Cybersecurity tool lists have a habit of turning into shopping lists:
install an antivirus, add a VPN, bolt on a scanner, try a monitoring
dashboard, then wonder who is supposed to maintain all of it.
For a sole trader or tiny business, that is backwards.
Before you add specialist security software, make sure the accounts,
devices and files your business already depends on are not relying on
obvious mistakes. The UK's National Cyber Security Centre (NCSC)
organises its current small-organisation guidance around securing email
and important accounts, protecting devices, backing up data and spotting
attacks. That is a much better starting point than collecting tools for
the sake of it.
This guide separates the free protection you probably already have,
the free tools or services that solve a clear job, and the
specialist security tools that most tiny businesses do not need yet.
Quick route: If you only do five things, secure your email, turn
on stronger sign-in protection for critical accounts, keep devices
updated and locked, make recoverable backups, and independently verify
suspicious payment or account requests.
1. Start with your email account
Your business email is often the route into password resets, invoices,
cloud services and conversations with customers or suppliers. Treat it
as an important account, not just an inbox.
Where your provider supports a passkey, consider enabling it. If
not, use a strong unique password and 2-step verification (2SV/MFA).
Check that your recovery email address, phone number or other recovery
method is still yours.
A password manager can help if passwords are still part of your setup.
Its useful job is simple: helping you create and store unique passwords
instead of reusing the same one across services.
Free-tool decision: you do not need three password tools. Pick a
reputable password manager that fits your devices and working style,
enable stronger sign-in protection on the vault itself, and actually use
it.
2. Secure the other accounts that could stop the business
Next, list the accounts that matter if they are stolen or locked:
- banking and payment services;
- website and domain hosting;
- cloud storage;
- bookkeeping, payroll or invoicing;
- social media;
- customer or booking systems.
For each one, ask:
Who has access? Is MFA/passkey protection enabled? Is recovery
information current? Is there an old employee, contractor or shared
login that should no longer be there?
This review often produces more useful security work than installing
another scanner.
The NCSC specifically recommends reviewing access to important accounts
and removing people who no longer need it. For day-to-day computer use,
it also recommends using a standard user account rather than working
permanently as an administrator.
3. Use the security already built into your devices
If you use a modern supported version of Windows, macOS, iOS or Android,
do not assume you need to replace every built-in protection with a paid
security suite.
Start by checking:
- automatic operating-system and application updates are enabled;
- the screen locks when you step away;
- device encryption is available and enabled where appropriate;
- the built-in firewall is on;
- built-in antivirus/security protection is active where the platform
provides it; - everyday work is not being done with unnecessary administrator
privileges.
The NCSC notes that modern devices generally include antivirus and
firewall protection, and that smartphones do not need separate antivirus
when you stick to official app stores. That makes a blanket "every small
business must buy antivirus" recommendation hard to justify.
When does a separate malware scanner make sense?
A reputable second-opinion scanner can be useful when you are
investigating suspicious behaviour or want an additional manual check.
That is different from stacking multiple real-time antivirus products on
one computer.
If you already have centrally managed devices, regulatory requirements
or a provider responsible for endpoint security, follow that documented
setup rather than adding random software from a list.
4. Backups: the free feature that matters only if you can restore
A folder synchronising to the cloud can be useful, but "it is in the
cloud" is not the same as proving you can recover the business after
deletion, account compromise, device failure or ransomware.
Identify the files and data the business cannot comfortably operate
without. Then record:
- where the primary copy lives;
- where the backup or independent recoverable copy lives;
- whether the process is automatic;
- who controls the backup account;
- whether that account has MFA;
- when you last restored a file to prove recovery works.
The NCSC recommends backing up important business data and checking that
it can be restored. It also advises protecting online backups with 2SV
and keeping removable backup media disconnected when it is not being
used.
A backup you have never restored is still an assumption.
5. Free checks that answer a specific question
This is where free security tools become genuinely useful. Do not start
with a brand name. Start with a question.
"Is my browser current?"
Use the browser's own update mechanism or an authoritative
browser-version check. An unsupported or badly outdated browser is a
fixable problem.
"Is my password exposed or reused?"
Change reused passwords regardless. Where a reputable service can tell
you that an address or credential has appeared in known breach data,
treat that as a prompt to secure the affected account — not as proof
that your whole device has been hacked.
"Is my website exposing an obvious configuration problem?"
A reputable header/TLS/site-health check can flag configuration worth
investigating. A green score is not a penetration test and does not
prove that a website is secure.
"What is happening on my network?"
Network-analysis and scanning tools can be excellent learning and
diagnostic tools, but they are not baseline protection for a
five-person business. Tools such as Wireshark and Nmap belong in a
diagnostic or learning toolbox for someone who understands the task and
has permission to inspect the network.
That distinction matters: a security-analysis tool is not automatically
a security control.
6. VPNs: useful for a job, not a magic shield
A VPN creates an encrypted connection between your device and the VPN
service. That can be useful for particular network/privacy requirements
or when a business provides a VPN for access to internal systems.
It does not make phishing harmless, fix reused passwords, patch an
outdated laptop, create a backup or make a fraudulent invoice
legitimate.
Do not buy or install a VPN simply because a "security stack" article
says every business needs one. Define the job first.
7. Website and cloud protection
If your business runs a public website or cloud application, services
such as DNS/CDN protection, managed hosting security, backups and access
controls can be valuable. But the right configuration depends on how the
site is built and who operates it.
For a normal brochure site or small online shop, start with:
- supported software;
- prompt updates;
- strong administrator authentication;
- the smallest practical number of admin accounts;
- protected backups;
- reputable hosting;
- HTTPS;
- monitoring appropriate to the platform.
Do not install penetration-testing or intrusion-detection tooling simply
to feel "more secure." Complexity has a maintenance cost.
8. Specialist tools that are useful — but not your starting point
Wireshark, Nmap, vulnerability scanners, intrusion-detection systems and
penetration-testing distributions are legitimate tools. They are also
easy to misunderstand in a beginner-focused list.
Use them for an authorised, defined task: learning in a lab, diagnosing
your own network, or performing work you have explicit permission to
perform.
They do not replace MFA, updates, backups, sensible access control or
scam awareness.
For most tiny businesses, boring controls beat an impressive
toolbox.
9. Scam and payment checks cost nothing
One of the highest-value "security tools" is a business rule.
If someone emails or messages you with new bank details, an urgent
payment request, an unexpected password reset or an MFA approval you did
not initiate, do not use the contact details or links in that same
message to verify it.
Open the service independently or contact the supplier/person using
details you already trust.
The NCSC advises contacting an organisation directly using details from
its official website when a message is suspicious. For business payment
fraud, it advises contacting your bank directly using official contact
details.
Write this verification rule down so that it still happens on a busy
Friday afternoon.
10. A sensible free security stack for a tiny business
Instead of thirteen products, start with seven jobs:
- Email: strong unique sign-in plus passkey or MFA where
supported. - Important accounts: MFA/passkeys, current recovery details and
access review. - Passwords: a reputable password manager if passwords remain in
use. - Devices: supported software, automatic updates, lock screen and
built-in protections. - Files: automatic backups or recoverable copies, plus a real
restore test. - People: remove access when it is no longer required.
- Scams/payments: independently verify suspicious or changed
instructions.
Only add another security product when you can finish this sentence:
"We need this tool because it solves ________, and
________ will maintain it."
If you cannot fill in both blanks, adding another dashboard probably is
not your next security job.
What about free antivirus, VPN and firewall recommendations?
Free tiers change. Products get renamed, discontinued, restricted or
moved behind paid plans. That is why this article does not pretend a
static list of thirteen brands is a permanent security architecture.
For a tiny business:
- check the protection already included with your supported operating
system; - choose additional software for a specific requirement;
- download it from the vendor's official source;
- understand what the free tier does and does not include;
- review it periodically.
This is less exciting than a giant "best tools" table. It is also much
easier to maintain safely.
Free checklist: have you missed anything?
If you want to check the basics without building your own spreadsheet,
ArtificialGeek's Have I Missed Anything? Security Check is a free
seven-question check for sole traders and tiny businesses.
It does not give you a fake security score. It simply helps you spot
which of the boring basics still needs attention.
Get the free Have I Missed Anything? Security Check
If you think you have already been compromised
Do not work through a generic tool list while an attacker may still have
access.
If money has been sent to a fraudster, contact your bank using its
official details as quickly as possible. If an important account has
been compromised, use the provider's official recovery process. For
ransomware, an ongoing intrusion, serious website compromise or a
sensitive-data incident, move into incident response and get appropriate
professional/official help.
The short version
Small-business cybersecurity does not begin with thirteen downloads.
It begins with knowing which accounts matter, making sign-in harder to
steal, keeping devices current, making recoverable backups, removing
access people no longer need and slowing down suspicious payment/account
requests long enough to verify them.
Then — when you can name a security job that is still unsolved — pick
the tool that solves that job.
That is a smaller toolbox, but a much stronger starting point.
Sources
Last checked: 24 September 2026. Free tiers, features and prices change; check each vendor before relying on a specific tool.
