Most computers that get hacked were not attacked by a genius. They were missing an update, reused a password or had a setting switched off. The good news is that Windows and macOS now include most of the protection a home or small office computer needs. You only have to check that it is turned on.
This guide gives you a 10-step check you can do in about 15 minutes, with exactly where to find each setting on Windows 11 and on a Mac. It also lists the signs that a computer may already be compromised, and what to do if it is.
The short answer: your computer is reasonably secure if it runs a supported operating system with automatic updates, its built-in antivirus (Microsoft Defender on Windows, XProtect on Mac) and firewall are on, its disk is encrypted with BitLocker, device encryption or FileVault, your important accounts use multi-factor authentication and unique passwords from a password manager, and you have a recent backup stored off the computer. If any of those is missing, fix it first.
Why cybersecurity is important, even for one computer
Four reasons, with current numbers:
- Everyone is a target. The FBI’s Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025, with $20.877 billion in reported losses, up 26% from 2024. Many attacks are automated: they look for any weak computer or account, not for you in particular.
- Scams start on your screen. Tech support scams, often a fake “your computer is infected” pop-up with a phone number, led to 47,794 complaints and $2.13 billion in losses in 2025. People aged 60 and over reported $7.7 billion in losses across all crime types.
- Small businesses are hit hard. Verizon’s 2026 Data Breach Investigations Report counted 7,152 confirmed breaches at small and medium-sized businesses and found ransomware hits small organizations disproportionately.
- Your computer holds the keys to everything. Saved passwords, signed-in email and banking sessions, and synced photos all live on it. Information-stealing malware is built to take exactly those.
The 10-step security check
The 10-step computer security check
Where to find each setting on Windows 11 and on a Mac
1. Run a supported system and turn on automatic updates
Updates close the holes attackers use. A system that no longer gets security updates stays open forever.
- Windows: open Settings, then Windows Update, and install everything waiting. Windows 10 support ended on October 14, 2025. If you still run it, upgrade to Windows 11 if the computer qualifies, or enroll in Microsoft’s consumer Extended Security Updates program, which covers Windows 10 version 22H2 until October 12, 2027. Enrollment is free if you sync your settings with Windows Backup, or costs 1,000 Microsoft Rewards points or a one-time $30.
- Mac: open System Settings, General, Software Update. Click the info button next to Automatic Updates and turn on the option to install security updates and system data files. On macOS Tahoe 26 and later, also turn on Automatically Install under Privacy & Security, Background Security Improvements.
- Everything else: update your browser, office apps and PDF reader. Most can update themselves; let them.
2. Make sure antivirus is on
You do not need to buy antivirus for a home computer. Both systems include it.
- Windows: Microsoft Defender Antivirus is built into the Windows Security app. Open it and look for green check marks. Under Virus & threat protection, “Who’s protecting me?” shows which antivirus is active. If you install another antivirus product, Windows switches Defender off automatically and turns it back on if the other product expires or is removed. Never run two at once.
- Mac: XProtect is built into macOS. Apple says it checks apps when they first open, when they change and when its signatures update, and those signatures update automatically, independent of system updates. Gatekeeper and notarization block apps that Apple has not checked or has revoked. Install apps from the App Store or from developers you trust, and do not override Gatekeeper warnings.
3. Turn on the firewall
A firewall blocks unwanted incoming connections, which matters most on public Wi-Fi.
- Windows: in Windows Security, open Firewall & network protection and check that Microsoft Defender Firewall is on for the Domain, Private and Public network profiles. Microsoft warns that turning it off makes a device more vulnerable. If an app is blocked, allow that app instead of switching the firewall off.
- Mac: open System Settings, Network, Firewall and turn it on. In Options, stealth mode stops your Mac answering probes such as ping. Apple also notes that sharing services let traffic through, so switch off anything you do not use in General, Sharing.
4. Encrypt the disk
Encryption protects your files if the computer is lost or stolen. Without it, anyone can remove the drive and read it.
- Windows: open Settings, Privacy & security, Device encryption. Microsoft turns device encryption on automatically when you set up a computer with a Microsoft account or a work or school account, but not with a local account. Windows Pro, Enterprise and Education also have full BitLocker. The recovery key is saved to the Microsoft account used at setup. Make sure you know where it is before you need it.
- Mac: open System Settings, Privacy & Security, FileVault and turn it on. Macs with Apple silicon or a T2 chip encrypt data automatically; FileVault ties that encryption to your login password. Store the recovery key away from the Mac, or let your Apple Account unlock the disk. Apple warns that if you lose both your password and your recovery key, your data is gone.
5. Turn on multi-factor authentication
Multi-factor authentication (MFA) means a stolen password alone is not enough to sign in. CISA, the U.S. Cybersecurity and Infrastructure Security Agency, lists it among its four basic steps for staying safe online. Turn it on for your Microsoft or Apple account first, then your email, bank, social media and shopping sites. Passkeys and authenticator apps are stronger than text-message codes. Never approve a sign-in prompt you did not start.
6. Use a password manager
Reused passwords are how one leaked website becomes a hacked email account. A password manager creates and remembers a different password for every site. The one built into your browser or system (such as Apple Passwords, Google Password Manager or Microsoft Edge) is fine for most people, and dedicated password managers add sharing and cross-platform features. NIST’s digital identity guidelines (SP 800-63B-4) set 15 characters as the minimum for a password used on its own, and length matters more than symbols.
7. Back up, and keep one copy off the computer
Backups are your only real defense against ransomware, theft and a dead drive. Keep at least one copy that is not permanently connected to the computer.
- Windows: the Windows Backup app saves your folders, apps and settings to OneDrive (it needs a personal Microsoft account). For a second copy, use an external drive.
- Mac: Time Machine backs up to an external drive. Apple suggests a drive at least twice your Mac’s storage, and keeps hourly backups for 24 hours, daily backups for a month and weekly backups after that.
- Both: restore one file now and then to prove the backup works.
8. Clean up your browser and extensions
The browser is where most attacks arrive. Keep it updated, and review extensions: in Chrome, open the menu, Extensions, Manage extensions. Remove anything you do not use or do not recognize, and limit the rest to the sites they need. Google’s advice is to approve only extensions you trust, and Chrome’s Enhanced protection warns you about untrusted ones. Block notifications from websites you do not know, and never call a number shown in a pop-up that says your computer is infected.
9. Use an everyday account without administrator rights
Malware runs with the rights of the account that opened it. If you browse and read email as an administrator, anything you run can change the whole system. Create a standard account for daily use and keep a separate administrator account for installing software (Windows: Settings, Accounts; Mac: System Settings, Users & Groups).
10. Check for signs of compromise
The U.S. Federal Trade Commission (FTC) lists these warning signs of malware:
- The computer slows down, freezes or crashes often.
- Your browser home page changes, or you are redirected to sites you did not choose.
- New toolbars or programs appear that you did not install.
- You see many pop-up ads, including on sites that do not normally show them.
- You get repeated error messages from the operating system.
- Built-in tools such as Task Manager or Activity Monitor will not open.
- Emails or social media posts go out that you did not write.
Also watch your accounts: password reset emails you did not request, unknown devices signed in to your Microsoft or Apple account, or bank charges you do not recognize.
Windows and macOS built-in protection at a glance
| Protection | Windows 11 | macOS |
|---|---|---|
| Updates | Windows Update | Software Update, background security updates |
| Antivirus | Microsoft Defender Antivirus | XProtect, Gatekeeper, notarization |
| Firewall | Microsoft Defender Firewall | Application firewall, stealth mode |
| Disk encryption | Device encryption (all editions), BitLocker (Pro and above) | FileVault |
| Backup | Windows Backup to OneDrive | Time Machine to an external drive |
| Passwords and sign-in | Windows Hello, passkeys, Microsoft Edge passwords | Touch ID, passkeys, Apple Passwords |
What to do if you think you have been hacked
Think your computer is compromised? Do this, in order
Based on the FTC's malware advice
- Stop signing inNo banking, shopping or email logins on that computer until it is clean
- Update and scanUpdate your security software and run a full scan
- Change passwordsFrom a different, clean device, and turn on MFA
- Restore if unsureIf problems continue, reset the system and restore files from a backup
- Report itFraud to ReportFraud.ftc.gov, cybercrime to ic3.gov, and tell your bank
If money was taken, call your bank right away; the faster a transfer is reported, the better the chance of getting it back.
For businesses: checking one computer is not enough
This checklist protects one computer. A business with 20 or 200 computers needs to know when any of them stops updating, has its firewall rules deleted or shows a burst of failed sign-ins, and an attack on one computer often spreads to others. Our guide to the most common types of cyber attacks shows how.
That is the job of a security information and event management (SIEM) system. UTMStack, an open source SIEM, collects security logs from Windows and Linux computers through a free agent (a macOS agent is available in the paid edition), checks them against more than 600 detection rules, and runs agent-based vulnerability scans and software inventory on Windows and Linux to show missing patches. Read more in SIEM for small business, or try the free Community edition from the install page.
Frequently asked questions
How do I check if my computer is secure? On Windows, open the Windows Security app and look for green check marks, then confirm Windows Update and Device encryption in Settings. On a Mac, check Software Update, FileVault and Firewall in System Settings. Then go through the other steps in the checklist above.
Is Microsoft Defender enough for a home computer? For most home users, yes, as long as it stays on and updated alongside automatic Windows updates, a firewall and backups. Businesses usually add endpoint detection and response and central monitoring.
Do Macs need antivirus? macOS includes XProtect, Gatekeeper and notarization, which block known malware and unchecked apps. Most home users do not need more. Businesses often add endpoint protection so they can see and manage every Mac centrally.
Is it safe to keep using Windows 10? Only with security updates. Support ended on October 14, 2025. Enroll in Microsoft’s consumer Extended Security Updates program, which runs until October 12, 2027, or upgrade to Windows 11.
How can I tell if someone is remotely accessing my computer? Signs include the mouse moving on its own, remote access programs you did not install, new user accounts and security tools that will not open. Disconnect from the internet and follow the steps above.
Should I pay for a security suite? Not just for antivirus. Built-in tools cover the basics. Paid suites can add a password manager, a VPN or identity monitoring, which may be worth it if you will use them.
Sources
- FBI Internet Crime Complaint Center: 2025 Internet Crime Report
- Verizon 2026 Data Breach Investigations Report, executive summary
- Microsoft: Windows 10 support has ended and Windows 10 Extended Security Updates for consumers
- Microsoft: Stay protected with Windows Security
- Microsoft Learn: Microsoft Defender Antivirus compatibility with other security products
- Microsoft: Turn Microsoft Defender Firewall on or off
- Microsoft: Device encryption in Windows
- Microsoft: Back up and restore with Windows Backup
- Apple: Update macOS on Mac and About background updates in macOS
- Apple Platform Security: Protecting against malware in macOS
- Apple: Change Firewall settings on Mac
- Apple: Protect data on your Mac with FileVault
- Apple: Back up your Mac with Time Machine
- Google Chrome Help: Install and manage extensions
- CISA: Secure Our World
- NIST SP 800-63B-4: Authentication and Authenticator Management
- FTC: How to Recognize, Remove, and Avoid Malware
