A firewall controls which network connections are allowed between systems, based on rules. Antivirus examines files and running programs on one device for malicious behavior. They answer different questions, so neither replaces the other. Run both, and add patching and sign-in controls that neither provides.
What does a firewall do?
NIST SP 800-41 Rev. 1 describes firewalls as devices or programs that control the flow of network traffic between networks or hosts with different security postures. The simplest form filters packets by source and destination address, protocol and port. More capable forms track connection state or act as an intermediary for specific applications.
The practical effect: a service nobody should reach, such as a database port, simply does not answer from outside. A firewall can also limit outbound traffic, which matters when a compromised machine tries to contact a remote controller.
A host based firewall does the same job on one machine, which is useful on laptops that leave the office network.
What does antivirus do?
Antivirus software scans files, and watches process behavior, for known malicious patterns and suspicious actions. When it finds a match it blocks, quarantines or alerts. It sits on the endpoint, so it sees what arrives by email attachment, USB stick, download or a web page that the firewall allowed through.
Where do they differ?
Where it sits. A firewall sits at the network edge, between segments or on the host. Antivirus sits on each endpoint or server.
What it looks at. A firewall looks at connections, addresses, ports and sometimes application content. Antivirus looks at files, memory and process behavior.
What it stops. A firewall stops unwanted inbound access and some outbound abuse. Antivirus stops malware that reaches the device.
What it misses. A firewall misses malware carried inside allowed traffic, such as a web download. Antivirus misses attacks that use no malicious file, such as stolen passwords.
Constructed example: one phishing email, two controls
An employee receives an email with a link. They click it and download a document over normal web traffic on port 443. The firewall sees an ordinary outbound web connection and allows it, as policy says it should. Antivirus inspects the file, recognizes a malicious macro and blocks it.
Now change the scenario. The employee types a password into a fake sign-in page. No file is downloaded. Antivirus has nothing to scan, and the firewall sees a normal web session. Both controls stay quiet. The defense here is multi factor authentication and mail filtering.
The example is invented, but it shows why the pair is not enough on its own.
How do they fit with other controls?
CISA's guidance on denial of service attacks lists firewalls to restrict incoming and outgoing traffic and maintained antivirus software together in the same prevention list, along with monitoring and a recovery plan. That is the right framing: they are layers in one set of habits.
Add patching, because exploits against unpatched software run inside trusted programs. Add least privilege so one compromised account cannot reach everything. Add backups you have tested.
Developers have one more gap. A package pulled during a build executes on the build machine, so a malicious dependency never looks like an attack on the network. Safeguard's dependency scanning checks packages before they reach a build, which sits outside both categories above.
How to check or apply this
- List the network zones you have and write the firewall rule that allows each needed flow. Deny the rest.
- Review rules twice a year and delete the ones nobody can explain.
- Enable the host firewall on laptops and servers.
- Confirm antivirus is installed, updating and reporting on every device.
- Add multi factor authentication to email and remote access.
- Patch operating systems and browsers on a schedule.
- Test restoring a backup.
Quick check
If I have a firewall, do I still need antivirus?
Yes. A firewall cannot tell that a file arriving over allowed web traffic is malicious. Antivirus looks at the file and the program that runs it.
Can antivirus replace a firewall?
No. Antivirus does not decide which network connections are permitted, so exposed services stay exposed without a firewall.
Sources
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
- CISA, Understanding Denial of Service Attacks
Last reviewed: 18 October 2026.
