there are paches for xp but howmany users will apply them? not to manny if they have to do it themselves, if the auto update bubble comes up they will always do it later because they are busy or dont want to have to restart there computer this is one of the reasons your company has to have a good security policy and pach mamangement policies in place and make sure that users actualy follow them