Businesses face security 'red alert' as XP SP2's retirement looms

Three out of four companies are running the almost-obsolete operating system on 10 percent or more of their PCs, says survey

Three out of four companies will soon face more security risks because they continue to run the soon-to-be-retired Windows XP Service Pack 2 (SP2), a report published today claimed.

According to Toronto, Canada-based technology provider Softchoice, 77 percent of the organizations it surveyed are running Windows XP SP2 on 10 percent or more of their PCs. Nearly 46 percent of the 280,000 business computers Softchoice analyzed rely on the aged operating system.

[ Get all the details you need on deploying and using Windows 7 in the InfoWorld editors' 21-page Windows 7 Deep Dive PDF special report. | Stay up with Windows news and analysis with our Technology: Windows newsletter. ]

"This is a red alert," said Dean Williams, the services development manager for Softchoice. "This isn't something you can safely ignore, like you might have before."

Williams was referring to the impending end-of-support deadline that Microsoft has set for Windows XP SP2, a service pack that debuted in the fall of 2004. After July 13, Microsoft will stop issuing security updates for SP2, a move that has users scrambling to update to Windows XP SP3, which will be supported until April 2014.

"Windows XP SP2 is deployed in 100 percent of the companies [surveyed] to some extent," said Williams. "But that doesn't tell the whole story. On average, 36 percent of the PCs in every organization run SP2."

Softchoice obtained its data from customers of its IT assessment services, which include asset, hardware lifecycle and licensing management. It analyzed 278,000 PCs in 117 U.S. and Canadian organizations in education and the financial, health care and manufacturing industries. The firm weighted the number of XP SP2 systems in each polled organization to arrive at the average usage mark of 36 percent.

But most companies have work to do, Williams said, citing the 10 percent threshold of Windows XP SP2 systems. "It's unrealistic to expect them to execute a deployment of Windows 7 in the next three weeks," he said. "But they should determine who is affected and get them updated to Windows XP SP3 immediately."

Windows XP SP3, which Microsoft released in May 2008 , is available as a free upgrade to all Windows XP users. Microsoft has promised to support XP SP3 with security updates until April 8, 2014.

Softchoice's data is similar to numbers produced last month by Qualys, which said that approximately half of all enterprise PCs running some version of XP were using SP2.