Does a small business still need a firewall?

Yes, if you have an office, shop or site where several people share a network, a small business still needs a proper firewall. It protects everything on that network, including printers, card machines and cameras that can't run security software directly, and it's the main defence for any system you make reachable from the internet. A business with no office, where everyone works remotely and everything is in the cloud, may not need a firewall appliance, but still needs the firewall on every laptop switched on and potentially a firewall in the cloud to protect hosted resources.

How many businesses have one?

In the government's Cyber Security Breaches Survey 2025/26, 74% of businesses said they had firewalls covering their whole IT network as well as individual devices, rising to 93% of large businesses.

That leaves around one in four with gaps. In small offices, the most common one is relying on whatever router came with the broadband.

What a firewall protects

A firewall sits between your network and the internet and decides what can pass. A modern business firewall, often called a next-generation firewall, does much more than open and close ports:

• Blocks attacks at the edge. Intrusion prevention spots and stops known attacks before they reach your systems.
• Looks inside encrypted traffic. Most web traffic is now encrypted, and malware hides in it. A firewall that can't inspect it can't see those threats.
• Filters the web for everyone on the network, including visitors and devices you don't manage.
• Protects devices that can't protect themselves, such as printers, door entry systems, cameras and older machines.
• Gives remote staff secure access to office systems, instead of leaving those systems open to the internet.
• Shows you what's happening, so you can see which devices and applications are using your connection.

What a firewall doesn't do

A firewall is one layer, not the whole answer:

• It can't see traffic that never passes through it. A company laptop at an employee's home is often outside its view - although there are ways to cover that too!
• It doesn't stop someone handing over their password. Phishing and stolen passwords are the most common way in, which is why identity protection and multi-factor authentication matter as much.
• It only watches the edge. Once an attacker is inside, they move between machines on your internal network. Network detection watches internal and external traffic within the network and can uncover suspicious activity.
• It isn't set and forget. A firewall facing the internet is a target in its own right. In February 2025 the NCSC and its international partners warned of an increasing number of sophisticated attackers targeting vulnerabilities in edge devices, the equipment that sits between your network and the internet. An unpatched firewall can become the way in.

Isn't my broadband router a firewall?

Partly. The router your broadband provider supplied blocks unsolicited traffic coming in, which is useful. But it doesn't inspect the traffic you do allow, filter websites, detect intrusions or provide secure remote access, and it's rarely kept up to date.

A problem we often see is the opposite one: a business firewall bought years ago whose security subscription has lapsed. It still passes traffic, so nobody notices, but it's no longer getting updates or doing most of what it was bought for.

When you might not need one

You may not need a firewall appliance if all of these are true:

• Nobody works from a shared office, shop or site.
• Your email, files and business applications are all in the cloud, such as Microsoft 365 or Google Workspace.
• You don't host anything yourself, such as a server, CCTV system or phone system.

In that case, put the effort into the devices and accounts instead: the firewall switched on on every laptop, device protection, multi-factor authentication on every account, and disk encryption in case a laptop is lost or stolen. If you open an office later, revisit this.

What to look for in a business firewall

Whatever brand you choose, a good small business firewall should:

1. Be a business product, with a security subscription, so it keeps receiving threat updates. Check what stops working if the subscription ends.
2. Inspect encrypted traffic without slowing your connection down.
3. Be sized to your internet connection and number of users, with all security features switched on, not just its headline speed.
4. Be managed from the cloud, so it can be updated and checked without someone being on site.
5. Have a published end-of-life date that's years away, so you know how long it will be supported.
6. Work with your other security, so it can, for example, cut an infected laptop off the network automatically.
7. Provide secure remote access for staff, ideally zero trust access rather than only a traditional VPN.

And whoever installs it, make sure someone is responsible for applying updates and checking it after that.

What it costs

A business firewall is a hardware appliance plus a subscription for its protection features. With us, a Sophos Firewall subscription is from £22 a month per device, excluding VAT, plus the appliance itself, which depends on the size of your connection and how many people use it. Installation and configuration is at our standard day rate, or your own IT provider can do it.

Where we can help

We can look at what you have now, tell you honestly whether you need a firewall at all, and size one to your office if you do. It's managed from the same console as your Wi-Fi and switches and device protection, so they can work together. Talk to us about your network.

< Back to Guides