Windows 11 update removes modem support for certain PCs?

Microsoft's January 2026 Windows 11 security update KB5074109 (Build 26200.7623) intentionally removes legacy modem drivers — agrsm64.sys, agrsm.sys, smserl64.sys and smserial.sys — rendering dependent modems unusable and prompting broad user complaints and vendor support strain. Microsoft says the removals address unpatched security vulnerabilities; affected users can temporarily restore functionality by uninstalling the update, but that raises security risks. The issue is a reputational and support-cost concern for Microsoft and modem vendors, though the direct market impact is likely limited and operational rather than financial.

Analysis

Market structure: Legacy-modem OEMs and small hardware suppliers are immediate losers as Microsoft removes agrsm*.sys drivers—expect a 5–15% revenue hit for niche modem vendors over 1–2 quarters and higher RMA/support costs. Winners include enterprise security vendors and modern telephony/cloud-voice providers (Microsoft Teams/Cisco Webex) because customers will accelerate refreshes and cloud migrations; MSFT faces short-term reputational and support-cost pressure but limited long-term revenue loss. Volatility: expect implied volatility on MSFT options to rise 20–40% in the next 2–4 weeks as retail and SMB outage reports mount.

Risk assessment: Tail risks include broad enterprise outages (call-centers, POS systems) leading to regulatory scrutiny or class-action suits against Microsoft—low probability but >$500M aggregate exposure if major telco/enterprise outages occur. Timeline: immediate (days) — uninstall/patch guidance and support load; short-term (weeks–months) — OEM driver releases or forced hardware replacements; long-term (quarters–years) — faster hardware refresh cycles and increased cloud voice adoption driving capex shift. Hidden dependencies: industrial/telemetry systems and legacy fax/modem-based logging in healthcare/legal verticals could incur outsized downtime costs.

Trade implications: Tactical: buy downside protection on MSFT via 3-month put spreads sized 0.5–1% of AUM (buy 5% OTM, sell 10% OTM) to hedge reputational drawdowns; establish a 2–3% long in CSCO to play corporate security/voice spend reallocation ahead of FY cadence. Pair trade: long CSCO (2%) / short MSFT (1%) for 1–3 months to capture rotation into enterprise networking/security. Options: consider buying HACK (cyber ETF) calls or 3-month call spread sized 1–2% to play accelerated security budgets; trim small-cap peripheral/hardware exposure by 50% near-term.

Contrarian angles: The market may over-penalize MSFT — driver deprecation is deliberate security policy and will force OEM upgrades, increasing long-term cloud/Teams sticky revenue; if no major enterprise outages emerge within 30–60 days, MSFT IV and downside-premia will compress, creating opportunity to sell short-dated premium. Historical parallel: past Windows driver deprecations caused temporary OEM pain but accelerated platform modernization and spending; monitor OEM driver releases and class-action filings over next 60 days as decision triggers.

Key Decisions for Investors

• Buy a 3-month MSFT put spread sized 0.5–1% of portfolio: buy 5% OTM put and sell 10% OTM put to cap cost and hedge reputational/downside risk over next 90 days.
• Establish a 2–3% long position in CSCO (Cisco) to capture enterprise security/voice budget reallocation; add on any pullback >5% within 1–3 weeks.
• Implement a pair trade: long CSCO 2% / short MSFT 1% for 1–3 months to express relative strength in enterprise networking vs. consumer/Windows reputation risk.
• Allocate 1–2% to cybersecurity thematic (e.g., HACK ETF or top-tier names) via 3-month call spreads to play increased security spend; scale in over next 30 days as OEM outage reports persist.
• Reduce exposure to small-cap peripheral/modem OEMs by 50% immediately and re-evaluate after 30 days or when vendor driver updates or Microsoft mitigations are published.