Do you need antivirus software or a VPN for your small business?
Antivirus software is a sensible tool for the computers and phones a business uses, and a VPN is worth considering if staff reach the business network from outside the office. Neither replaces updates, a second sign-in step, backups and staff training, which are usually the higher priorities. CISA and the FTC both say to keep security tools updated, and the FTC says to consider a VPN for remote access.
What each tool does and does not do
These descriptions are general advice in owner terms. Products differ, so check what a particular one covers.
| What it does | What it usually does not do | |
|---|---|---|
| Antivirus or antimalware | Looks for and blocks known harmful software on a device | Stop a person being tricked into giving away a password or paying a fake invoice, or make a weak password strong |
| VPN | Sends a device's traffic through a protected connection to the business network, so it is harder for others to read on public or home Wi-Fi | Clean a device that is already infected, or stop a phishing message from working |
What the FTC and CISA say
CISA's page "Update Business Software" says to confirm that the organization's entire network is protected by antivirus/antimalware software, and to prioritize updates for these tools. The related answer on keeping computers and phones updated covers the rest of that page.
The FTC's page "Cybersecurity for Small Business" (dated September 2025) has a section on the NIST Cybersecurity Framework and lists, under its Protect function, "Update security software regularly, automating those updates if possible". In its section on secure remote access it says to consider creating a VPN for employees and vendors to use, and that VPNs can help protect a business from outside attacks.
What usually matters more
As general advice, put the basics ahead of any purchase: install updates, turn on a second sign-in step, keep backups you have tested, and teach staff to spot a suspicious message. The related answer on basic cybersecurity steps covers CISA's list, which includes each of these. The related answer on keeping computers and phones updated covers the update routine. No tool, and no checklist, can promise to stop every attack.
Working from home more safely
The FTC's remote access guidance says employees and vendors should use a router with WPA2 or WPA3 encryption when connecting from home, and that the router's software should be kept up to date; the related answer on employees using their own phones and laptops covers the devices themselves. It also says to tell staff about the risks of public Wi-Fi.
If a provider sells a bundle
The related answer on managed IT support covers reading the agreement. Ascent Vision does not publish prices.
- Which devices does it cover, and do phones and tablets count?
- Do you already have protection built in or paid for elsewhere, so the bundle does not double up?
- Who receives the alerts, and who acts on them?
- Whose name is the account in, and can you see and export what it holds?
- How do you cancel, and what happens to the devices afterward?
Sources
Related answers
- What are the basic cybersecurity steps for a small business?
- How do you keep business computers and phones updated, and when should you replace them?
- What is managed IT support, and what should it include?
- Can employees use their own phones and laptops for work, and what if one is lost?
Ongoing technical support
The site goes down, email stops arriving, a domain is about to lapse, nobody knows the password. Many owners do not have a technical person. We are that person, for everything we build and the things you already have.