This question already has an answer here:
I have been assigned (as the youngest, hence the IT specialist, of the team [none of us have any IT background at all]) the task to check out our industrial computers.
It turns out the situation is dire, with key machines running stuff as old as Windows NT 4.0 or Windows Server 2003.
As always in this situation, is a question of buck for my bang, and no money is getting spend on upgrading if there is no added value.
In order to give an accurate recommendation, I'd like to find a list of security holes for a given OS, with, in an ideal world, an indication of damage and likelyhood, so I can build a damage probability matrix.