---
title: 'Does a Small Business Still Need a Firewall?'
url: 'https://triplepoint.org.uk/guides/does-a-small-business-need-a-firewall'
markdown: 'https://triplepoint.org.uk/guides/does-a-small-business-need-a-firewall.md'
date: '2026-10-28'
description: "With staff in the cloud and working from home, does a small business still need a firewall? What it protects, what it doesn't, and what to buy."
---

# Does a Small Business Still Need a Firewall?

![](https://triplepoint.org.uk/user/pages/guides/does-a-small-business-need-a-firewall/does-a-small-business-need-a-firewall.jpg)

**Yes, if you have an office, shop or site where several people share a network, a small business still needs a proper firewall.** It protects everything on that network, including printers, card machines and cameras that can't run security software directly, and it's the main defence for any system you make reachable from the internet. A business with no office, where everyone works remotely and everything is in the cloud, may not need a firewall appliance, but still needs the firewall on every laptop switched on and potentially a firewall in the cloud to protect hosted resources.

## How many businesses have one?

In the government's [Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026), **74% of businesses said they had firewalls covering their whole IT network as well as individual devices**, rising to 93% of large businesses.

That leaves around one in four with gaps. In small offices, the most common one is relying on whatever router came with the broadband.

## What a firewall protects

A firewall sits between your network and the internet and decides what can pass. A modern business firewall, often called a next-generation firewall, does much more than open and close ports:

- **Blocks attacks at the edge.** Intrusion prevention spots and stops known attacks before they reach your systems.
- **Looks inside encrypted traffic.** Most web traffic is now encrypted, and malware hides in it. A firewall that can't inspect it can't see those threats.
- **Filters the web for everyone on the network,** including visitors and devices you don't manage.
- **Protects devices that can't protect themselves,** such as printers, door entry systems, cameras and older machines.
- **Gives remote staff secure access** to office systems, instead of leaving those systems open to the internet.
- **Shows you what's happening,** so you can see which devices and applications are using your connection.

## What a firewall doesn't do

A firewall is one layer, not the whole answer:

- **It can't see traffic that never passes through it.** A company laptop at an employee's home is often outside its view - although there are ways to cover that too!
- **It doesn't stop someone handing over their password.** Phishing and stolen passwords are the most common way in, which is why [identity protection](https://triplepoint.org.uk/security/detect-and-respond/identity-protection) and multi-factor authentication matter as much.
- **It only watches the edge.** Once an attacker is inside, they move between machines on your internal network. [Network detection](https://triplepoint.org.uk/security/detect-and-respond/network-detection) watches internal and external traffic within the network and can uncover suspicious activity.
- **It isn't set and forget.** A firewall facing the internet is a target in its own right. In February 2025 the NCSC and its international partners [warned of an increasing number of sophisticated attackers targeting vulnerabilities in edge devices](https://www.ncsc.gov.uk/news/cyber-agencies-unveil-new-guidelines-to-secure-edge-devices-from-increasing-threat), the equipment that sits between your network and the internet. An unpatched firewall can become the way in.

## Isn't my broadband router a firewall?

Partly. The router your broadband provider supplied blocks unsolicited traffic coming in, which is useful. But it doesn't inspect the traffic you do allow, filter websites, detect intrusions or provide secure remote access, and it's rarely kept up to date.

A problem we often see is the opposite one: a business firewall bought years ago whose security subscription has lapsed. It still passes traffic, so nobody notices, but it's no longer getting updates or doing most of what it was bought for.

## When you might not need one

You may not need a firewall appliance if all of these are true:

- Nobody works from a shared office, shop or site.
- Your email, files and business applications are all in the cloud, such as Microsoft 365 or Google Workspace.
- You don't host anything yourself, such as a server, CCTV system or phone system.

In that case, put the effort into the devices and accounts instead: the firewall switched on on every laptop, [device protection](https://triplepoint.org.uk/security/devices/malware-protection), multi-factor authentication on every account, and [disk encryption](https://triplepoint.org.uk/security/devices/disk-encryption) in case a laptop is [lost or stolen](https://triplepoint.org.uk/guides/lost-laptop-encryption). If you open an office later, revisit this.

## What to look for in a business firewall

Whatever brand you choose, a good small business firewall should:

1. **Be a business product, with a security subscription,** so it keeps receiving threat updates. Check what stops working if the subscription ends.
2. **Inspect encrypted traffic** without slowing your connection down.
3. **Be sized to your internet connection and number of users,** with all security features switched on, not just its headline speed.
4. **Be managed from the cloud,** so it can be updated and checked without someone being on site.
5. **Have a published end-of-life date** that's years away, so you know how long it will be supported.
6. **Work with your other security,** so it can, for example, cut an infected laptop off the network automatically.
7. **Provide secure remote access** for staff, ideally [zero trust access](https://triplepoint.org.uk/security/network/remote-access) rather than only a traditional VPN.

And whoever installs it, make sure someone is responsible for applying updates and checking it after that.

## What it costs

A business firewall is a hardware appliance plus a subscription for its protection features. With us, a [Sophos Firewall](https://triplepoint.org.uk/security/network/firewall) subscription is from £22 a month per device, excluding VAT, plus the appliance itself, which depends on the size of your connection and how many people use it. Installation and configuration is at our standard day rate, or your own IT provider can do it.

## Where we can help

We can look at what you have now, tell you honestly whether you need a firewall at all, and size one to your office if you do. It's managed from the same console as your [Wi-Fi and switches](https://triplepoint.org.uk/security/network/wifi-and-switching) and device protection, so they can work together. [Talk to us](https://triplepoint.org.uk/contact?about=Firewall) about your network.

## Questions

 Do I need a firewall if I have antivirus?+They do different jobs. Antivirus protects each device it's installed on. A firewall protects the network as a whole, including printers, cameras and other equipment that can't run antivirus. An office with several people sharing a network usually needs both.

 Do Windows and Mac computers have a firewall built in?+Yes. Windows has Microsoft Defender Firewall, switched on by default. Macs have a built-in firewall too, but it's usually off until you turn it on in System Settings > Network > Firewall. These protect the individual computer, not the rest of your network.

 Do staff working from home need a firewall?+They will likely have a router from their ISP, already. This is a basic router and firewall, combined and can help keep the Internet out of their home network. It's a good idea to make sure the firewall on each work laptop is also switched on, keep device protection up to date, and give them secure access to office systems via a VPN or secure browser rather than leaving those systems open to the internet.

 How long does a business firewall last?+Until the manufacturer stops providing security updates for it, which is published as an end-of-life date. After that it keeps working but stops being patched, so replace it before then. As it controls your network perimeter, it's critical to keep it up to date.

 Where to go next- [Next-generation firewall](https://triplepoint.org.uk/security/network/firewall)
- [Secure Wi-Fi and switching](https://triplepoint.org.uk/security/network/wifi-and-switching)
- [Network detection and response (NDR)](https://triplepoint.org.uk/security/detect-and-respond/network-detection)
- [Secure remote access (zero trust)](https://triplepoint.org.uk/security/network/remote-access)

[< Back to Guides](https://triplepoint.org.uk/guides)

## Not sure what you need?

Tell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon.

[Talk to us](https://triplepoint.org.uk/contact)
or
[See every security area](https://triplepoint.org.uk/security)

Our experts spent 20 years at Sophos and include a certified ethical hacker.
[More about us](https://triplepoint.org.uk/about)

---

## Navigation

- Parent: [Cyber Security Guides for UK Small Businesses](https://triplepoint.org.uk/guides.md)
- Previous: [Cyber Insurance Requirements: What UK Insurers Ask](https://triplepoint.org.uk/guides/cyber-insurance-requirements-uk.md)
- Next: [How to Spot a Phishing Email: A Guide for Staff](https://triplepoint.org.uk/guides/how-to-spot-a-phishing-email.md)