No, antivirus alone is not enough for a small business. It catches known malware on a device, but most small business incidents also involve stolen passwords, unpatched software, misconfigured accounts or a missing backup. Treat antivirus as one control inside a short, written baseline.
What does antivirus actually do?
Antivirus and its newer endpoint variants inspect files and processes on a device and block what matches known bad behavior. That matters, because commodity malware is common and cheap to buy. But the tool only sees the device it runs on. It does not see your email accounts, your cloud storage, your website, or the laptop an employee uses at home and never enrolled.
What does it miss?
Consider a constructed example. A six person design studio runs antivirus on every laptop. An employee reuses a password from another site, and it appears in a breach. An attacker signs in to the studio's email with it. No malware is involved, so nothing fires. The attacker reads invoices and emails a client new bank details. The antivirus was working all along.
MITRE ATT&CK catalogs this pattern as Valid Accounts, where adversaries obtain and abuse credentials of existing accounts. Its listed mitigations are not antivirus. They are multi-factor authentication, sensible password policies, and limits on where accounts can sign in from.
What does CISA suggest small businesses start with?
CISA's Cyber Essentials is written for leaders of small businesses and local government agencies. It frames the work as six elements: yourself, your staff, your systems, your surroundings, your data and your crisis response. The actions for your systems include maintaining inventories of hardware and software, turning on automatic updates, applying secure configurations, removing unsupported software, and using allow listing so that only approved software runs.
Notice that allow listing and updates sit next to, not instead of, malware scanning. The idea is to shrink what an attacker can use, then catch what remains.
Where should a small business put its effort first?
Less than most vendors suggest, and in a different order. The cheapest wins are mostly settings, not products: MFA on email and finance accounts, automatic updates, a password manager, and a tested backup stored somewhere an attacker on your network cannot erase. Antivirus fits in after those, because it handles the cases the settings do not.
If your business ships software or uses open source packages in a product, add one more item: know which third party components you depend on, since a vulnerable library is a risk that a device scanner never sees.
Do not forget the devices antivirus never sees. Phones, shared tablets and a contractor's laptop can all hold company email. Decide which of them may access business data, and apply the same account protections to all of them. A shared mailbox that three people sign in to with one password is another common blind spot, because nobody can tell which person's session is the attacker's.
Finally, plan for the bad day. Antivirus will sometimes miss something, so decide in advance who can isolate a laptop, who resets passwords, and who calls the bank or the insurer. A short, printed contact sheet beats a search through a mailbox the attacker may already be reading. Small teams recover faster when the first hour has a script.
How to check or apply this
- List every device, account and online service the business depends on. A spreadsheet is fine.
- Turn on MFA for email, banking, payroll and admin consoles first.
- Enable automatic updates on operating systems, browsers and apps. Remove software that no longer gets updates.
- Keep a backup that is offline or immutable, and restore a file from it once to prove it works.
- Keep antivirus or endpoint protection running on every managed device.
- Write one page on who to call and what to do if an account is taken over.
- Review the list every quarter.
Quick check
Does antivirus stop phishing?
Only partly. It may block a malicious attachment, but it will not stop someone entering a password on a fake sign-in page. MFA and staff awareness cover that gap.
What is the single most useful addition to antivirus?
Multi-factor authentication on email and financial accounts, because stolen credentials are a common way in and need no malware at all.
Sources
Last reviewed: 18 October 2026.
