Quick answer: Yes, every computer your business uses should run antivirus software and keep it updated. It catches known malware. It will not stop someone who tricks you into giving up a password, and it cannot restore your files after an attack. For that, you need updates, backups and multifactor login too.
Below: what antivirus actually does, what it misses, the four habits that fill the gap, and what your website and email need on top.
What does antivirus software actually do?
It looks for known threats and blocks them. CISA, the US cybersecurity agency, explains that antivirus software looks for patterns based on the signatures of known malware, and that vendors find new malware daily, so updates matter.
When you set it up:
- Install one antivirus product on every computer your business uses, including laptops people take home.
- Turn on automatic updates so that it always has the latest signatures.
- Turn on automatic scans, and check once a month that they are running.
Windows and Mac computers include built-in protection. Check that it is on before you buy anything else, because CISA notes that most products perform the same types of functions.
What will antivirus not stop?
| The threat | Why antivirus can miss it | What covers it |
|---|---|---|
| Brand-new malware | It relies on signatures, so it can only detect what is already known | Prompt software updates |
| Phishing emails | The danger is a person being tricked into acting, not a file | Training, multifactor login, email filtering |
| Stolen or reused passwords | The attacker logs in like a normal user | Multifactor login and a password manager |
| Ransomware | It can arrive through a link someone clicks, then spread | Tested backups |
| Attacks on your website | Your website runs on a server, not on your computer | Hosting security, updates, SSL |
CISA says so directly: because it relies on signatures, antivirus can only detect malware with known characteristics. NIST’s small business page on ransomware gives an example: someone is tricked into clicking a link that downloads a file, and the attack spreads to other computers from there.
Which four habits fill the gap?
- Turn on multifactor login. CISA’s guidance for small businesses says any form of it raises the cost of an attack. Start with email and banking.
- Update everything. CISA recommends turning on automatic updates, because many updates are created to fix security risks.
- Back up, then test it. CISA notes that many ransomware victims had no backups or damaged ones, so it is critical to test restoring your files, not only to schedule backups.
- Teach people to pause before they click. CISA’s phishing tips are short enough to read at a staff meeting. Our business password policy guide covers the login side.
What protects your website and email?
Your computer’s antivirus does not cover the server your site runs on or your mailbox, so check what your providers include.
- Website: Turbify web hosting includes free SSL that auto-renews, DDoS protection and backup and restore tools. Our guide to malware protection for your website covers the rest.
- Email: Business Mail includes spam and virus filtering and encryption in transit and at rest. Our help center explains how email viruses work.
- Higher assurance: if your business needs organization or extended validation, see our paid SSL certificates.
Quick answers
Is free antivirus enough for a small business?
For a business with one or two computers it can be a start, if it stays updated and scanning. Once you have staff or customer data, we recommend a business product that lets you see all of your computers in one place.
Do I need antivirus on a Mac or a phone?
Keep the built-in protection on and install updates on every device. Phishing works on any device, so the habits above matter just as much.
Does my hosting company’s security replace antivirus?
No. They protect different things. Hosting protects your site on the server, and antivirus protects the computers you work on.
What should I do if I click a bad link?
Disconnect the computer from the internet, run a full scan, change your passwords from another device and tell anyone who could be affected.
Your next step
Today, check three things: that antivirus is on and up to date on every computer, that multifactor login is on for your email, and that you have restored one file from a backup.
Keep customer data safe. Turbify includes free SSL on every hosting plan, with payment tools built for small business. See SSL options.
