"We have antivirus" is a starting point, not a complete security plan. Business owners often use the word virus to mean any harmful software. Malware is the broader term and includes threats such as ransomware, which can disrupt access to business information.
No product can promise that malware will never reach a device. The goal is to reduce opportunities, detect suspicious behavior, and respond before the damage grows.
Close the easy entry points
Keep supported operating systems, browsers, business applications, and device software updated through an accountable process. Verify that updates actually install, and plan replacements for systems the vendor no longer supports.
Limit software installation to approved sources and appropriate users. Unexpected downloads, fake support prompts, and software from unfamiliar advertisements deserve scrutiny. Microsoft's cybersecurity overview recommends current software, reputable security tools, and caution around links and attachments. [1]
Manage protection, rather than just installing it
Ask who verifies that protection is running, reviews alerts, and responds when a device becomes unhealthy. Depending on the environment, endpoint detection and response can add investigation and response capabilities beyond a basic antivirus installation.
That does not make every alert proof of infection, or justify stacking incompatible security tools on a computer. Select and manage the controls together, and make sure somebody owns the exceptions.
Reduce the damage an account can do
Use ordinary user access for everyday work and reserve administrative privileges for approved tasks. Protect important sign-ins with strong authentication. MFA and passkeys help defend accounts, but they are not antivirus and do not remove malicious software from a device.
Email and web protections can reduce exposure. They should complement employee judgment, not create an expectation that anything reaching an inbox must be safe.
Make reporting easy
Employees need a known support route and permission to report a click, download, or unexpected prompt promptly. Ask them to describe what happened without trying to repair everything first.
A browser warning with a telephone number is not a reason to call an unknown support service or grant remote control. Use your established IT contact, ideally from another trusted device when the affected one may be compromised.
Keep recovery separate from prevention
CISA's ransomware guidance recommends protected backups, restoration testing, updates, restricted privileges, and an incident-response plan. Backup copies need protection from the same access or attack that affects production data. [2]
A tested backup helps recovery, but a restore does not automatically establish that an attacker has been removed. Containment, investigation, and restoration need coordination.
What to do when you suspect an infection
Stop using the affected device for sensitive work and contact IT immediately. Follow the organization's response procedure. When encryption or other destructive activity is actively occurring and help is not immediately available, isolating the device from the network can limit spread; do not independently wipe it or begin restoring files. CISA prioritizes isolating affected systems and coordinated response. [2]
Avoid repeated rebooting or cleanup attempts unless the incident lead directs them, because they can interfere with investigation. Record the visible warning and approximate time without copying confidential information into an unsecured channel.
Blue Tree Technology® can help assess prevention, monitoring, and recovery as one managed process. The useful question is not "Which product guarantees no viruses?" It is "Who makes sure our layers work, and what happens when one fails?"
Verification links
[1] Microsoft: What is cybersecurity?
[2] CISA and partner agencies: #StopRansomware Guide