For those that have said "just throw up a firewall, XP will be fine" I want to play a little devil's advocate.
The attack that rooted RSA's servers was an email attack, It was a PDF with corrupted embedded fonts that exploited kernel bug to make a root hole in the kernel.
Education? This was RSA, and they got suckered in. The idea is pretty complex stuff, imagine explaining what a kernel and root kit are to your parents. Was it a PDF exploit? Technically no, PDF (and email) were just the vectors. A firewall would not have helped (or did not, I assume RSA of all people had a firewall).
IE - just because you don't browse with IE doesn't mean you don't use it. Think of "IE" as a container with some menus, the actual HTML rendering is an ActiveX control that is used in a lot of other programs. Saying 'use Chrome' doesn't fix everything. IE must be kept up to date no matter what people click on for their webmail.
Computer security is hard. A computer is (effectively) an infinite state machine. Some of these states are unexpected, either due to bad design or bugs, and are exploitable. Windows XP is a target for a bunch of reasons, some due to bad design, some due to popularity (a large target for infection), some due to naivete (since Windows is a default install, you don't need to be technical to get it running, so non-technical people are connected to the net), some due to bugs. I'd personally think of the Ubuntu option a bit more. The fact that they're scared of it may be a good thing, they're less likely to make changes that interfere with security.
That Popup that says 'make your Windows box faster' and loads an ActiveX control (all safely passing through the firewall) is not a problem on Linux.
o.O). – Synetech Feb 13 at 19:49