Q4 2026: Microsoft's October Deadline & Closing the Year Securely

October 13: Microsoft's End-of-Support Day

Microsoft's October security release is the last one for a number of products still in daily use across small and mid-sized businesses. Windows 10 officially lost standard support in October 2025, and the first year of paid Extended Security Updates (ESU) for commercial devices ends on the same day as several other products.

Nothing stops working on October 14. Computers will boot, files will open, and applications will run. The problem is quieter than that: every vulnerability discovered after this date stays open on unsupported systems, and attackers know exactly which ones to look for. Unsupported software is also increasingly flagged during cyber insurance renewals and compliance audits.

ESU is a bridge, not a destination. For most businesses, the better investment is replacing or upgrading the remaining Windows 10 machines now rather than paying rising annual fees on hardware that must be retired by 2028 regardless.

Year-End Fraud: Why the Holidays Are Peak Season

Every year, the final weeks of the calendar bring the same combination of conditions attackers love: staff on vacation, year-end invoices being paid in a rush, holiday shipping at its peak, and approvals being handled by whoever happens to be in the office. None of these attacks are new. They simply work better in December.

Watch for these patterns in particular:

• Vendor banking changes. An email from a "supplier" announcing new banking details before a year-end payment. This is the single most expensive fraud pattern we see. Always confirm by phone using a number you already have on file.
• Gift card requests from "the boss." A short, friendly message asking for gift cards for staff or clients, usually with a request to keep it quiet. Leadership will never ask for this by text or email.
• Fake delivery notices. Texts or emails claiming a package could not be delivered, with a link to "reschedule." With so many legitimate deliveries in December, these are easy to click without thinking.
• Revealing out-of-office replies. Auto-replies that list your exact return date, who is covering, and their direct contact details hand attackers a ready-made script for impersonation.

The defence is the same one we covered last quarter: slow down, verify through a separate channel, and never let urgency override your approval process. An attacker's best tool is the pressure to act before anyone checks.

Planning for 2027

As budgets for next year take shape, a few developments are worth factoring in.

• Canada's cyber law is now on the books. Bill C-8, the Critical Cyber Systems Protection Act, received Royal Assent on June 15, 2026. It directly covers federally regulated sectors such as banking, telecommunications, energy, and transportation, with obligations phasing in over time. Smaller businesses that supply those sectors should expect more detailed security questionnaires from their customers.
• Hardware refresh budgets. Any device that cannot run Windows 11 should be in the 2027 budget. Planning the replacement over several months is far less disruptive, and less expensive, than replacing machines in a hurry after a failure or audit finding.
• Cyber insurance renewals. Insurers continue to ask sharper questions about MFA, endpoint detection, backups, and unsupported systems. Having answers documented before your renewal date avoids surprises in coverage or premiums.
• AI governance. AI tools are now part of everyday work. A short, written policy on which tools are approved and what data may be shared with them is quickly becoming a standard expectation from clients, auditors, and insurers alike.

What We're Doing for Managed Clients This Quarter

If CG Technologies manages your environment, here is what is already underway on your behalf.

• End-of-support device reporting. Using our NinjaOne monitoring platform, we are identifying every managed device running Windows 10, Windows 11 version 24H2, Office 2021, or Windows Server 2012 R2. You will receive a clear list and a recommended path for each device.
• Windows 11 feature updates. Eligible Windows 11 devices are being moved to the current supported version on a scheduled basis, outside business hours where possible.
• Pre-holiday backup verification. Before the holiday shutdown, we will be running restore tests on client backups to confirm data can actually be recovered, not simply that a backup job reported success.
• 24/7 coverage through the holidays. Our Microsoft Defender for Business and Huntress MDR stack continues around the clock, with a security operations centre monitoring endpoints while your office is closed.
• 2027 technology planning sessions. We are booking planning meetings through November and December to map out hardware replacement, licensing, and security priorities for the year ahead.

Your Holiday Shutdown Checklist

Before leaving for the break, take ten minutes to run through these steps. They prevent the most common problems we see in the first week of January.