Microsoft announced in January that it will continue to deliver anti-malware support to XP users through July 14, 2015, provided customers have Security Essentials installed by April 8. Microsoft will also maintain System Center Endpoint Protection, Forefront Client Security, Forefront Endpoint Protection, and Windows Intune for enterprise customers. Most security vendors also plan to support Windows XP for at least the next several years. All of these efforts could mitigate XP's potential risk after April, but Johnson said the protection will be more reactive than proactive.

Miller agreed. "Antivirus simply cannot protect you from every kind of attack," he said in a January blog post, comparing XP to a "rotting wooden boat."

XP poses a threat, not only to conventional PC users, but also to a variety of industrial systems, ATMs, and healthcare products. A February report by the SAN Institute identified Windows XP's prominence as a potential liability in the healthcare industry, for example. The OS also reportedly supports the majority of the world's ATMs, and Michael Assante, former VP and security chief for the North American Electric Reliability Corporation, told The Wall Street Journal that XP workstations are used in virtually all electric and gas utilities in the United States.

With such systems, "the issue is really: How connected are they to the public Internet, and how locked down are they?" Silver noted. He said single-application machines should be locked down to begin with, which will "hopefully make them less vulnerable."