Loading story…
Windows 11 adoption has accelerated to roughly three-quarters of the desktop Windows install base, while Windows 10 usage has fallen sharply following Microsoft’s decision to end support for the older OS. Reporting citing StatCounter data puts Windows 11 at ~72.8% share versus ~26.3% for Windows 10, with the shift attributed to a mix of PC refresh cycles and users moving off an unsupported platform. The same coverage notes that Windows 11’s stricter hardware requirements and its push toward Microsoft-account-based setup have been persistent friction points, driving some users to seek workarounds that Microsoft has increasingly tried to block.
Separately, ongoing debate about Windows privacy has continued to focus on Microsoft’s collection of diagnostic data (telemetry) from Windows PCs. Commentary on the issue argues that claims of “spying” are often made without evidence, and points to the availability of network monitoring and inspection tools that allow users to review what telemetry is transmitted. The discussion also highlights that Microsoft’s telemetry practices have been subject to scrutiny by government privacy regulators (particularly in the EU), keeping telemetry and data-handling transparency as a recurring enterprise risk consideration alongside OS lifecycle and upgrade planning.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
StatCounter estimated that Windows 11 had grown to 72.78% of desktop PCs worldwide, while Windows 10 had fallen to 26.27%, signaling a major late-stage shift in adoption.
Microsoft introduced the Diagnostic Data Viewer in 2018, giving Windows users a way to inspect the diagnostic data their devices send to Microsoft.
Microsoft promised to address some of the most frustrating Windows 11 issues highlighted by users, though the article says the effectiveness of those promised fixes remains unclear.
Windows 11 updates were associated with a series of reliability problems, including BitLocker recovery prompts that could lead to data loss, WinRE control issues, and boot failures after security updates.
Microsoft took steps to make bypasses for Microsoft-account-based Windows 11 setup more difficult, reinforcing complaints from some users about reduced control over installation and configuration.
During the multi-year Windows 10 to Windows 11 transition, adoption was hindered by Windows 11's stricter hardware requirements and Microsoft's push for Microsoft-account-based setup, which some users tried to bypass.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcezdnet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft is reportedly shifting Windows 11 engineering toward improving **performance, reliability, and overall user experience** in an effort to rebuild trust after ongoing complaints about buggy updates and UI issues. Reporting cites an internal focus on “**swarming**” to address core problems, following high-visibility failures such as **boot issues after a January 2026 security update** and prior updates that disrupted recovery and reinstall workflows. In parallel, user-facing friction around Windows 11’s **TPM 2.0** hardware requirement continues to drive “unsupported” upgrade behavior. Guidance circulated on how to bypass Microsoft’s compatibility checks to install Windows 11 on otherwise capable Windows 10-era systems that lack TPM 2.0, framed against Microsoft’s end of Windows 10 support and upgrade prompts encouraging users to buy new hardware; the article also reiterates TPM’s role as a security component for protecting keys and mitigating certain risks.
Jun 29, 2026
Windows 11 has introduced several significant changes that impact both enterprise security and digital forensics, particularly as organizations prepare for the end of Windows 10 support in October 2025. Despite Windows 11 being available for several years, enterprise adoption has lagged, with many organizations still relying on Windows 10 and even Windows 7, according to data from Kaspersky’s Global Emergency Response Team. As Windows 10 reaches end-of-life, a shift toward Windows 11 is expected, which will bring new challenges and opportunities for incident response teams. One of the most notable new features in Windows 11 is Recall, an AI-powered tool that continuously takes screenshots of the user’s display, analyzes them locally, and stores extracted information in a searchable database. This feature, available broadly since May 2025 on ARM-based systems with dedicated NPUs, has sparked controversy due to its privacy implications and the potential forensic value of its artifacts. Recall’s database could provide investigators with a detailed timeline of user activity, but it also raises concerns about the security and retention of sensitive information. In parallel, Microsoft has expanded the capabilities of Copilot, its AI assistant, within Windows 11. Copilot can now link to both Microsoft and Google accounts, allowing users to access files, emails, and calendar data from services like OneDrive, Outlook, Google Drive, Gmail, and Google Calendar directly through the Windows interface. This integration, currently available to Windows 11 Insiders, enables users to query Copilot for specific information across multiple platforms, such as retrieving contact details or locating recent documents. The process involves connecting accounts through the Copilot app’s settings, after which the AI can search and retrieve data as requested. These advancements in AI-driven features not only enhance user productivity but also introduce new vectors for data exposure and complicate the forensic landscape. Security professionals must now account for the presence of AI-generated artifacts and the expanded data access capabilities when conducting investigations or assessing organizational risk. The combination of Recall’s comprehensive activity logging and Copilot’s cross-platform data access underscores the need for updated security policies and forensic methodologies tailored to Windows 11’s evolving ecosystem. As organizations transition to Windows 11, understanding these features and their implications will be critical for maintaining robust security postures and effective incident response.
Jul 12, 2026
Enterprise fleets still running Windows 10 are carrying significantly higher security risk than Windows 11 systems after Microsoft ended support for Windows 10 on 14 October 2025. Data cited from Lansweeper shows Windows 10 still accounts for **16.9%** of Windows client devices, while Windows 11 has reached **78.8%** adoption, yet Windows 10 endpoints average **1,903 active CVEs** per device compared with **652** on Windows 11. About **66.6%** of Windows 10 vulnerabilities are rated high or critical, and **2.4%** are known to be actively exploited, with exploitability reported as **1.7 times higher** than on Windows 11. The exposure is concentrated in organizations and sectors where migration has lagged, particularly SMBs and industries with long-lived or specialized hardware such as **healthcare and pharmaceuticals, retail, and manufacturing**. Researchers said hardware incompatibility is not the main barrier to upgrading, while nearly one-fifth of monitored Windows devices still run end-of-life operating systems including **Windows 7, Windows 8.1, and Windows XP**. Although Microsoft offers Extended Security Updates as a temporary bridge for some Windows 10 users, coverage is limited and consumer ESU expires on **12 October 2027**, leaving organizations facing growing operational, compliance, insurance, and regulatory risk if legacy systems remain in production.
Jul 20, 2026