It’s easy to assume that more security software means more protection. In practice, the right amount of security depends on how a computer is used — and for most homes and small offices, a few well-maintained basics do far more than a pile of overlapping products. Here’s what “enough” looks like, and when it’s time to step up.
Start by splitting computers into two groups: online computers, which connect to the internet or a network, and offline computers, which never do.
Online computers: the essentials
Almost every computer today is an online computer. For a home or small-office computer, these essentials provide solid protection:
- One up-to-date antivirus. On Windows 10 and 11, the built-in Microsoft Defender Antivirus meets the needs of most home users at no extra cost. A reputable paid product is fine too — but use just one, and make sure it stays up to date. Our article Antivirus and Antispyware: How They Protect You explains why one is enough.
- A firewall. Windows includes Windows Defender Firewall, which by default blocks unsolicited connections coming in from the internet. Your router adds a second layer by keeping the devices on your network hidden from the internet. For most homes and small offices, the two together are enough. (On a Mac, the built-in firewall is turned off by default — turn it on in System Settings → Network → Firewall.)
- Updates. Turn on automatic updates for Windows and your programs. Many attacks rely on security holes that were fixed months earlier on computers that were never updated.
- A secure router. Change the router’s default admin password, keep its firmware updated, and replace it when the manufacturer stops providing updates — an old, unsupported router is a common weak point.
- Strong passwords and two-step verification. Use a different strong password for each important account, and turn on two-step verification for email, banking and other important accounts. A password manager makes this practical.
- A standard account for everyday use. Use a standard (non-administrator) account for daily work and save the administrator account for installing software and changing settings. Malware that runs under a standard account can do far less damage.
- Backups. Security software can’t undo every disaster. Keep backups that follow the 3-2-1 rule — see Data Backup: How to Protect What Matters Most.
Offline computers: when you can relax a little
Some computers never connect to the internet or a network — for example, a computer that runs a single piece of equipment. If a computer truly never connects and never receives files from other computers, it doesn’t need real-time antivirus. But be careful:
- Removable drives can carry malware. USB drives and external disks are the main way malware reaches offline computers.
- Scan files before they go in — on an up-to-date computer. An offline computer can’t download the latest antivirus definitions, so its own scans may miss new threats. Scan USB drives and files on an online computer with current antivirus before taking them to the offline machine.
- Keep it truly offline. Turn off Wi-Fi and Bluetooth and keep it unplugged from the network. A computer that is “offline except sometimes” should be treated as an online computer.
Why more isn’t better
Adding a second antivirus program or extra “security suites” on top of the essentials usually makes things worse, not better: the programs compete for memory, slow the computer, conflict with each other and can even break one another. One well-maintained antivirus and a firewall, combined with updates and good habits, is the right foundation.
When a business should step up
The essentials above suit most homes and many small offices. Consider stronger, business-grade protection if any of these apply:
1. You have several computers to manage
Once you have more than a handful of computers, checking each one by hand becomes unreliable, and it’s easy for one machine to fall behind on updates or have its protection switched off. Business-grade antivirus (often called endpoint protection) lets every computer be monitored and updated from one place, so problems are spotted quickly.
2. Ransomware and phishing are a real risk for you
If your business handles money, sensitive records or lots of email from outside, you’re an attractive target. A basic router firewall can’t inspect email attachments or recognize a fake login page. Stronger protection includes email filtering, web filtering that blocks known malicious sites, security software that can detect and stop ransomware, and dividing the network so one infected computer can’t reach everything — for example, keeping guest Wi-Fi separate from business systems.
3. Staff work remotely or need to reach the office network
Remote access should go through a secure, modern VPN or remote-access service protected by two-step verification — never by opening ports on the router to the internet. Business firewalls can also detect and block known attack attempts and control which applications are allowed on the network.
4. You must meet regulations
Medical and dental offices handling patient information must follow HIPAA, and any business that accepts credit cards must follow the PCI DSS card security standard. These require specific safeguards, such as controlled access, encryption, activity logs and documented security practices. No single product makes you compliant — compliance depends on how your systems are set up, documented and maintained — so it’s worth getting professional help.
The bottom line
For most people, “enough” security is one up-to-date antivirus, a firewall, automatic updates, a secure router, strong passwords with two-step verification, and good backups. Businesses with several computers, sensitive data, remote staff or regulations to meet should build on that foundation with centrally managed, business-grade protection.
Need a hand?
Not sure whether your setup is enough? PSA can review your computers and network, recommend what fits your needs and budget, and set it up for you. For businesses, our managed services keep that protection monitored and up to date. Call (707) 506-6802 or send us a message.
This article replaces PSA-0002 (2016), PSA-0002-C (2016) and PSA-0023 (2023).