A malicious program does not need to exploit a software flaw to compromise a computer. According to a Sophos study published in 2026, compromised credentials are now the leading cause of ransomware incidents in France, ahead of phishing and the exploitation of vulnerabilities. Effectively protecting a computer against viruses and online threats therefore requires action on two simultaneous fronts: the workstation itself and the accounts associated with it.
Compromised Credentials: The Attack Vector That Antivirus Does Not Block
Most computer protection guides start with the choice of antivirus software. Antivirus software remains a necessary component, but it comes into play after the intrusion when it occurs through a stolen username-password pair. An attacker logging in with valid authentication information does not trigger any classic detection alerts.
This type of compromise occurs after a data leak on a third-party service, through the reuse of the same password across multiple accounts, or through targeted social engineering. A unique password per service drastically reduces the attack surface. A password manager (KeePass, Bitwarden) generates and stores random strings without the need for memorization.
Enabling multi-factor authentication (MFA) on every account that allows it adds a barrier that stolen credentials alone cannot breach. Prefer a code generation app (TOTP) over SMS, which is more exposed to interception. You can visit the Viruslab webpage to delve deeper into protection mechanisms against these threats.
VPN and System Updates: Two Protections That Can Backfire
France has, according to the same Sophos 2026 study, the highest rate of VPN-related compromises among all surveyed countries. Recommending a VPN without specifying the conditions of its effectiveness creates a false sense of security.
A VPN whose firmware is not up to date, whose authentication relies on a simple password, or whose connection logs are not monitored becomes a direct entry point to the network. Before activating a VPN on your computer, check three points:
- The VPN client and server use the latest version of the software, with security patches applied within days of their release.
- VPN access requires multi-factor authentication, not just a username and password.
- The protocol used is recent (WireGuard, OpenVPN with AES-256 encryption or equivalent) and not an outdated protocol like PPTP.
For the operating system, the logic is the same. Windows, macOS, and Linux distributions release security patches that close vulnerabilities that are actively exploited. Delaying an update by a few weeks is enough to make a workstation vulnerable to already documented attacks. Enable automatic updates and restart your machine when the system requests it.
Firewall and Antivirus: Configuration Rather Than Simple Installation
Installing antivirus and a firewall is just the first step. The difference in protection between security software configured by default and software properly set up is significant.
Antivirus Settings to Check After Installation
Real-time scanning must be active at all times. Some users disable it to gain performance, which removes the detection of malicious files at the moment of their opening. Full scheduled scans (once a week) can detect dormant threats that real-time scanning may have missed.
Ensure that the signature database updates daily. An antivirus with definitions that are weeks old does not recognize recent malware. Modern solutions combine signatures and behavioral analysis, but behavioral analysis does not replace up-to-date signatures.
Firewall: Control Outgoing Connections
The firewall built into Windows or macOS blocks unsolicited incoming connections by default. However, outgoing connections are rarely filtered. Malware already present on the workstation can therefore communicate freely with a remote server to exfiltrate data.
Configuring the firewall to report or block unusual outgoing connections adds a layer of detection. Tools like GlassWire (Windows) or LuLu (macOS) provide this visibility without excessive complexity.
File Backup and Segmentation: The Last Line of Defense
No combination of security software guarantees total protection. Ransomware attacks encrypt local files and, increasingly often, exfiltrate data before locking it. A regular backup on a disconnected medium remains the only reliable defense against data loss.
The so-called 3-2-1 rule structures this backup: three copies of each file, on two different media, with one stored offsite (or offline). An external hard drive disconnected after each backup cannot be accessed by ransomware active on the workstation.
Segmenting usage complements this approach. Using a standard user account (without administrative rights) for daily tasks prevents malware from installing system components. The administrator account is only used for installations and configuration changes, as needed.
- Create a standard user account separate from the administrator account on Windows or macOS.
- Launch your browser and email from this restricted account.
- Reserve administrative rights for system updates and the installation of verified software.
Online threats evolve faster than user habits. The security of a computer relies less on a single product than on a set of coherent practices: rigorous password management, timely updates, a firewall configured to monitor outgoing traffic, and disconnected backups. Each layer compensates for potential weaknesses in the previous one, and it is this layering that makes compromise significantly more difficult for an attacker.
