No single tool protects you completely — real protection comes from layering a password manager, antivirus software, a VPN, and a few privacy tools together. Below is a category-by-category guide to what each type of tool actually does, what to look for when choosing one, and which specific products are worth considering in 2026.
Cybersecurity tools work best as a layered system, not a single purchase. A password manager doesn’t protect you from malware, and antivirus software doesn’t stop a scammer from talking you into a bad decision over the phone. This guide walks through the eight categories that matter most for everyday users, what each one actually defends against, and specific products worth considering — along with one important removal from earlier versions of this list.
Why the Tool Matters Less Than the Company Behind It
In August 2022, LastPass — one of the most widely used password managers at the time — disclosed a breach in which attackers stole source code and, in a second related incident months later, a backup copy of customer vault data, including encrypted passwords. Because LastPass used a zero-knowledge architecture, the stolen vaults were encrypted with a key derived from each user’s master password, meaning attackers couldn’t simply read the contents outright. But vaults protected by weak or reused master passwords remained vulnerable to offline cracking attempts, and security researchers have since linked the stolen data to a string of cryptocurrency thefts targeting LastPass users.
The lesson isn’t “don’t use password managers” — a password manager with a strong, unique master password is still dramatically safer than reusing weak passwords across sites. The lesson is that the architecture and track record of the company behind any security tool matters as much as the tool’s feature list. That’s the lens to apply to every category below, not just password managers.
1. Password Managers
What they protect against: password reuse, weak passwords, and credential-stuffing attacks that exploit both.
What to look for: zero-knowledge/end-to-end encryption (the company itself can’t read your vault), a transparent security track record, and cross-device syncing.
Worth considering: 1Password, Bitwarden (open-source, strong free tier), Dashlane, and Proton Pass. We cover this category in much more depth, including how these compare head-to-head, in our password manager comparison guide.
2. Antivirus & Anti-Malware
What they protect against: viruses, ransomware, spyware, and other malicious software that reaches your device through downloads, email attachments, or compromised sites.
What to look for: independent lab test results (AV-Comparatives, AV-TEST), real-time protection rather than just scheduled scans, and — as the next section makes clear — the trustworthiness of the vendor itself.
Worth considering: Bitdefender, Norton 360, ESET, and Windows Defender (a genuinely capable free baseline built into Windows). Note: earlier versions of this list included Kaspersky. That’s no longer safe advice for US-based readers — Kaspersky has been under a full federal sales and software-update ban since 2024 over national-security concerns, which means any US installation is now frozen with no security patches since September 2024. See our full antivirus guide for the complete picture, including why that matters.
3. VPNs
What they protect against: network-level eavesdropping on public Wi-Fi and exposure of your browsing activity to your internet provider — not general “anonymity” online, which no VPN fully delivers.
What to look for: a published, independently audited no-logs policy, strong encryption standards, and a kill switch that cuts your connection if the VPN drops.
Worth considering: ExpressVPN, Proton VPN, and Mullvad (which doesn’t require an email address to sign up). For a deeper breakdown of when you actually need one, see our guide to whether you really need a VPN.
4. Ad Blockers & Anti-Tracking Tools
What they protect against: cross-site tracking, malicious ads (malvertising), and some of the data collection that fuels targeted advertising.
What to look for: how actively the tool is maintained, since browser platforms keep changing the rules extensions can operate under.
Worth considering: uBlock Origin and Privacy Badger. One caveat worth knowing: Chrome and Edge are phasing out the extension framework (Manifest V2) that full-featured ad blockers depend on, so Chrome/Edge users are increasingly limited to a reduced version called “uBlock Origin Lite.” Firefox still supports the full version. See our browser privacy guide for the current state of this.
5. Secure Cloud Storage
What they protect against: unauthorized access to files you store in the cloud, including from the storage provider itself, if the service uses end-to-end encryption.
What to look for: whether the provider can technically access your files (most mainstream services can; a genuinely zero-knowledge provider cannot).
Worth considering: Proton Drive and Tresorit for true end-to-end encryption; Google One and iCloud remain reasonable for convenience if you’re not storing highly sensitive files. For how to think about securing what you already have in Google Drive, iCloud, or Dropbox, see our cloud safety guide.
6. Dark Web Monitoring & Identity Protection
What they protect against: not knowing your credentials or personal information have already been exposed in a data breach.
What to look for: how broad the monitoring coverage is, and whether the service helps with recovery (identity restoration support) rather than just alerting you.
Worth considering: Have I Been Pwned (free, and a good starting point for anyone) for breach checking; Aura or IdentityForce for ongoing monitoring with recovery support.
7. Two-Factor Authentication Apps
What they protect against: account takeover even after a password is stolen or guessed, by requiring a second proof of identity.
What to look for: whether the app supports secure cloud backup of your codes (losing access to your 2FA app without a backup can lock you out of your own accounts).
Worth considering: Microsoft Authenticator, Google Authenticator, and a hardware security key for your most critical accounts (email, banking). See our guide to why two-factor authentication matters and our look at passkeys and the future of login security.
8. Parental Controls
What they protect against: age-inappropriate content, excessive screen time, and some — though not all — contact-based risks for children online.
What to look for: how the tool balances monitoring with your child’s privacy and autonomy as they get older; a tool that’s appropriate for a 7-year-old is often the wrong fit for a 15-year-old.
Worth considering: Qustodio and Google Family Link. See our family-focused safety guides for the broader picture beyond software alone.
How Many of These Do You Actually Need?
Not all eight at once. A reasonable baseline for most people:
- A password manager (non-negotiable — this single tool eliminates the most common cause of account takeover).
- Antivirus software, even if it’s just a well-configured built-in option like Windows Defender.
- Two-factor authentication on your email, banking, and any account that offers it.
- A VPN, specifically when you’re on public or untrusted Wi-Fi.
Everything else — dark web monitoring, dedicated ad blockers, encrypted cloud storage — adds real value but matters more for specific situations (you’ve had data exposed in a breach, you handle sensitive files, you’re especially concerned about tracking) than as a universal requirement.
People Also Ask
For most categories, a capable free option exists — Bitwarden’s free tier, Windows Defender, Have I Been Pwned — and covers genuine baseline protection. Paid tiers typically add convenience features (more device syncing, premium support, bundled extras) rather than fundamentally different core protection.
A password manager, because weak and reused passwords remain one of the most common root causes behind account takeovers and credential-stuffing attacks. Everything else layers on top of that foundation.
Yes, and it’s generally better than relying on one all-in-one suite for everything. Running antivirus from one company, a VPN from another, and a separate password manager doesn’t cause conflicts in most cases, and avoids putting all your trust in a single vendor.
Check for independent security audits (especially for VPNs and password managers, where “no-logs” and “zero-knowledge” claims should be independently verified, not just marketed), a transparent breach-disclosure history, and, in rare but important cases like Kaspersky, whether a government has raised specific national-security concerns about the vendor.
Not automatically — how a company responded matters. LastPass stayed on many recommendation lists immediately after its 2022 breach because its zero-knowledge architecture limited the damage, though its handling of the incident was still heavily criticized. Kaspersky’s situation is different: it’s an active government ban affecting ongoing protection, not a past incident alone. We no longer recommend Kaspersky for that reason.
Sources: U.S. Department of Commerce, Bureau of Industry and Security, Final Determination on Kaspersky Lab (June 2024); LastPass, incident disclosure notices (August and December 2022); Have I Been Pwned (haveibeenpwned.com)
Leave a Reply
You must be logged in to post a comment.