This question already has an answer here:
I'm trying to quantify the exact risk I'm subjecting my PC to if leaving it with Windows XP as opposed to upgrading it to e.g. Windows 7, an upgrade that would be very time-costly in my case. I don't really go on "dodgy" websites and have a firewall & AV. Is there a risk that a new exploit/vulnerability that is uncovered for XP (and not patched due to this OS's support having ceased) will affect my computer in an "unprovoked" manner, just because it is connected to the Internet, and without me accessing a compromised web resource? For instance, will my PC will more vulnerable (with XP as opposed to Win 7) to attacks from the Internet that single out vulnerable OSs, such as ping-based attacks, DDoS etc?