Re: XP use
When I was working in the NHS there were XP boxes still around simply because they ran multi million quid bits of kit like MRI machines. The software was written for XP and preinstalled on the box provided by the manufacturer.
The manufacturer wouldn't provide a new machine with the software on it, but would offer a 5% discount on their latest model MRI machine, at a total cost exceeding what pretty much anybody reading this will earn in total in their life.
1) Toss a several million quids worth of perfectly good MRI machines and drop the number of medical procedures offered down to around 25% of normal to pay for replacement hardware.
2) Unplug the XP box from the network, leave it connected to the MRI boxes and then print the scans on a high spec colour printer, and honestly answer that you have XP in use which is not receiving any security patches.
3) stick a small hardware firewall between the XP box and the rest of the world and only allow it to do updates etc, and allow outbound SMTP traffic on port 21 to allow the scanner to email the MRI results to people who need them, then honestly answer that you have XP in use, but it's connected to the network, secured and up to date.
4) Do a Sir Humphreyesque answer to surveys stating that all staff desktops have been updated to Win7 or Win10 and that you have no staff using a Windows XP desktop computer for their day to day work.
Answers on a postcard to which one you'd pick.