More people are still running Windows XP and Windows 7 than many headlines imply — not because those systems are ideal, but because compatibility, cost and inertia still matter to millions of users and organisations worldwide.
Background / Overview
When Microsoft ended mainstream servicing for Windows 7 in January 2020 and long before that for Windows XP (April 2014), security experts warned that the clock was ticking for systems that no longer receive vendor patches. Those warnings did not make the old installations vanish. Even as Windows 10 and Windows 11 dominate web‑facing telemetry, small but meaningful slices of the installed base continue to run legacy releases. Public telemetry from StatCounter and other trackers shows single‑digit percentages for Windows 7 and sub‑percent figures for Windows XP in many snapshots — numbers that are small in percentage terms but still translate to millions of machines when applied to a global Windows installed base measured in the hundreds of millions to more than a billion devices. StatCounter’s rolling charts indicate Windows 7 and Windows XP persist at measurable levels in the global web‑usage sample, while reporting that Windows 11 and Windows 10 account for the lion’s share of pageviews. This article outlines why legacy Windows releases still exist in 2025, who uses them, what concrete security and operational risks they carry, and what practical migration or mitigation paths organisations and private users actually rely on. It verifies the major facts with public telemetry and vendor notices, highlights the tradeoffs users make, and flags claims that need a cautious interpretation.
Why legacy Windows (XP and 7) still exists
App compatibility: the single strongest reason
For many organisations and for some home users, the primary reason to keep Windows XP or Windows 7 isn’t nostalgia — it’s compatibility. A surprising number of line‑of‑business (LOB) applications, control systems, custom drivers and point‑of‑sale setups were developed for the APIs, runtimes and hardware drivers of older Windows releases. Upgrading the OS can break these dependencies.
- Industrial control, manufacturing software, lab instruments and bespoke bookkeeping suites are common examples where the application vendor no longer supports modern Windows builds or where the application’s internal database format cannot be migrated without expensive development work.
- Peripheral drivers for legacy scanners, label printers or measurement devices often only exist for older frameworks; manufacturers of that hardware sometimes stopped producing modern drivers years ago.
This is not just conjecture — forum and field reports over many years show organisations elect to keep older Windows images alive because the cost and risk of replacing a functioning application is higher than continuing to operate the old stack. Community archives that document long‑running deployments and migration pain echo this reality.
Hardware and cost constraints
Upgrading from Windows XP or Windows 7 to a supported modern release frequently requires new hardware. Windows 11 in particular has a stricter baseline (for example, TPM and newer CPU families) which disqualifies many older desktops and laptops. The total cost of ownership for an upgrade includes:
- New hardware purchases (or retrofitted components).
- License fees for new OS and, sometimes, new application versions.
- Labour to migrate or re‑implement decades of application data.
- Testing and validation to ensure mission‑critical workflows are unaffected.
For small businesses and users in low‑income markets, those costs are not hypothetical — they are decisive. Many choose to keep functioning hardware and software in place rather than pay for a risky migration.
Data migration headaches and business continuity
Data trapped in legacy application formats is a huge migration blocker. In some cases the only viable path to preserve decades of records is manual transcription. That is expensive, error‑prone and operationally disruptive. Organisations that depend on that historical data — healthcare clinics, legal offices, small factories and retail chains — will reasonably prioritise continuity over an OS shift until they can budget a controlled migration project.
Isolation, single‑purpose machines and air‑gapped systems
Not all legacy Windows machines are general‑purpose. Many run as dedicated appliances: billing terminals, label printers, CNC controllers, or kiosk devices. These machines are often air‑gapped or exist on isolated VLANs, which materially reduces their exposure to internet‑borne threats. For those deployments, organisations accept diminished patching in exchange for reliability and predictability.
Virtualisation and sandboxing: modern mitigations for old software
Some users — hobbyists, auditors, and IT pros supporting legacy apps — run XP or Win7 inside virtual machines (VMs) hosted on patched hosts. Virtualisation offers a controlled compromise: you can keep the old OS for compatibility while placing it behind isolation layers, snapshots, strict network rules and modern endpoint protection. That approach addresses many, but not all, risks.
The numbers: market share, installed base and what “millions” means
Telemetry from trackers like StatCounter provides pageview‑weighted snapshots of what OS versions are used to access the web. Those percentages fluctuate month to month and by region. StatCounter’s public charts show that Windows 11 and Windows 10 account for the majority of web‑facing Windows usage in recent months, with legacy versions occupying the remainder; depending on the snapshot, Windows 7 can be in the low single digits and Windows XP in the low‑tenth or low‑hundredth percentage points. These figures are directional and change quickly during migration waves. Two crucial clarifications:
- A small percentage of a very large installed base still equals millions of devices. If the global Windows population is measured in the order of one billion active devices, even a 0.2% share equates to roughly two million machines.
- “Market share” in trackers measures active web traffic from devices in the panel — not a vendor‑verified inventory of every installed machine. Different measurement methods (panel‑based telemetry, enterprise asset inventories, sales/shipments) will produce different snapshots.
Microsoft and other outlets have repeatedly stated that the Windows ecosystem comprises more than a billion active devices in recent years; the exact figure (1 billion vs 1.4 billion) has been reported differently in different communications and press coverage, so treat single‑figure claims as approximate. Vendor communications and multiple industry reports confirm that the Windows installed base remains very large; that makes legacy percentages meaningful in absolute terms.
The security tradeoffs: real risks, partial mitigations
What stops when support ends
When Microsoft marks an OS as out of support, the practical consequence is that Microsoft stops issuing routine OS‑level security patches (except for devices enrolled in specific extended programs). The underlying code continues to run, but newly discovered kernel, privilege escalation and driver vulnerabilities will no longer receive vendor fixes for unenrolled devices. That increases the risk profile over time. Microsoft’s recent end‑of‑servicing announcement for Windows 10 on October 14, 2025, illustrates the distinction: devices still boot but routine servicing stops unless a device is enrolled in an ESU or similar program.
Mitigation options in practice
- Isolation: keeping legacy machines off the internet or on dedicated networks dramatically lowers attack surface and is a widely used approach for single‑purpose hardware.
- Virtualisation: running legacy Windows inside a VM on a patched host lets defenders apply host‑level controls and ephemeral snapshots.
- Endpoint protection: up‑to‑date antivirus and endpoint detection can reduce risk from commodity malware, although they do not substitute for OS patches that fix privilege escalation or kernel issues.
- ESU / paid support: for some commercial scenarios, Extended Security Updates (ESU) or vendor contracts provide a bridge of fixes and support. Microsoft and cloud‑hosted services also offer ESU coverage models for particular deployments.
Why mitigation is not perfect
Antivirus and network isolation reduce the probability of successful compromise but cannot eliminate it. Some vulnerabilities do not require internet exposure; they can be triggered locally or by a malicious USB device. Similarly, ESU programs are expensive and temporary by design, so they are not a long‑term solution for most organisations.
Who’s still running legacy Windows — and where
Small business and SMBs
Small businesses that rely on specialized local software or legacy peripherals are the most visible segment still running Windows 7 or XP. For them, an upgrade is not simply an OS reinstall — it is a project that can require new hardware, updated certifications, and months of validation.
Industrial and embedded systems
Manufacturing floors, laboratories and point‑of‑sale systems often contain equipment that was built around older Windows releases. Changing the OS on a PLC or machine control terminal may require re‑engineering the control stack and re-certifying the device, which is expensive and time‑consuming.
Hobbyists, retrocomputing communities and niche use cases
A small but vocal set of users keep Windows XP and Windows 7 alive for nostalgia, legacy gaming, or specific applications (for example, older audio production suites that relied on legacy drivers). Enthusiasts often use VMs or air‑gapped machines and documented projects show creative re‑uses of legacy Windows on modern hardware. Community threads over the years recount these use cases and the technical workarounds people employ.
Geographic variation
Market share and behavior vary widely by region. Some lower‑income markets retain older hardware longer, while enterprise patterns differ by country and industry vertical. StatCounter regional breakdowns and multiple independent reports show that legacy versions can be over‑represented in some regions and verticals relative to global averages.
Microsoft’s posture and the real upgrade options
Vendor lifecycles and ESU programs
Microsoft’s official lifecycle policy is explicit: after an announced end‑of‑support date, routine OS patches stop for unenrolled devices. For Windows 10, October 14, 2025 was the cutoff for ordinary servicing; Microsoft provided consumer ESU and commercial ESU options and a variety of cloud/virtualisation paths to extend security coverage temporarily. Organisations should consult official lifecycle documentation for specific SKU coverage and timelines.
Practical upgrade paths
- Upgrade the OS on eligible hardware to Windows 11 (or the latest supported release) after inventory and testing.
- Replace unsupported endpoints with new hardware that meets modern security hardware baselines (TPM, firmware).
- Enroll critical devices in ESU or purchase third‑party support as a bridge.
- Re‑architect legacy applications into supported platforms (web services, containerised workloads, cloud VMs) where cost‑benefit justifies the migration.
Each path has tradeoffs: cost, time, and compatibility. Many organisations take a hybrid approach: migrate high‑risk, internet‑facing devices quickly and phase out isolated legacy endpoints on a slower schedule.
What users should do today: a practical checklist
- Inventory: Create an authoritative asset inventory that identifies OS versions, applications, and network exposure.
- Prioritise by risk: Internet‑connected machines and devices with sensitive data should be the highest priority for upgrade or isolation.
- Isolate legacy endpoints: If immediate migration is impossible, segment those devices away from corporate networks and limit inbound/outbound flows.
- Virtualise where possible: Move legacy workloads into virtual machines on patched hosts with restrictive network rules.
- Use ESU or paid support as a bridge: For critical devices, enrol in vendor bridge programs but plan a permanent migration path.
- Test migrations: Build a test environment that mirrors production to validate application compatibility and procedural changes before rolling out.
These steps are straightforward in theory but often complex and resource‑heavy in execution — which is precisely why legacy versions continue to persist in the field.
Strengths, risks and critical analysis
Notable strengths of the “keep it running” approach
- Predictability: Legacy systems that are stable and meet business requirements avoid the disruption of an upgrade.
- Cost avoidance (short term): If hardware and software still function, the immediate capital outlay is deferred.
- Simplicity for single‑purpose devices: For devices that do one thing and do it well, modernising can add little business value.
Major risks and where organisations are mis‑judging them
- Rising vulnerability exposure: Over time, the likelihood of an exploitable unpatched vulnerability increases. Attackers scan for older OS signatures and adapted exploit chains.
- Compliance and liability: Regulatory or contractual rules may forbid unpatched or unsupported OS in certain data environments.
- False economy: The up‑front cost of migration can seem large, but the long‑term cost of a breach, downtime, or forced emergency remediation is often much higher.
- Supply chain fragility: Hardware and driver support for older devices can vanish, making future recovery difficult even if you want to modernise later.
Where claims need caution
- Absolute installed‑base numbers: Public figures like “one billion Windows PCs” are estimates and may be framed differently by vendors and market analysts; treat round numbers as approximations and cross‑check against vendor statements and multiple industry datasets.
- Short‑term telemetry spikes: Pageview‑weighted trackers can show month‑to‑month volatility during migration events; use multiple snapshots and complementary sources to interpret trends.
Regional and sector case studies (brief snapshots)
Retail/POS environments
Point‑of‑sale networks often run tucked‑away Windows 7 images because the payment‑processing software is certified against that platform. Shops typically isolate POS networks, apply device‑level controls and defer upgrades until a planned refresh cycle.
Small manufacturing plant
A factory with legacy CNC and measurement software built for Windows XP may replace the host PCs only during a capital refresh. Engineers often run the control software in a VM to preserve compatibility while modernising peripheral interfaces.
Freelance creative studio
Some audio and video production suites were developed in the XP era and rely on legacy drivers. Freelancers commonly keep a dedicated legacy workstation for old projects and isolate it from file sharing to reduce exposure.
These patterns are common in forum archives and community posts describing long‑running use cases. They underline that the decision to stay on older Windows is often pragmatic and operational, not simply sentimental.
Conclusion: legacy Windows is a living compromise
Windows XP and Windows 7 have not vanished because software and business processes are not modular by default. Compatibility, financial constraints and continuity needs keep millions of machines running old releases. That reality forces an uncomfortable truth: security is one of many factors affecting technology decisions, and for many organisations it shares priority with reliability, cost and regulatory compliance.
The right approach is not a single, moralistic command to “upgrade now” but a structured risk‑management plan: inventory assets, prioritise internet‑facing and high‑value systems, isolate and mitigate legacy devices, use vendor bridge programs sparingly, and plan for an orderly migration where feasible.
Public telemetry confirms legacy Windows persists in small percentages that nonetheless equate to millions of machines; vendor lifecycle calendars and ESU programs confirm the commercial and technical constraints organisations face. Those facts together explain why Windows XP and Windows 7 remain part of the computing landscape — and why those who manage them owe it to their users to do so with clear mitigating controls and a migration roadmap.
Source: XDA
Are people still using Windows XP and Windows 7? Yes, and here's why