Home > Guides > Layered security
Layered cybersecurity for small business: why we pair a WatchGuard® firewall with Bitdefender
Antivirus alone misses what happens on the network. A firewall alone cannot protect a laptop at a coffee shop. Each layer covers the gaps of the others, and together they leave the records you need to prove what happened.
The short version
- Firewall (WatchGuard): stops threats before they reach your computers, filters content and protects devices that cannot run antivirus.
- Endpoint protection (Bitdefender GravityZone): protects each computer anywhere it goes and detects ransomware behavior.
- Multi-factor sign-in, email filtering, patching and tested backups close the remaining gaps.
- Insurers, PCI DSS, HIPAA and the FTC Safeguards Rule expect these same layers.
- Every layer keeps logs, which is how you detect a breach and meet reporting deadlines.
Why one product is never enough
Attacks come in through many doors: a phishing email, a stolen password, an unpatched program, a malicious website, an infected USB drive, a printer or camera with old firmware. No single product watches every door. Security professionals call the answer defense in depth.
The layers we install
| Layer | What it stops | What we use |
|---|---|---|
| Network firewall | Known attacks, malicious sites, unwanted content, threats aimed at printers, cameras and other devices | WatchGuard Firebox with Total Security |
| Endpoint protection and EDR | Malware and ransomware on each computer, at the office or away | Bitdefender GravityZone |
| Multi-factor authentication | Stolen passwords used to get into email and remote access | Microsoft 365 and WatchGuard AuthPoint |
| Email security | Phishing, fake invoices and malicious attachments | Microsoft 365 protection |
| Patching and updates | Known flaws in Windows and applications | Managed updates |
| Backups | Data loss from ransomware, theft or failure | Off site, immutable, tested |
| People | Clicking the wrong thing | Security awareness training |
What the firewall catches that antivirus cannot
Printers, cameras, phones, smart TVs and guest devices cannot run antivirus. The firewall protects them all, blocks known bad destinations before a connection is made, filters inappropriate content and keeps guests separate from your business systems.
What endpoint protection catches that the firewall cannot
Laptops leave the building. Encrypted traffic, USB drives and files already inside the network never pass the firewall. Bitdefender watches behavior on each computer, so ransomware trying to encrypt files is stopped even when it arrives by a route the firewall never saw.
The same layers compliance asks for
- PCI DSS: network security controls (Requirement 1), anti-malware on all systems (Requirement 5) and critical patches within one month (Requirement 6)
- HIPAA: administrative, physical and technical safeguards for patient data
- FTC Safeguards Rule: multi-factor authentication, encryption and monitoring for financial businesses
- Cyber insurance: MFA, EDR on every computer, tested backups and a response plan
Layers also mean evidence
When something does happen, logs from the firewall, endpoints and Microsoft 365 show when it started, what was touched and whose information was involved. That is what lets you meet the 30 day California notice deadline with facts instead of guesses.
Related guides
Sources
- PCI DSS requirements explained (Bastion)
- IBM Cost of a Data Breach 2025 (Infosecurity Magazine)
- FTC Safeguards Rule notification (Davis Wright Tremaine)
- HIPAA Breach Notification Rule (HHS)
This guide is general information for business owners, not legal advice. Laws change; confirm your specific obligations with your attorney, compliance officer or diocese. Last reviewed November 2026.