You can build a useful cybersecurity baseline without buying a security suite: turn on multifactor authentication (MFA), use a different strong password for each account, install updates, back up important files, and learn to spot phishing. These steps are not a guarantee against every attack, and some services or storage options may charge for additional features. But for many people, they are the right place to start.
What essential cybersecurity can you do for free?
Start with protections already available in your accounts and devices. The U.S. National Institute of Standards and Technology (NIST) lists foundational practices such as strong passwords, backups, changing default passwords, software updates, and awareness of phishing and ransomware. Its small-business guidance also recommends considering a password manager; it does not require a particular product or a paid subscription. NIST Cybersecurity Basics
As an Amazon Associate I earn from qualifying purchases.
- Secure important accounts: Enable MFA wherever it is offered, especially for email, banking, health care, and other sensitive accounts. Email is particularly important because it can be used to reset passwords for other services. CISA’s MFA guidance advises turning it on for every account or app that offers it.
- Use unique passwords: Avoid reusing passwords across accounts. If remembering them is difficult, consider a password manager; compare its capabilities and terms rather than assuming a paid plan is necessary.
- Install updates: Keep your operating system, browser, apps, and device software current. Turn on automatic updates when practical, and don’t ignore update prompts from the software or device maker.
- Back up important data: Use a backup option available to you and check its storage limits, settings, and recovery process. A synced folder is not always the same as an independent backup: deletions or unwanted changes can sync too.
- Replace default passwords: Change factory-set credentials on routers and other devices, and use a unique password. Follow the manufacturer’s instructions for the device.
- Pause before responding to messages: Treat unexpected links, attachments, payment requests, and password-reset prompts with care. Go to the service’s official app or website yourself instead of using a link in a message you did not expect.
Which free MFA option should you choose?
MFA requires more than one kind of proof to sign in—for example, a password plus a code or a security key. It can make an account harder to take over if a password is exposed. Use the strongest option the service supports and that you can reliably recover. CISA’s guidance for small businesses describes security keys as its strongest phishing-protection method among the options it discusses. CISA: Require Multifactor Authentication
| Method | What to consider |
|---|---|
| Physical security key | CISA identifies this as a strong phishing-resistant option. Check that both the account and your device support the key, and understand how you would sign in if it is lost. It is optional; a key may involve a purchase. |
| Authenticator app with number matching | CISA lists number matching among its MFA options. Check whether the service supports it and how you can restore access if you change or lose your phone. |
| Authenticator app with one-time codes | Codes from an authenticator app are another option. Confirm the service’s setup and recovery steps before relying on the app as your only second factor. |
| Biometrics | CISA includes biometrics among the methods it discusses and says they are best paired with another factor. Availability and setup depend on the service and device. |
| Text or email codes | CISA lists these as the weakest options among the methods it describes. If they are all a service offers, enabling them can still be preferable to leaving MFA off. |
The exact choices vary by account. Check the service’s security settings and recovery instructions before switching methods. CISA’s business guidance says organizations should aim to use phishing-resistant MFA; for an individual, a supported security key is worth considering when stronger protection is important and the account works with it. CISA’s Four Cybersecurity Essentials for SLTTs was published August 29, 2025; its government-focused scope should not be mistaken for a consumer product recommendation.
#1 Best Overall
Do you need to pay for antivirus?
The official guidance cited here does not establish that a paid antivirus product is necessary for every person or device. NIST includes maintained antivirus in its small-business basics, while the Federal Trade Commission (FTC) advises getting security software from a reliable company and keeping it updated. Choose software that fits your operating system, comes from a trustworthy source, and provides features you actually need. Don’t assume a higher price means a better fit, or that every feature advertised is essential. FTC: Protect Your Computer from Malware
Be cautious about where you download security software. The FTC warns that a free download can hide malware: use a trusted source, and do not buy software because of an unexpected call or message claiming your computer is infected. If you are unsure whether a warning is genuine, close it and check through the device maker or software provider’s official site.
Where can you get free cybersecurity help?
Government resources can help you learn without requiring a purchase. CISA provides small- and medium-sized-business factsheets and training resources, and lists SCuBA, a no-cost tool for assessing and hardening supported software-as-a-service configurations. That tool is aimed at supported business environments; it is not a general consumer security app, and its availability does not mean every commercial feature is free or endorsed. CISA small-business resources
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
NIST also indexes free and low-cost online cybersecurity learning materials. Its phishing guidance explains the risks and protective practices for small businesses; individuals can use it as general learning material, while keeping in mind its intended audience. NIST learning resources and NIST phishing guidance.
Rank #3
When might an optional purchase make sense?
Paying can make sense when a specific gap remains after you have used the free settings and guidance available to you. A physical security key may be useful if an important account supports it and you want a phishing-resistant MFA method. A password manager may help if you need a practical way to generate and keep track of unique passwords. In either case, check compatibility, recovery arrangements, and the actual terms before spending money. Neither is a prerequisite for taking the basic steps above.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
