Is antivirus still enough to protect an SME?

Many small and medium-sized businesses treat antivirus as a synonym for security: if it is installed and the icon is green, the problem feels solved. It is still a useful layer, but on its own it covers only part of the risks an SME faces today. Understanding what it does, and what it does not do, helps you spend your time and budget more wisely.

What antivirus does well

Traditional antivirus compares files and behaviour against known patterns of malicious software. When it finds something suspicious, it blocks it, quarantines it or alerts the user. Newer solutions, often called anti-malware or endpoint protection, also watch for abnormal behaviour, such as a program that suddenly starts encrypting dozens of files one after another.

This layer is valuable because it:

• stops a large share of the common threats that arrive through attachments, downloads and USB sticks;
• scans web pages and files before they are opened, when configured to do so;
• raises alerts that help whoever looks after IT notice that something is wrong.

The catch is that antivirus reacts to what it can recognise. New threats, attacks that use legitimate credentials and configuration weaknesses get in by other routes.

Where antivirus cannot reach

Many incidents in small businesses do not start with a classic virus. Some common examples:

• Leaked or weak passwords: if someone logs in to the business email account with the correct password, there is no malicious file for the antivirus to detect.
• Out-of-date systems: a known flaw in the router, the server or the browser can be exploited without anything being installed on the user's computer.
• Services exposed to the internet: remote access left open without adequate protection is a door that antivirus does not close.
• Social engineering: a convincing email asking you to change a supplier's bank details carries no malware at all.
• Excessive permissions: if every user is an administrator, a single wrong click has a far greater impact.

None of these scenarios is solved simply by buying a better antivirus product. They call for other measures that complement one another.

Malware protection as part of a set of controls

The UK's Cyber Essentials scheme, created by the NCSC as a baseline for organisations of any size, treats malware protection as one of five technical controls. The other four are firewalls, secure configuration, user access control and security update management. That is precisely the logic: each control covers part of the risk, and it is the combination that reduces exposure consistently. If you would like to see all five together, the article on the five basic cyber security controls introduces each one.

For the malware protection control, the scheme accepts two main approaches, which can be combined:

Anti-malware software

This is the most common route for SMEs. The expectation is not just to have the product installed, but to keep it up to date, configured to scan files when they are opened and to check the web pages being visited, blocking connections to known malicious sites.

Application allow-listing

In this model, only software that has been approved in advance can run on the computer. Unknown programs simply do not execute. It is a more restrictive approach and requires maintenance, but it works well on machines with predictable use, such as shop tills or reception computers.

How to assess what your business has today

Before switching supplier or buying a more expensive solution, it is worth carrying out a simple review:

1. Coverage: do all desktops and laptops, including those used for home working, have active protection? What about the servers?
2. Updates: are the signatures and the software itself updating automatically? Is there any machine that has not updated for weeks?
3. Configuration: is real-time scanning switched on? Is web protection active? Can an ordinary user disable the tool?
4. Central management: is there a dashboard where someone follows the alerts, or does each machine work in isolation, with nobody seeing what happens?
5. Phones and tablets: do the devices that access the business's email and systems use only official app stores, and is their operating system up to date?

Often the problem is not the product but the lack of follow-up. An antivirus that raises alerts nobody reads offers far less than it seems.

What to do next

The short answer to the question in the title is: antivirus is still necessary, but it is not enough. It should be treated as one piece of a minimum set of information security measures for SMEs, not as the whole strategy.

A sensible sequence for most small businesses is to make sure malware protection is active and monitored, then deal with updates, review who has access to what and, finally, ensure there are backups that allow you to recover your data if something gets through every barrier. That last point is covered in the article on backups against ransomware.

Quick checklist

• All computers and servers have active, up-to-date anti-malware.
• Real-time scanning and web protection are enabled.
• Ordinary users cannot disable the protection.
• Someone reviews the alerts regularly.
• Systems and applications receive security updates promptly.
• Day-to-day work is done with accounts that do not have administrator privileges.
• Email and critical systems use two-factor authentication.