Every small business has a firewall of sorts - usually the box your broadband provider posted you, doing the bare minimum. The question is whether that is enough, and if not, what to buy instead without overspending on enterprise kit you will never use. This guide cuts through the spec sheets to what actually protects a UK small business, and how to tell a real business firewall from a glorified home router.
Why the free router is not really a firewall
The box from your internet provider does include a basic firewall, and for a home it is fine. For a business it leaves three gaps that matter. It rarely inspects the actual content of traffic, it is seldom updated against new threats, and it gives you almost no control or visibility over what your network is doing.
A modern business firewall - often called a next-generation firewall or NGFW - does far more than wave traffic through or block it. It inspects what is inside the connection, recognises and stops known attacks and malicious websites, filters dangerous downloads, and lets you see and control which staff and devices can reach what. If you are wondering whether you even need one in the cloud era, we tackle that head-on in do you still need a firewall? - the short answer is yes, just a smarter one.
What a small business firewall should actually do
Ignore the longest feature lists and focus on the capabilities that earn their keep in a small office. These are the ones that stop real incidents and the ones your cyber-insurance application will care about.
- •Deep traffic inspection: looking inside connections (including encrypted ones) to catch threats a basic router waves straight through.
- •Intrusion prevention and web filtering: automatically blocking known attacks, malicious sites and risky categories.
- •Secure remote access: a built-in VPN or zero-trust option so home and travelling staff connect safely - usually included, so you avoid buying it separately.
- •Visibility and control: a clear dashboard showing what is happening, with the ability to separate guest Wi-Fi and devices from your core systems.
- •Automatic, supported updates: regular threat updates and security patches, backed by a vendor that issues them promptly.
How to size it without overspending
Firewalls are sold in model numbers that climb with the number of users and the internet speed they can inspect at full tilt. The classic mistake is buying purely on your broadband speed; the subtler one is buying the cheapest model, then watching it choke once you switch on the security features that made you buy it in the first place.
As a rule of thumb, size for your team count and a comfortable margin above your line speed, and check the throughput figure with security features turned on - not the headline number. A small firewall sized for the right number of people will comfortably handle a typical UK office; for example, an entry business model such as a FortiGate 40F suits a very small team, stepping up to a 60F or 80F as headcount grows. Buy a size up from your minimum so you do not have to replace it the moment you hire.
The brands worth shortlisting
For a small business you do not need an exotic name - you need a mainstream platform with a strong reputation, regular updates and support you can actually reach. The big, well-supported options dominate for good reason, and standardising on one keeps management simple.
Fortinet (FortiGate) is a perennial small-business favourite for strong value and an all-in-one feature set. Sophos is popular with UK firms for its straightforward management and tidy integration with endpoint protection. For the deeper, vendor-by-vendor comparison aimed at IT buyers, see our best business firewalls for 2026. Whichever you pick, the firewall is only one layer - pair it with broader network security.
Subscriptions, set-up and the long view
Two things surprise people after the purchase. The first is that the security itself is usually a subscription. The firewall hardware is a one-off, but the threat intelligence, web filtering and support that make it effective renew yearly, and a firewall with lapsed subscriptions quietly becomes that basic router again. Budget for the licence, not just the box.
The second is that a firewall is only as good as its set-up. An expensive appliance with default settings and no one watching the alerts is poor value; a sensibly configured mid-range one, kept patched and monitored, is excellent. This is why many small firms have theirs managed, and increasingly fold remote access and cloud protection into one service - the direction we cover in best SASE platforms for 2026. Spend on getting it configured and maintained, not just on a bigger model number.