How I Actually Decide What Cybersecurity Setup Someone Needs
How I Actually Decide What Cybersecurity Setup Someone Needs
People ask me constantly what the best cybersecurity setup is, and they usually want one answer that applies to everyone. There isn't one. A retired couple checking email twice a day needs something completely different from a freelancer juggling five client logins, and both need something different again from a small business handling customer payment details. The mistake I see most often isn't using bad tools, it's using the wrong tools for the actual situation. Here's how I actually work through that decision when someone asks me for a recommendation.
Start With What You're Actually Protecting
Before I recommend anything, I ask what's actually at stake if something goes wrong. Personal email and social media accounts carry a different risk than a laptop full of client contracts, which carries a different risk again than a business handling other people's payment data. This isn't about being dramatic, it's about proportionality. Someone whose biggest exposure is a compromised Instagram account doesn't need the same setup as someone who'd be legally and financially on the hook for a customer data breach. I've had people ask me for the best security software when what they actually needed was a password manager and two-factor authentication turned on, nothing more elaborate than that. Matching the response to the actual exposure is the first decision, and it's the one people skip most often because it's more interesting to talk about tools than to think about what you're actually defending.
The Difference Between a DIY Toolkit and a Managed Service
Once I know what's at stake, the next question is whether someone wants to manage their own security or have someone else handle it. A DIY toolkit means picking your own pieces, a password manager like NordPass, a VPN like NordVPN, antivirus software, and knowing how to keep them updated and configured properly yourself. It's cheaper and gives you more control, but it only works if you'll actually maintain it. I've written separately about how I actually compare antivirus software if you're building this route yourself and want to know what to look for beyond the marketing claims. A managed service means paying someone, whether that's an IT provider or a dedicated security company, to handle monitoring and updates for you. It costs more but removes the maintenance burden entirely. Neither option is inherently better, they solve different problems, and the honest answer to which one you need usually comes down to whether you'll actually keep a DIY setup maintained or whether it'll quietly go stale within a few months.
How Much Technical Comfort You Actually Have Matters
I try to be honest with people about this one, because it's the factor that gets glossed over the most. If the idea of configuring a firewall or reading a software update changelog makes your eyes glaze over, recommending a fully DIY toolkit isn't doing you any favours, even if it's technically the cheaper option. A setup you won't maintain properly is worse than a simpler setup you'll actually keep up with. I've seen people buy genuinely excellent security software and then never update it, never check its settings, and effectively get none of the protection they paid for. If that sounds familiar, the honest recommendation is usually something closer to a managed service or at minimum tools with strong default settings and minimal ongoing configuration, rather than a stack of individually excellent tools that need constant attention to actually work.
Free Tools Are a Starting Point, Not the Whole Answer
A lot of people ask me whether free security tools are good enough, and the honest answer is that they're a reasonable starting point but rarely the complete answer. Free antivirus, free VPN tiers, and built-in browser protections cover real ground and are genuinely better than nothing. Where they tend to fall short is in the details, weaker encryption standards on free VPNs, limited device coverage on free password managers, and slower response to new threats on free antivirus compared to paid tiers that fund more active threat research. I don't think everyone needs to pay for everything, but I do think it's worth being honest about where the free version stops being enough for what you're actually protecting. If you're just browsing casually with nothing sensitive at stake, free tools might genuinely be fine. If you're handling financial logins or client data, the gap between free and paid starts to matter more than the price difference suggests.
When It's Worth Paying for a Managed Provider
The point where I usually recommend bringing in outside help is when the complexity outgrows what one person can reasonably keep on top of alone, multiple staff members, several devices, sensitive customer data, or simply not having the time to stay on top of updates and monitoring yourself. That's not a failure of the DIY approach, it's just a different scale of problem. If you're at that point, I've written separately about the questions I'd ask before hiring any cybersecurity company, which covers how to actually vet a provider rather than just picking whoever pitches the hardest. The goal either way is the same, proportional protection for what you're actually defending, not the most impressive-sounding setup you can find.
There's no universal best cybersecurity solution, only the one that actually matches what you're protecting, how hands-on you want to be, and how reliably you'll keep it maintained. Get honest about those three things first, and the right setup usually becomes obvious rather than something you need to research endlessly. If you want a second, independent source on getting the basics right before deciding on any of this, the NCSC publishes its own guidance for individuals and small businesses, and my free Safety Toolkit covers the rest of what I'd recommend if you want to work through your own setup properly.