0patch Explained: How It Works and What It Means for the End of Windows 10

PCMag editors select and review products independently. If you buy through affiliate links, we may earn commissions, which help support our testing.

Windows 10 doesn't have much time left. In October 2025, with free security updates. You can still get , but you’ll have to pay for them—and the fee will increase each year. After three years, Microsoft will be done. But one company says it has .

is a product from . Its creators say they can patch Windows just as well as Microsoft—perhaps even better in some situations—and at a lower cost. In fact, while Microsoft has already left Windows 7 behind, 0patch has “security-adopted” it and still delivers security patches for it today. It plans to do the same for Windows 10 22H2 when October 2025 rolls around.

There’s been a lot of chatter about 0patch, so I reached out to Mitja Kolsek, the CEO of Acros Security and cofounder of 0patch, to nail down more specifics. He told me the company has over 40,000 accounts using 0patch around the world, some of which have thousands of registered agents.

Here, I explain everything you need to know about 0patch. Whether it is a worthwhile or viable option to keep your Windows 10 machine secure ultimately depends on your situation, but it certainly deserves your consideration.

How Can 0patch Securely Update Windows?

I spoke to multiple security professionals who had never used 0patch but, off the record, expressed some concern about whether one company could really patch another company’s software securely.

“We were the first ones to express this skepticism when 0patch was still just an idea discussed in meetings, so it seems like a natural reaction for anyone who first hears about 0patch,” Kolsek told me.

But how well does it work?

“After eight years of patching (mostly) Microsoft’s security holes, our record speaks for itself. Most of our legacy Windows patches are logically identical to Microsoft’s own patches that they had issued for still-supported Windows versions,” said Kolsek.

Kolsek also highlighted past situations in which 0patch and , while Microsoft put out a buggy patch that later had to be pulled.

Why Doesn't It Patch Every Known Flaw?

Erich Kron, a security professional at the security awareness outfit , raised a potential issue. “One concern is that they only patch a limited number of vulnerabilities, and the choice of what to patch is out of the customer’s hands. While that is also true of Microsoft patches, they [release] a significant number of patches of varied criticalities rather than just high-risk, actively exploited ones.”

Kron pointed to . The page states that “The goal of 0patch is not to micropatch every vulnerability but the important ones.”

Kolsek told me that 0patch has listed every new patch it issues on that page for years. He said that 0patch focuses on “likely to be exploited vulnerabilities” that are of high severity. Those include vulnerabilities that allow remote code execution or local privilege escalation.

He pointed me to First’s , which he said is in line with the company’s practice. Kolsek also highlighted the huge number of flaws being found and 0patch’s need to focus on the most important and dangerous ones.

“This is likely going to leave a variety of vulnerabilities unpatched, but the (always limited) effort will go into maximizing actual security,” Kolsek said. If a flaw seems low risk and is unlikely to be exploited, 0patch won’t focus engineering resources on it.

How Does 0patch Work?

Let’s rewind. How exactly can 0patch patch Windows? It doesn’t work like a typical Windows Update, which updates the actual files on your disk with new code.

Instead, 0patch patches in memory. Your computer runs something called the 0patch Agent, which downloads small “micropatches” that it applies instantly. In other words, 0patch changes how programs behave to prevent flaws from being exploited. You don't even need to reboot for these to take effect.

Kolsek explained how the company creates its patches: “We’re collecting vulnerability information from public and private sources, and as soon as we know enough to reproduce a vulnerability, we analyze it and create a patch. Which is really what everyone on both [the] defense and offense side is doing … Attackers try to weaponize the vulnerability and start exploiting it, and defenders try to create defenses to block these attacks. What makes 0patch different from other defense solutions is that we actually remove vulnerabilities from the code.”

Kolsek said 0patch’s agent is designed to be lightweight and make minimal changes to avoid causing problems. The company subjects each patch to two types of tests: Security tests that confirm the patch fixed the problem in question and functional tests that ensure it didn’t break anything. “These tests are always performed by a different person than the person who wrote the patch,” he told me, pointing out that 0patch publishes the source code of some of its micropatches in its .

Kron flagged the way 0patch works as a potential concern. “The 0patch agent is used to inject the patch directly into memory related to the processes, rather than patching an executable file. That is very convenient as it doesn’t require a reboot. However, the same tactic is used by many strains of fileless malware ... the technique itself is not bad .... however, if the agent was able to be hijacked by an attacker, it could be used maliciously.” Kolsek told me that Acros Security, as a security company, performs penetration testing on its software to ensure security.

One thing is clear: This isn’t a plug-and-play solution that’s indistinguishable from getting security updates from Microsoft. It’s not like an organization is swapping out its stationary supplier for a company that sells cheaper printer paper. No, 0patch is a totally different product. It’s a way to (likely) get some extra security on a Windows PC by blocking potential flaws from being exploited. But you’re also trusting an additional vendor’s security software.

Not Just for End-of-Life Systems

Kolsek pitches 0patch as more than just a solution for end-of-life systems; you can also consider it a general security solution.

“While our patches for legacy systems are a popular subject these days in light of the impending Windows 10 sunset, we’re also providing '0day' patches for still-supported Windows systems. These are patches for vulnerabilities that have been discovered and disclosed but don’t have an official vendor fix yet.” He said the company often moves more quickly than Microsoft to release fixes when critical problems are found.

In fact, Kolsek told me that 40% of 0patch’s customers are using it on still-supported versions of Windows.

0patch Won’t Keep Patching Windows 10 for Free

0patch won’t be free for Windows 10 once Microsoft sunsets the OS. But it will be cheaper than Microsoft’s official updates, it won’t go up in price every year, and it should be an option for longer than Microsoft's three-year bonus period. 0patch currently charges around $28 per year per device for its Pro service, which will cover Windows 10 22H2 end-of-service updates.

You can get some security patches from 0patch for free, but . I’ve seen some confusion about this online, but 0patch won't be a free way to keep getting security updates for Windows 10 after official support ends.

Kolsek was clear that the company recognizes it can’t just compete with Microsoft on price. “If, for instance, your organization’s compliance auditor interprets a standard as requiring official vendor patches, you’ll have to go with ESU or upgrade. (Although many still use 0patch on top of that for 0days.)”

How Long Will 0patch Support Windows 10?

As mentioned, 0patch is particularly interesting for end-of-life systems. Come October 2028, after three years, it might be the only way to keep getting security patches for Windows 10.

That’s how it played out with Windows 7. “In January 2023, the three-year Extended Security Updates ran out for Windows 7, but we decided to keep supporting this Windows version with critical security patches—and are still supporting it,” said Kolsek. “We still have thousands of Windows 7 users today and are planning to extend our support for it at least until January 2026, and even longer if there is demand.”

Kolsek says the company plans on patching Windows 10 for five years—longer than Microsoft’s three years—but it will likely extend that commitment as well since it expects an even higher level of demand than it has for Windows 7. The company doesn’t see anything on the horizon that would cause a problem with patching Windows 10.

Another Layer of Security, But Not a Permanent Solution

0patch isn’t just a less expensive, drop-in alternative to Windows Update. And it’s not a magic bullet that will protect against all problems. Heck, even official Windows patches aren’t a magic bullet: That’s why organizations often use endpoint security software and home users install antivirus tools. But its promise to protect your system against the most dangerous exploits appears to check out. And that makes it potentially useful for more than just end-of-life systems.

Still, 0patch isn’t the only option for such Windows 10 computers. KnowBe4’s Kron suggested isolating machines that are forced to stay on unsupported versions of Windows: “For example, using microsegmentation to isolate a machine from most of the network could be useful in situations where files are generated on a machine and just need to be copied to a network location, for example, an MRI machine.”

If you’re going to connect a Windows 10 (or Windows 7) PC to a network after it’s no longer receiving patches, you should take some security precautions. Ensure you’re using a browser that’s still getting updates on your operating system and an antivirus that’s still supported. And yes, 0patch could also be an additional layer of security against nasty flaws.

“In the short term, it is a good option to buy time, but eventually, the operating system should be upgraded to a regularly supported version,” said Kron.

If you want to upgrade an old PC, there are . There are also other , including switching to Linux or ChromeOS.