Yes, keep antivirus on in 2026, but for most small businesses the copy that already ships with Windows or macOS is enough if it is updated. The incidents that actually hurt SMEs are usually phishing, reused passwords and no multi-factor authentication, not a 2005-style virus. Paid antivirus can add central control when you have many devices, but it will not save a firm that clicks a fake invoice and has no backup. Treat antivirus as one layer, and spend more attention on email habits, unique passwords, MFA and a restore you have tested.
What actually hits small businesses?
The boring list, because the boring list is the real one:
- Phishing. An email that looks like a supplier, a bank, Microsoft, HMRC or “the boss”. Someone enters a password or pays a new account number. No exotic malware required.
- Stolen or reused passwords. One leak on a shopping site opens the mailbox, and the mailbox resets everything else.
- No MFA. A password alone is enough. That is still common.
- Unpatched software. A prompt ignored for months. Attackers use known holes. They do not need a custom exploit for a firm that never clicked Update.
- Ransomware and simple deletion. Often after one of the above, or after a lost laptop. Painful if there is no backup. Recoverable if there is.
Traditional viruses still exist. They are not the main story for a five-person office in Sussex. Scare pages that lead with “cybergeddon” and a made-up percentage are selling you fear. I am not going to invent statistics. You can read the National Cyber Security Centre’s small-business guidance if you want a public-sector view. The practical takeaway is the same: email, identity, updates, backup.
A longer walk through the habits sits in cyber security basics for small business.
Is Microsoft Defender enough on Windows?
For a typical small firm, yes. Microsoft Defender is built into current Windows. It stays on, it gets updates with Windows Update, and it handles the everyday malware that used to require a box from a supermarket. If you have switched it off to install a trial that then expired, turn Defender back on. Two antivirus engines at once are a mess. One good one is enough.
Paid suites add extras: a pretty dashboard, a VPN, a password manager, web filters, and management across many PCs. Those extras can be useful. They are not a requirement for “being protected”. A password manager and MFA on email will do more than a gold badge in the system tray.
Defender is not a substitute for:
- MFA on Microsoft 365 or Google.
- A policy that staff do not approve mystery authenticator prompts.
- Keeping Windows and Chrome (or Edge, or Firefox) on automatic update.
- Not running as a full administrator for daily mail.
If an insurer or a client asks “do you have antivirus?”, Defender counts. Write it down. Do not buy a product only to tick a questionnaire if Defender is already on.
Do Macs need antivirus in 2026?
Macs are not immune. They are targeted less than Windows, and Apple’s built-in protections (Gatekeeper, XProtect, notarisation, a tighter permission model) are strong when you keep macOS up to date. For most small businesses using Macs as normal office machines, that built-in stack plus the same habits (MFA, unique passwords, updates, backups) is a reasonable position.
Paid Mac antivirus is optional, not a moral duty. Consider it if you routinely open random attachments from strangers, or if you manage a mixed fleet and want one console. Do not assume a Mac is “safe so we can skip MFA”. Account takeover does not care which logo is on the lid.
iPhones and iPads in the business should be updated too. The risk there is still a phishing page in Safari, not a desktop virus.
Where do backups fit?
Antivirus tries to stop bad software running. Backups try to make the bad day recoverable. You need both ideas. A clean Defender log does not bring back the only copy of last year’s invoices on a dead drive.
A simple rule still holds: three copies of important data, on two kinds of storage, with one copy off the machine (cloud or a disk that does not stay plugged in). Then restore a file on purpose, once, so you know the copy works. An untested backup is a story you tell yourself.
Where the files live matters. If everything is already in Microsoft 365 or Google Workspace, you still need to understand version history, deleted-item retention, and what is not in the tenant (a desktop folder called “scan” that never synced). If you only have a USB disk in the same bag as the laptop, you have one incident waiting to happen.
I have a separate post on how to back up your business data if you want the mechanics. The antivirus question and the backup question get sold as one scary bundle. They are two jobs.
What should a sensible 2026 setup look like?
For a small UK business with a handful of PCs or Macs:
- Leave the built-in antivirus on. Update the operating system automatically.
- Turn on MFA for email and for any admin login. Prefer an authenticator app over SMS where you can.
- Use a password manager so staff are not recycling
Summer2024!. - Spend thirty minutes a year showing people a fake invoice and a fake “your mailbox will close” email. Urgency is the tell.
- Keep a backup you have restored from.
- Have a leaver process: disable the account the same day.
That list is mostly free. Paid antivirus belongs on it when a single console for twenty devices would save someone a headache, or when a contract insists on a named product. It does not belong on it as a substitute for MFA.
Page Forge can review that baseline as a project and write down the gaps. Quoted per project. We are not a managed security provider, we do not watch your network overnight, and we do not run a helpdesk. See IT and AI consulting. Website care is a different product: £99 to set up a one-page site and £29 a month, or £299 a year.
When is paid antivirus worth buying?
Buy, or let an MSP include it, when:
- You have enough devices that you cannot tell whose protection is off.
- You want web filtering for a shared space, and you accept it will annoy someone.
- A customer or insurer specifies a product family you do not already meet with Defender.
Skip the annual full-page advert that implies last year’s suite is now useless. Check whether Defender or XProtect is already doing the job. Spend the money on a password manager and on time to turn MFA on if those are still outstanding.
Frequently asked questions
Is the free antivirus in Windows good enough in 2026?
For most small businesses, yes. Microsoft Defender is capable and stays current with Windows Update. Paid tools add management and extras. They are not the difference between safe and unsafe if MFA and backups are missing.
If antivirus is not the main defence, what is?
Identity and habits. Unique passwords, MFA on email, a team that pauses on urgent payment-change emails, updates, and a backup you can restore. Those stop more real incidents than a second scanner.
Do I need antivirus on a Mac?
You need the Mac’s built-in protections left on and the system updated. Extra antivirus is optional for a normal office Mac. You still need MFA and backups. A Mac is not a free pass.
Will antivirus stop phishing?
Sometimes it will block a known bad link. Often the page is new, or the email only asks you to type a password. People and MFA stop phishing. Treat unexpected payment details as a phone call to a number you already have, not a click.
How much does a security review cost at Page Forge?
IT work is quoted per project. There is no monthly monitoring contract here. Look at IT and AI consulting and describe what you have. We will not invent a package price in a blog post.
Should I turn off Defender if I install another brand?
You normally let Windows sort the conflict so only one real-time engine runs. Do not run two at full tilt. If you later remove the paid product, check that Defender came back on.
Are small businesses really targeted?
Plenty of attacks are automated and indiscriminate. They look for easy mailboxes and easy remote access, not a famous name. Being small is not invisibility. It can mean fewer people watching the inbox. The fix is the short list above, not a frightening headline.
If you want a calm review of what is on, what is missing, and what is worth paying for, that is a scoped conversation. See IT and AI consulting or get in touch. Bring a list of devices and where email lives. Leave the scare stories at the door.