5 Ways To Prevent Malware and Antivirus Best Practices

Malware rarely arrives through a clever hack. It comes in through an email someone clicked, or a laptop that missed its updates. That’s good news, because those are things you can fix.

The short answer: to prevent malware, turn on automatic updates and multi-factor authentication first; they close the doors most attacks use. Then keep the antivirus that comes with Windows switched on, and keep one backup copy where ransomware can’t reach it.

1. Let updates install themselves

Attackers go after known weaknesses in software that hasn’t been patched. The NCSC’s advice is to install security updates as soon as they’re available, and to switch on automatic updates wherever you can.

Nobody needs to check for updates by hand every morning. Turn on automatic updates, and have someone (you, or your IT provider) confirm they’re actually installing. Don’t forget the kit people overlook, such as the firewall and the VPN.

Anything that no longer gets security updates has to go. Windows 10 reached end of support on 14 October 2025, so a Windows 10 PC without extended security updates is now an open window.

2. Turn on multi-factor authentication

This wasn’t on the original list, and it’s the biggest omission we’ve corrected. A lot of malware exists to steal passwords. With multi-factor authentication, a stolen password alone doesn’t get anyone in; the NCSC recommends it precisely so stolen credentials can’t easily be reused.

Turn it on for email and Microsoft 365 first, then everything else that offers it. It adds a few seconds to a sign-in. That’s the price, and it’s a small one.

3. Keep antivirus switched on, and know what it can’t do

Windows comes with Microsoft Defender Antivirus built in, and it updates itself through Windows Update. For most devices there’s no need to buy a separate antivirus product; the job is to make sure Defender stays switched on and nobody has disabled it.

Antivirus blocks known malware and suspicious files. It’s less good at spotting an attacker who is already in and using your own tools against you. That’s what endpoint detection and response (EDR) is for: it watches behaviour and can stop an attack in progress. Microsoft 365 Business Premium includes Defender for Business, which has EDR. Our guide to endpoint security explains the difference.

Keep the firewall on as well. Windows has one, and so does your office router. Firewalls are one of the five controls in Cyber Essentials.

4. Be wary of links and attachments

Most malware still arrives by email. A few habits do most of the work:

• Treat any unexpected attachment or link as suspicious, even from someone you know, because their account may be the one that’s been taken over.
• Check a request for money or a password by phoning the person on a number you already have, not one in the email.
• Remember that the padlock in the address bar only means the connection is encrypted. Scam sites have one too, so type the address of sites you use or use a bookmark.
• Use your phone’s hotspot or a VPN for anything sensitive on public Wi-Fi, which is riskier than your office network.

When someone does click, make it easy to say so straight away. A quick report turns a disaster into a password reset. Our guide to phishing email training covers how to build the habit.

5. Back up, and keep one copy out of reach

Ransomware encrypts your files and then goes looking for your backups. The NCSC’s advice is to keep offline backups, separate from your network, and to test that they restore. A backup that’s only ever been “running” hasn’t been tested.

If your data lives in Microsoft 365, that needs a backup too. Microsoft keeps deleted items for a limited time, but your licences don’t include a backup; see why Microsoft 365 needs a backup.

Where most businesses are exposed

The gaps that matter are rarely exotic. One important account without multi-factor authentication, or an old PC in the corner that nobody wants to retire, does more harm than any missing product. Fix those two before you buy anything new.

How Jera can help

For the businesses we look after, we manage updates and Defender for you, with security monitoring around the clock by an external security operations centre. Setting it up takes a little of your team’s time in the first month. Book a call and we’ll tell you where your gaps are.