The Four Tools I Actually Rely On to Stay Safe Online
The Four Tools I Actually Rely On to Stay Safe Online
People ask me fairly often what security software they actually need, usually expecting a long list. I understand the instinct, there's no shortage of apps and services promising to protect you, and it's tempting to think more tools automatically means more safety. In practice, I've settled on four things I actually use every day, and everything else I've tried over the years has either been redundant, more hassle than it was worth, or solving a problem I didn't really have. Here's what actually earns a permanent place on my devices, and why.
A Password Manager Comes First
If I had to keep only one tool, this would be it, and it isn't close. Every other security habit I have sits on top of this one. Before I started using a password manager properly, I was reusing variations of the same few passwords across dozens of accounts, which meant a single breach anywhere could unlock everything else I owned. A password manager generates a long random password for every account, remembers all of them for me, and fills them in automatically so I never have to type or memorise anything. I've written before about why I finally switched to a password manager, and the honest answer is that I put it off for years for no good reason. It's the one tool on this list I'd tell anyone to install today, before any of the others.
A VPN for the Networks I Don't Trust
A VPN sits in second place, and I'll be upfront that I don't think it needs to run every single second the way a password manager does. What it does well is protect what I'm doing on networks I don't control, coffee shop wifi, hotel wifi, anywhere I'm connecting through infrastructure someone else owns and manages. I've written before about why I run a VPN on every device I own, and while my usage has settled into something less constant than that title suggests, the principle hasn't changed, it's still switched on automatically the moment I'm on a network I didn't set up myself. I use a VPN specifically because it's fast enough that I don't notice it running and it's simple enough that I never have an excuse to skip turning it on.
Antivirus Software I Don't Think About
This is the tool I actually think about least, which is exactly the point. Good antivirus software should run quietly in the background, catch the small percentage of threats that get past everything else, and never demand my attention unless something's genuinely wrong. I use security software across my devices for this reason specifically, it's thorough without constantly interrupting me with upsells or false alarms, which was a real problem with software I'd used previously. I don't think antivirus software is the most important tool on this list, most of what actually puts people at risk is behavioural rather than something a scan catches, but it's a reasonable last line of defence for the malware and dodgy downloads that occasionally slip through despite everything else I do.
Two-Factor Authentication on Everything That Matters
This one is slightly different from the other three because it isn't a piece of software I installed once, it's a setting I turned on individually across every account that matters to me. I don't count it as optional anymore. A strong password from my password manager stops someone guessing their way in, but it does nothing if that password ever gets exposed somewhere I didn't expect, a breach on a site I'd forgotten about, a phishing page that caught me on a bad day. Two-factor authentication is what still holds the door shut even after the password itself has leaked. It costs nothing, takes a few minutes per account, and closes a gap that a password alone genuinely can't.
What I Deliberately Don't Bother With
I want to be honest about what I've left off this list, because I think it says as much as what's on it. I don't run a separate firewall app, since the one built into my operating system does the job without me needing to manage it myself. I don't use ad blockers as a security measure, only as a convenience one, they're not designed to stop the kind of threats that actually cause damage. I've also tried a couple of all-in-one "security suite" products that bundled a weaker version of everything I've already listed into one subscription, and found I preferred using one good tool for each job rather than one mediocre tool for all of them at once. More apps isn't the same as more protection, and a cluttered phone full of security software I don't understand isn't a safer one.
What I'd genuinely recommend is starting with the password manager, since almost everything else on this list becomes easier once that's in place, then adding the rest one at a time rather than trying to overhaul everything in a single weekend. None of these four tools took more than a few minutes to set up individually, and together they cover the overwhelming majority of what actually goes wrong for people online. If you want the fuller version of what I've put in place, including step by step guidance on setting each of these up, I've pulled it together in a free Safety Toolkit, and the NCSC has clear guidance on choosing security software as well if you want a second, independent source to check any of this against.