Defense in depth — not one product, multiple controls.
No single security product stops all attacks. Layered security means multiple controls that each catch different threats — perimeter firewall, endpoint protection, email security, backup, user awareness. Each layer catches what the others miss.
Business firewall
The perimeter — where your network meets the internet. Business firewall (Sophos, SonicWall, FortiGate) with stateful inspection, IPS, application control, web filtering, gateway antivirus. Much more than consumer router "firewall" features.
Network segmentation
VLANs to isolate departments, guests, IoT devices, security-sensitive systems. A compromised guest device can't access accounting servers. Limits blast radius when something goes wrong.
Endpoint protection
Modern EDR (endpoint detection and response) on every workstation — Sophos Intercept X, SentinelOne, Bitdefender GravityZone, or Microsoft Defender for Business. Behavioral detection beyond traditional signature-based antivirus.
Secure remote access
VPN for remote workers with MFA. Site-to-site VPN between offices. SSL VPN for occasional access from any device. All firewall-terminated and logged. No exposed RDP or unprotected file shares to the internet.
Email security
Most attacks arrive via email — phishing, malware attachments, business email compromise. Advanced email filtering (via Google Workspace / M365 or third-party) catches most before they reach users. Layered with user training.
Wireless security
WPA2/WPA3 with strong pre-shared keys or enterprise authentication. Guest network isolated from business network. Rogue AP detection. IoT devices on isolated VLAN with controlled access.
Three main options.
Sophos XG/XGS
Strong SMB features, integrated with Sophos endpoint security. Central management via Sophos Central. Good balance of features, usability and cost. Popular for growing SMEs.
SonicWall
Long-standing SMB firewall specialist. Wide product range covering very small offices to mid-enterprise. Comprehensive security services. Widely deployed — plenty of expertise available.
Fortinet FortiGate
Enterprise-grade capability. FortiGate + Fortinet Security Fabric integration. Higher complexity but more powerful. Better fit for larger businesses or high-security requirements.
All three do the core job well. Choice depends on size, budget, complexity and existing ecosystem.
Not enterprise overkill for small offices.
Small businesses often get sold enterprise-grade security they don't need — and don't actually implement properly because complexity exceeds the team's capacity. Better: right-sized security that's actually deployed and maintained.
Small office (5-25 seats)
Right-sized: SMB-grade firewall (Sophos XG 106/136, SonicWall TZ series), basic VPN for remote access, business-grade endpoint AV, guest WiFi isolation, backup with off-site component.
Overkill: Enterprise NGFW with SD-WAN, dedicated SOC monitoring, comprehensive SIEM, formal ISO 27001 program.
Mid-size (25-100 seats)
Right-sized: Mid-tier firewall with advanced services, structured VPN with MFA, EDR endpoint security, VLAN segmentation, email security add-on, tested backup with immutable storage.
Consider: Basic security awareness training, incident response procedure documentation.
Larger (100+ seats)
Right-sized: Enterprise firewall or HA firewall pair, full EDR with monitoring, comprehensive email security, network access control, identity management integration, formal incident response.
Consider: Formal security program, regular penetration testing, compliance certifications.
Regulated sectors
Legal, healthcare, financial services — higher security bar regardless of size. Data classification, encryption at rest and in transit, formal access controls, audit trails, compliance-aligned procedures.
Note: Compliance-driven requirements often exceed what business size alone would suggest.