Millions of people are still running Windows XP
but if they connect to the internet they're "sitting ducks for cybercriminals to attack".

You still need to activate XP or it stops working after 30 days. (You can get round this but it's not simple.)