implying the remaining Windows 10 market share could show no signs of going anywhere.

And that’s a worrying state of affairs, because the average Windows 10 device has around 3x as many active common vulnerabilities and exposures (CVEs) as a Windows 11 device (1,930 vs 652).

Additionally, around two-thirds of the active CVEs on Windows 10 are rated high or critical, and the rate of vulnerabilities known to be exploitable is around 1.7x higher than on Windows 11.

The report notes that Microsoft’s Extended Security Updates (ESU) program buys some breathing room, protecting consumers until October 2027 and paying commercial customers until October 2028.

Healthcare and pharmaceuticals (23%), consumer and retails (23%) and manufacturing (18%) are among the industries most likely to still be running Windows 10, with SMBs (21.4%) more likely to be running the outgoing OS compared with enterprises (16.6%).

Lansweeper also revealed that technical limitations aren’t necessarily to blame, with only 2.8% of the Windows 10 devices it analysed failing Windows 11’s hardware requirements.

More broadly, the report warns that nearly one-fifth (18.7%) of the entire Windows landscape it monitors runs end-of-life operating systems like Windows 7, Windows 8.1 and Windows XP.

The report concludes that, while many users have now upgraded to the latest OS, the remaining estate is smaller but disproportionately more difficult, expensive or risky to update. But with ESU programs soon running to an end, deeper considerations into leaving Windows 10 should be made.

Microsoft has quietly extended its free Windows 10 Extended Security Updates (ESU) program for consumers by an additional year, allowing enrolled devices to continue receiving security updates until October 12, 2027.

The change was made without a formal announcement and instead appeared in updates to Microsoft’s Windows 10 ESU documentation and as an “Editor’s note” to a Windows Experience Blog post.

“Editor’s note – June 25, 2026 – This post has been updated to reflect that the Windows 10 Extended Security Updates (ESU) program for personal use devices is being provided for an additional year, with coverage now available through Oct. 12, 2027,” reads the updated blog post.

“This extension provides customers with more time to transition to a new Windows 11 PC while continuing to receive critical security updates.”

On October 14, 2025, Windows 10 reached the end of support, and Microsoft no longer provides technical support, feature updates, or security updates for the operating system unless you are running a Windows LTSC version.

For those who are unable to upgrade to Windows 11, Microsoft originally offered consumers an extra year of security updates if they enrolled in a free extended security updates (ESUs) program that would expire on October 12, 2026.

Enterprise customers could also enrol in the ESU program for up to three years, bringing the total cost per device to $427 over that period.

With today’s quiet update, Microsoft has now extended the free consumer ESU program to October 12, 2027, giving users an additional year to upgrade to a newer operating system.

When asked why the free ESU program was extended, Microsoft shared the following statement:

“We understand that moving to a new PC can take time. As part of our ongoing commitment to helping customers stay secure during the transition, the Windows 10 Extended Security Updates (ESU) program for personal devices is being provided for an additional year,” explained Microsoft.

“Coverage will now be available through October 12, 2027. This gives customers more time and flexibility to find the best PC for their needs while keeping them protected.”

Consumers can continue to receive extended security for free using one of these methods:

Most businesses believe they are well-prepared to face cyberattacks, but the number of successful breaches in the last year alone paints a different picture.

Last week, NordLayer released a new report, called “Why Browser Security Can’t Wait: Web-based Threat Report 2026.” In it, the company states that while 73% of organisations claim to be prepared for web-based attacks and are confident in their solutions, 82% experienced some form of web-based attack.

The paper is based on an analysis of 504 “highest rated and most reviewed work applications”, an analysis of data stolen from various info-stealers, and a survey of 405 US cybersecurity and IT professionals.

NordLayer stresses that coverage is “modest and uneven”, with data loss prevention tools (DLP) leading at just 53%, followed by other security controls. Nearly all IT professionals reported that their organisations are concerned about web-based threats (98%), and most expect escalation. In fact, 81% expect greater sophistication and 73% believe there will be more incidents in the coming years.

“There’s a clear gap between recognising the threat and knowing how to address it,” says Buinovskis. “Concern is high, but awareness of which controls actually solve browser-specific risks is low. Much of the initial confidence most likely comes from having general security controls in place, yet they rarely adequately cover risks in the browser.”

The researchers also stressed that 100% of the tested applications were browser-accessible, and almost four in five (78.8%) were browser-only. At the same time, malware was able to harvest 1.8 million credentials and 68.8 billion cookies last year.

“Hackers don’t hack anymore, they just log in,” says Buinovskis. “Stolen cookies and credentials grant immediate access without raising alarm bells — a login looks legitimate. It’s low risk, high reward, and as reliance on web-based SaaS grows, so does the value of stolen data. Attackers will keep exploiting this until organisations secure the browser as a critical boundary.”