To choose a small business firewall, write down what traffic it must control, check throughput with the security features switched on, confirm it gets security updates for years, lock down its own management, and make sure you can read its logs. Match the device to your risk and staff time, not to a feature list.
What is a firewall supposed to do?
NIST SP 800-41 Revision 1 defines firewalls as devices or programs that control the flow of network traffic between networks or hosts with differing security postures. The publication surveys several firewall technologies, discusses their relative advantages and disadvantages, and gives recommendations for establishing firewall policy and for selecting, configuring, testing, deploying and managing firewalls. It dates from 2009, so use it for principles and check current vendor documentation for features.
Start there, because the first question is policy, not hardware. What should be allowed in, what out, and between internal segments?
What does your office need?
Take a constructed example: a 25-person accounting firm with one office, a cloud file service, a small server for a legacy application, guest wifi and three remote staff.
Its list might read: block all inbound connections except a VPN endpoint; separate guest wifi from staff devices; restrict the legacy server so only the accounting workstations reach it; filter outbound traffic by category; keep logs for ninety days. Written like that, the requirements become testable, and half of the marketing differences between products drop away.
Which features are worth paying for?
Packet filtering and stateful inspection are the baseline. Inspecting application-layer content, filtering by web category, intrusion prevention, and VPN support are common add-ons. Each one consumes processing power, and many are subscriptions that stop working if unrenewed.
Ask about real throughput with those features enabled, not the headline figure with them off. A device that handles your office link only when inspection is disabled will end up with inspection disabled.
Encrypted traffic complicates inspection. Decrypting it has privacy, legal and performance costs, so decide deliberately whether you need it.
How should you assess security of the device itself?
A firewall is a high-value target. Check how long the maker commits to security updates, how updates are delivered, and whether a vulnerability disclosure process exists. Search the CISA Known Exploited Vulnerabilities catalog for the maker and product family before you buy. Network edge devices do appear there, which is one more reason to decide who can reach yours and how fast you can patch.
Never expose the management interface to the internet. Require multi-factor authentication for administrators, change default credentials on day one, and keep a backup of the configuration somewhere safe.
Managed or do it yourself?
If nobody on staff will read logs or apply updates within days, a managed service or an external partner may fit better than a more capable box you leave alone. A neglected firewall with permissive rules is worse than a simpler one that is maintained.
How to check or apply this
- Write requirements as rules: what is allowed, from where, to where.
- Map your internet link speed and number of users, then ask for measured throughput with your chosen features on.
- Confirm the support period for security updates and the cost of keeping subscriptions current.
- Plan segmentation: staff, guests, servers, devices that cannot be patched.
- Disable remote management from the internet and enable MFA for administrators.
- Send logs somewhere you will actually look, and set alerts for a few clear events.
- Test after install: scan from outside, try blocked paths from inside, and restore the saved configuration once.
- Review rules every quarter and delete the ones nobody can explain.
Where does Safeguard fit?
Safeguard is not a network security product and does not replace a firewall. It helps with the software side of a small company: scanning the code and dependencies of the applications that sit behind the firewall.
Quick check
Is a consumer router enough for a business?
Often it lacks segmentation, logging, update commitments and managed administration. Evaluate it against your written requirements before deciding.
Should a small business buy the fastest firewall available?
No. Size for your link with inspection on, plus some headroom, and spend the rest on updates, logging and someone to look after it.
Sources
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
- CISA Known Exploited Vulnerabilities Catalog
Last reviewed: 18 October 2026.
