For older software, they can simply disconnect the XP computer from the Internet, many science institutions and healthcare services like the NHS, still use Windows XP machines because they have no need to connect to the Internet.
However, there is still the threat of employees, bringing in infected USB sticks and external hard drives, and then infecting the system.
