10 Best Antivirus Software for Small Businesses in 2026

The best antivirus for a small business in 2026 is a centrally managed business product backed by current independent test results, not a home suite bought one licence at a time. If you pay for Microsoft 365 Business Premium, you already own Microsoft Defender for Business. If you do not, Bitdefender GravityZone tied for the highest real-world protection score (99.8%) in AV-Comparatives’ March to June 2026 business test.

Every price below was read on the vendor’s own site or official marketplace listing on 6 October 2026, and every protection score comes from the independent labs’ own tables. Four facts reshape the shortlist before any feature comparison: many small businesses already own an endpoint product through Microsoft 365; Kaspersky can no longer be sold to or updated for US customers; Norton and Avast are one company, and Norton uses the Avast engine; and several of the “business” prices quoted around the web, including on an earlier version of this page, were really home plans, and Norton’s and Avast’s licences forbid business use of theirs.

Small business antivirus compared: 2026 prices and lab results

The table puts each product’s cheapest business plan side by side. Scroll sideways on a phone to see every column.

Product	Owner	Entry price, checked 6 Oct 2026	EDR at that price?	Independent tests, 2026	Windows Server
Microsoft Defender for Business (the baseline)	Microsoft	$3.00 per user per month, paid yearly; included in Microsoft 365 Business Premium ($22.00 per user per month)	Yes	AV-Comparatives 98.8%, Approved; AV-TEST 6 / 5.5 / 6, Top Product	Extra licence at $3 per server instance, up to 60
1. Bitdefender GravityZone Business Security	Bitdefender	$269.49 for 10 devices for the first year (list $384.99)	No; EDR is in the quote-only Enterprise tier	AV-Comparatives 99.8% (Premium tier), Approved	File servers count as devices, up to 30% of them
2. CrowdStrike Falcon Go	CrowdStrike	$59.99 per device per year, or $7.99 a month; 100 devices maximum	No; EDR starts at Falcon Enterprise ($184.99)	AV-Comparatives 98.5% (Enterprise bundle), Approved	Sensor supports Windows Server; Go’s server terms are not stated
3. ThreatDown Core (Malwarebytes)	Malwarebytes	$69.00 per device per year, 5-device minimum	No; EDR starts at Advanced ($79.00)	Not in either lab’s latest business test	Separate licence: Core for Servers, $129.00
4. ESET PROTECT Core	ESET	$274.50 for 5 devices per year ($54.90 each)	Not listed; Premium ($1,030 for 10) adds 24/7 MDR	AV-Comparatives 98.8% (PROTECT Entry), Approved	Each server takes one seat
5. Webroot, now OpenText Core Endpoint Protection	OpenText	$150.00 for 5 seats per year; $2.50 a month per extra seat	Partial; full EDR is a separate OpenText product	Not in either lab’s latest business test	Windows Server 2019, 2022 and 2025
6. Sophos Endpoint (Intercept X)	Sophos	No price on sophos.com; $110.00 per endpoint per year with EDR on AWS Marketplace	Yes, in that plan	AV-Comparatives 98.3%, Not Approved (performance); AV-TEST 6 / 5.5 / 6, Top Product	Separate per-server licence ($222.00 on AWS)
7. SentinelOne Singularity Core	SentinelOne	$69.99 per endpoint per year, for 5 to 100 workstations, sold through partners	No; Complete ($179.99) adds it	Not in either lab’s latest business test	Servers count as endpoints
8. Norton Small Business	Gen Digital	$59.99 for the first year for up to 3 employees, then $119.99	No	AV-Comparatives 99.0%, Approved; AV-TEST 6 / 6 / 6, Top Product	Not supported
9. Kaspersky	Kaspersky	Not sold to US customers since 20 July 2024	Not applicable in the US	AV-Comparatives 99.8%, Approved; AV-TEST 6 / 6 / 6, Top Product	Not applicable in the US
10. Avast Essential Business Security	Gen Digital	$31.37 per device for the first year, then $39.21	No	AV-Comparatives 99.0% (Ultimate tier), Approved; AV-TEST 6 / 6 / 6, Top Product	Included: Windows Server 2012 to 2025

How to read the test column: AV-Comparatives’ figure is the real-world protection rate from its Business Security Test for March to June 2026 across 400 real-world test cases, and AV-TEST’s three numbers are protection, performance and usability out of 6 from its business Windows test, run in July and August 2026. A product that was not tested has not failed: ThreatDown, Webroot and SentinelOne were not in either lab’s latest business test. Prices are the vendor’s own published price in US dollars before tax, and first-year offers are marked as such because renewals cost more.

Start here: you may already own Microsoft Defender for Business

Microsoft Defender Antivirus is built into Windows 10 and Windows 11, but on its own it protects one PC at a time with nobody watching the alerts. Microsoft Defender for Business adds what a company needs on top of it: one portal for every device, endpoint detection and response (EDR), automated investigation and remediation, and vulnerability management. Microsoft’s FAQ caps it at 300 users, with up to five devices per user.

It costs $3.00 per user per month, paid yearly, as a standalone product, and it is included in Microsoft 365 Business Premium at $22.00 per user per month, paid yearly. Servers are extra: Microsoft prices a Defender for Business servers licence at $3 per server instance and allows up to 60 per subscription, so a firm with one file server and ten staff on Business Premium pays for one server licence and nothing else.

In independent testing, Defender scored 98.8% real-world protection with zero false alarms in AV-Comparatives’ March to June 2026 business test, and AV-TEST gave it 6, 5.5 and 6 out of 6 in July and August 2026, a Top Product result. In AV-TEST’s previous round, May and June 2026, it scored 5 for performance, leaving it half a point below the 17.5 of 18 that AV-TEST requires for a Top Product award, so treat any single round as a snapshot.

Two cautions apply. First, Defender is a target in its own right. CISA’s Known Exploited Vulnerabilities catalog lists three Defender flaws added in 2026, including CVE-2026-33825, a privilege escalation flaw rated 7.8 that CISA marks as used in ransomware campaigns. Microsoft fixed it in Defender Antimalware Platform version 4.18.26030.3011, which arrives through Defender’s own platform updates, so check that those updates are reaching every PC rather than assuming Windows Update covers it. Second, the product is only as good as its settings:

The usual place it’s “lacking” is that many features don’t get turned on.

disclosure5, answering “Is Windows Defender a good enough EDR?” on r/sysadmin, 26 March 2024

If nobody will read the alerts, add a managed service on top or choose a product that includes one. The rest of this list is for businesses without Business Premium, those that want a vendor to watch the alerts for them, and those that want a second opinion from a different engine.

How we chose and checked these products

This list was first published in March 2023 and rebuilt on 6 October 2026, when every claim on it was checked again. We did not run our own malware tests; the independent labs do that better. Our work is the part the labs do not publish: what each product costs, what the licence permits, who owns it, and what its own documentation says.

• Prices: read on each vendor’s own price page, store or cart in US dollars before tax. Where a vendor publishes no price, we looked for its official cloud marketplace listing and say when we found none.
• Protection: AV-Comparatives Business Security Test, March to June 2026 (released 15 July 2026, 400 real-world test cases) and AV-TEST’s business Windows results for July and August 2026. We read the scores from the labs’ own tables, not from vendor marketing.
• Exploited flaws: CISA’s catalog (version 2026.10.04) searched for every vendor here. Only Microsoft Defender has entries for an endpoint product; Sophos’s entries are for its firewalls and web appliance, not its endpoint software.
• MITRE ATT&CK Evaluations: MITRE’s Enterprise 2025 round lists 11 participants. CrowdStrike, ESET and Sophos took part. Microsoft and SentinelOne each announced it would not take part; Bitdefender and ThreatDown, which took part in 2024, are not on the 2025 list.
• Business, not home: every price is for a product the vendor licenses for business use. Home products appear only where an earlier version of this page listed them, and are labelled as such.

AV-Comparatives’ report describes the buyer this page is written for:

In the smaller SME segment, on-site IT managers or professionals are often absent. Instead, the responsibility of “computer maintenance” falls on an interested non-expert, usually a senior partner with other primary roles in the business.

AV-Comparatives, Business Security Test 2026 (March to June)

What is Antivirus Software?

Antivirus software detects, blocks and removes malicious software on a computer, phone or server. Business products now go well beyond the signature scanning the name suggests, and vendors sell four overlapping layers under different labels. Knowing which layer a price buys is the fastest way to compare quotes.

Layer	What it does	Examples on this page
Antivirus or next-generation antivirus (NGAV)	Blocks known and new malware using signatures, behaviour monitoring and machine learning	Every product here
Endpoint protection platform (EPP)	Adds a central console, policies, device control, web filtering and reports for every machine	GravityZone Business Security, Falcon Go, ESET PROTECT Core, Avast Essential Business Security
Endpoint detection and response (EDR)	Records what happens on each device so an attack that gets past prevention can be traced, contained and rolled back	Defender for Business, Falcon Enterprise, ThreatDown Advanced, SentinelOne Complete, Sophos EDR
Managed detection and response (MDR)	The vendor’s analysts watch the EDR alerts around the clock and respond for you	ThreatDown Elite, ESET PROTECT Premium, Sophos MDR, CrowdStrike Falcon Complete

A firewall is a different control. It filters traffic between your network and the internet, while antivirus works on each device, so a small business needs both; we compare the best firewalls for small businesses separately. What separates a business antivirus from a home one is rarely the scanner, which is often the same engine. It is four other things:

• a central console that shows every device’s protection status in one place;
• policies an administrator sets once instead of on each PC;
• alerts and reports that reach whoever is responsible;
• a licence that permits business use. Home and free licences usually do not, as the FAQ below shows.

What the 2026 breach data says about small businesses

Small firms are not too small to be targets. Verizon’s 2026 Data Breach Investigations Report found that, where the victim’s size was known, “about 96% of Ransomware victims were SMBs,” and ransomware grew to 48% of all the breaches it studied. In its small-business analysis the attackers got in through credentials that had been compromised (38%) or unpatched vulnerabilities in edge devices (29%), which is a reminder that antivirus is one control among several: multi-factor sign-in and prompt patching close the doors it cannot.

The FBI’s Internet Crime Report 2025 logged 3,611 ransomware complaints in 2025 with reported losses of $32.3 million, a figure the FBI notes does not normally include lost business, time or wages. Its recommendations for defenders include this:

Endpoint detection and response (EDR) tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each specific host.

FBI Internet Crime Complaint Center, Internet Crime Report 2025

In the UK, the government’s Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found that 42% of micro businesses and 46% of small businesses had experienced a cyber breach or attack in the previous 12 months, and that the share of businesses using up-to-date malware protection rose from 77% to 81%.

Before You Compare: Who Actually Owns What

Endpoint security has consolidated, and two of the ten products below come from the same parent. Comparing those two as rivals means comparing two brands inside one portfolio, with one support organisation behind them.

Product in this list	Owner	Detail
Norton Small Business	Gen Digital	NortonLifeLock completed its acquisition of Avast on 12 September 2022 and renamed itself Gen Digital
Avast Business	Gen Digital	Same parent as Norton. Gen Digital’s 2026 annual report lists Norton, Avast, AVG, Avira, LifeLock, CCleaner and MoneyLion as its trademarks
Webroot, now OpenText Core Endpoint Protection	OpenText	Carbonite acquired Webroot in 2019 for $618 million, and OpenText completed its acquisition of Carbonite on 24 December 2019
ThreatDown	Malwarebytes	Malwarebytes renamed its business products ThreatDown on 7 November 2023
Kaspersky	Kaspersky Lab	Prohibited from selling to or updating US customers. See the warning under entry 9
Bitdefender, CrowdStrike, ESET, Sophos, SentinelOne	Separate owners	None belongs to Gen Digital or OpenText, so these are genuinely distinct choices

The overlap goes deeper than the logo. AV-Comparatives states plainly that “Norton uses the Avast engine,” and in its 2026 business test the two returned identical results, 99.0% real-world protection and 99.8% malware protection, so the lab reports them on one line. Shortlisting Norton against Avast looks like two quotes but is one engine and one negotiation; a mixed shortlist spreads the risk instead.

Here are the 10 Best Antivirus Software for Small Businesses

The numbering follows the original 2023 list and is not a score. The comparison table above and the decision table near the end are where the products are compared against each other.

1. Bitdefender GravityZone

Bitdefender sells its business protection under the GravityZone name, separately from its home products. A small business can buy three tiers online, each priced per device per year for 1 to 100 devices, and a fourth, Enterprise, by quote. GravityZone tied for the top real-world protection rate in AV-Comparatives’ 2026 business test, 99.8% with 4 false alarms, and its false alarms on ordinary software fell in the lab’s lowest band.

Features

• Small Business Security: next-generation antivirus with ransomware mitigation and fileless attack protection
• Business Security: adds network attack defense and risk management
• Business Security Premium: adds attack forensics and visualisation and a sandbox analyzer
• Business Security Enterprise: adds endpoint detection and response (quote only)
• Optional add-ons on Business Security and Premium: patch management, full disk encryption, email security and mobile security

What Bitdefender’s business tools look like

These screenshots date from the original 2023 review. The first is from Bitdefender’s network traffic analytics appliance, an enterprise product, and the other two from its older on-premises Control Center.

Strengths

• Joint-highest real-world protection in AV-Comparatives’ 2026 business test (99.8%), with 99.5% malware protection
• Published per-device prices from a single device, so a five-person office can buy online without a sales call
• File servers are covered inside the device count

Limitations

• EDR is only in the quote-only Enterprise tier, so the online tiers stop at prevention
• The 30% price is a promotion, and the renewal price is not published
• Online purchase stops at 100 devices
• Not in AV-TEST’s two latest business rounds (May to August 2026), and not in MITRE’s 2025 evaluation after taking part in 2024

Other details

Detail	What the vendor states
Sold as	Online for 1 to 100 devices; quote for Enterprise and for more than 100 devices
Servers	Included: “desktops and laptops and up to 30% file servers”; Linux machines count as servers
Windows Server versions	Listed: 2016 to 2025, with 2012 and 2012 R2 under legacy support
Independent tests	AV-Comparatives, March to June 2026 (Business Security Premium 8.26): 99.8% real-world, 99.5% malware, Approved

2. CrowdStrike Falcon

CrowdStrike sells its Falcon platform to small businesses as self-serve bundles, priced per device and bought online monthly or yearly. Falcon Go covers next-generation antivirus for up to 100 devices, Falcon Pro adds firewall management, and Falcon Enterprise adds endpoint detection and response with threat intelligence and hunting. Falcon Enterprise was Approved in AV-Comparatives’ 2026 business test with 98.5% real-world protection.

Features

• Falcon Go: next-generation antivirus, device control, mobile device protection and Express support
• Falcon Pro: everything in Go plus firewall management
• Falcon Enterprise: adds endpoint detection and response, threat intelligence and threat hunting
• Falcon Complete: CrowdStrike’s 24/7 managed detection and response, priced by quote

Some screenshots of CrowdStrike Falcon

The July 2024 outage, and the control it gave customers

On 19 July 2024 a faulty content update for the Falcon sensor, Channel File 291, crashed Windows computers around the world. Microsoft estimated that it affected 8.5 million Windows devices. CrowdStrike’s root cause analysis, dated 6 August 2024, traced the crash to a template that defined 21 input fields while the sensor supplied 20. The change that matters to a buyer is control over timing: in CrowdStrike’s words, “Customers can choose where and when Rapid Response Content updates are deployed.” Set that policy when you deploy, so a bad update reaches a test machine before it reaches every PC.

Strengths

• Published per-device prices, with monthly billing available
• One platform from antivirus to EDR to fully managed MDR
• Approved by AV-Comparatives in 2026 (98.5% real-world, 99.7% malware protection) and a participant in MITRE’s 2025 evaluation

Limitations

• Go and Pro do not include EDR; Enterprise costs $125 more per device per year than Go
• AV-Comparatives named CrowdStrike among the products with above-average false positives on non-business software in its 2026 real-world test
• Falcon Go stops at 100 devices

Other details

Detail	What the vendor states
Sold as	Online, monthly or yearly; Falcon Complete by quote
Windows Server versions	Sensor supports: Server 2008 R2 SP1 to Server 2025, including Server Core editions
Independent tests	AV-Comparatives, March to June 2026 (Falcon Enterprise 7.33 to 7.37): 98.5% real-world, 99.7% malware, Approved

3. Malwarebytes, now ThreatDown

Malwarebytes renamed its business products ThreatDown in November 2023, and malwarebytes.com/business now redirects to threatdown.com, so the “Malwarebytes for business” many lists still recommend is bought there. The $38.24 a year this page used to quote was the price of Malwarebytes Premium, a one-device home product. ThreatDown is sold in four bundles at a five-device minimum, and its EDR tier is the cheapest published EDR on this list after Microsoft’s.

Features

• Core: next-generation antivirus, incident response, device control, application blocking, vulnerability assessment and browser phishing protection
• Advanced: adds EDR with 7-day ransomware rollback, patch management, firewall management, drive encryption and managed threat hunting
• Elite: adds 24/7 managed detection and response
• Ultimate: adds MDR Plus, identity threat detection and response and premium support

Some screenshots of Malwarebytes

Both screenshots below were taken for the original review and show Malwarebytes home products, not the ThreatDown business console.

Strengths

• EDR with 7-day ransomware rollback and patch management from $79.00 per device
• A 24/7 managed service at a published price ($99.00 per device with Elite)
• Published prices and online checkout

Limitations

• Five-device minimum, and servers need a separate licence at $129.00 each
• No current independent score: not in AV-Comparatives’ or AV-TEST’s latest business tests, and not in MITRE’s 2025 evaluation after taking part in 2024
• Server Core installations of Windows Server are not supported

Other details

Detail	What the vendor states
Sold as	Online, from 5 devices; 20% off a three-year term
Servers	Supported: Windows Server 2016 to 2025 and Linux servers, with a separate server subscription
Independent tests	None in 2026

4. ESET PROTECT

ESET sells its business protection as ESET PROTECT. In the United States, Italy and Slovakia it has replaced the Entry, Advanced and Complete tiers this page used to list with three plans, Core, Premium and Ultimate, according to ESET’s own support article. Core covers endpoints and servers on Windows, macOS and Linux plus phones and tablets, which corrects this review’s earlier claim that ESET supported only Windows and Android. ESET PROTECT Entry was Approved in AV-Comparatives’ 2026 business test with 98.8% real-world protection.

Features

• Core: endpoint protection for endpoints and servers on Windows, macOS and Linux, plus mobiles on iOS, iPadOS and Android and cloud virtual machines
• Premium: everything in Core plus 24/7 managed detection and response with expert-led threat monitoring
• Ultimate: ESET’s largest plan, priced as a package for bigger estates

Some screenshots of ESET PROTECT

Strengths

• The broadest coverage of any entry-level plan here: Windows, macOS, Linux, servers and mobiles in Core
• Approved by AV-Comparatives in 2026 and a participant in MITRE’s 2025 evaluation
• Premium includes a 24/7 managed detection and response service at a published price

Limitations

• Five-seat minimum for Core and ten for Premium
• False alarms on non-business software fell in AV-Comparatives’ medium band, behind Bitdefender, Kaspersky and Microsoft
• Plan names differ between the US and most other countries, which makes comparing quotes across regions harder

Other details

Detail	What the vendor states
Sold as	Online in 5-seat steps for Core and from 10 seats for Premium
Servers	Each server takes one seat; Windows Server and Linux servers are covered in Core
Independent tests	AV-Comparatives, March to June 2026 (ESET PROTECT Entry with ESET PROTECT Cloud): 98.8% real-world, 99.2% malware, Approved

5. Webroot, now OpenText Core Endpoint Protection

Webroot’s business endpoint product is now sold as OpenText Core Endpoint Protection, and the old Webroot business page redirects to OpenText. It is a cloud-managed agent sold in five-seat blocks, and OpenText’s checkout showed the same $150.00 a year for five seats that this page recorded in 2023. Carbonite bought Webroot in 2019 and OpenText bought Carbonite the same year, so support and renewals sit with OpenText.

Features

• Cloud-managed endpoint protection for Windows PCs, Macs and Windows servers
• Basic EDR features, which OpenText describes as “device isolation and process visualization”
• Optional DNS protection and security awareness training, offered as add-ons at checkout
• Over five seats, extra endpoints are billed monthly rather than in new blocks

Some screenshots of Webroot

Strengths

• Low, stable entry price: $150.00 for five seats in both 2023 and 2026
• Supports Windows Server 2019, 2022 and 2025 and current macOS versions

Limitations

• No current independent score: OpenText was not in AV-Comparatives’ or AV-TEST’s latest business tests, and its last MITRE enterprise evaluation was in 2021
• No Linux support in the published requirements
• Only basic EDR features; OpenText says full EDR capabilities come with a separate product, OpenText Core Endpoint Detection and Response

Other details

Detail	What the vendor states
Sold as	Online in 5-seat blocks; extra seats at $2.50 per month each
Servers	Windows Server 2019, 2022 and 2025 (Standard, Datacenter with Desktop Experience, Essentials)
Independent tests	None in 2026

6. Sophos Endpoint (Intercept X)

Sophos now lists Intercept X as Sophos Endpoint, managed from its Sophos Central console. Its licensing guidelines license it per user, with a separate per-server subscription for servers. Sophos publishes no price on its own site, but its official AWS Marketplace listing does: $110.00 per endpoint per year with EDR. The 2026 lab results split: AV-TEST gave Intercept X Advanced a Top Product award, while AV-Comparatives did not approve it because of its effect on system performance.

Features

• Anti-ransomware protection, including Sophos’s CryptoGuard behavioural detection
• Deep learning malware detection and exploit prevention
• Endpoint detection and response (EDR) and extended detection and response (XDR)
• Managed detection and response (MDR) as a higher plan
• Central management in Sophos Central

Screenshot of Sophos Intercept X Endpoint

Strengths

• AV-TEST Top Product in July and August 2026 (6, 5.5 and 6 out of 6)
• EDR in the entry plan, and a managed MDR service from the same vendor
• A participant in MITRE’s 2025 evaluation

Limitations

• Not Approved by AV-Comparatives in 2026: its performance impact score was 49.1, and approval requires a score below 40
• The lowest protection rates among the tested products on this list in AV-Comparatives’ test: 98.3% real-world and 96.6% malware protection
• Servers need their own licence, which costs about twice the user price

Other details

Detail	What the vendor states
Sold as	Through resellers and managed service providers, or AWS Marketplace
Servers	Separate Sophos Endpoint for Server subscription, per server; Windows and Linux
Independent tests	AV-Comparatives, March to June 2026 (Intercept X Advanced): 98.3% real-world, 96.6% malware, Not Approved; AV-TEST, July and August 2026: 6 / 5.5 / 6, Top Product

7. SentinelOne Singularity

SentinelOne does publish prices, although this page used to say it did not. Its packages page lists prices for four tiers per endpoint per year for 5 to 100 workstations, and every purchase goes through an authorised partner, which sets the final price. Its FAQ states that servers count as endpoints. SentinelOne was not in either lab’s latest business test and announced it would not take part in MITRE’s 2025 evaluation.

Features

• Core: endpoint protection
• Control: adds device and firewall control and remote shell
• Complete: adds real-time threat detection and response, 14 days of data retention and an AI security assistant
• Commercial: adds identity detection and response, 90-day data retention and managed threat hunting

Strengths

• Published per-endpoint prices, including for EDR
• Servers cost the same as workstations because they count as endpoints
• A clear upgrade path from Core to managed threat hunting

Limitations

• No 2026 independent score from AV-Comparatives, AV-TEST or MITRE
• Partner-only buying, so the price you pay is set by the reseller
• Detection and response starts at Complete, $110 more per endpoint per year than Core

Other details

Detail	What the vendor states
Sold as	Through authorised partners; listed prices for 5 to 100 workstations
Servers	Counted as endpoints
Independent tests	None in 2026

8. Norton Small Business

Earlier versions of this page reviewed Norton AntiVirus Plus, a home product. Norton’s own licence rules that out for a company: “Consumer products can only be used for consumer, household and non-commercial purposes.” Norton’s business product is Norton Small Business, licensed “only for businesses with fifty or fewer employees,” priced by employee and covering two devices per employee. It scored 99.0% real-world protection in AV-Comparatives’ 2026 business test and a full 18 of 18 in AV-TEST’s July and August round.

Features

• Device security for Windows PCs, Macs, Android phones and iPhones
• Password and card vault, software updater and dark web alerts for business details
• 250 GB of cloud backup
• Small Business Premium adds a VPN and 500 GB of cloud backup

Some screenshots of Norton

These screenshots from the original review show Norton’s home apps.

Strengths

• Top scores from both labs in 2026: AV-Comparatives Approved, AV-TEST 6, 6 and 6
• Backup, a password vault and dark web alerts in the same subscription
• Renewal prices published next to the first-year offer

Limitations

• No Windows Server support: Norton’s requirements list Windows 11, 10, 8, 8.1 and 7 and no server edition
• Renewal costs up to twice the first year: $119.99 after $59.99 for the 3-employee plan
• The same engine as Avast Business, so it is not an independent second choice
• No EDR

Other details

Detail	What the vendor states
Sold as	Online by number of employees, up to 50 employees under Norton’s licence
Servers	Not supported
Independent tests	AV-Comparatives, March to June 2026 (Norton Small Business): 99.0% real-world, 99.8% malware, Approved; AV-TEST, July and August 2026: 6 / 6 / 6, Top Product

9. Kaspersky

United States readers: Kaspersky cannot be supplied here, and it is no longer being updated for US systems. On 20 June 2024 the US Commerce Department’s Bureau of Industry and Security issued a Final Determination prohibiting Kaspersky from supplying anti-virus software and cybersecurity products or services to US persons. New agreements with US persons were barred from 20 July 2024, and from 29 September 2024 Kaspersky has been prohibited from providing anti-virus signature updates or codebase updates and from operating the Kaspersky Security Network in the United States.

BIS does not pursue individual users who already held the software, but it states plainly that those products are no longer updated and that continued use can create security vulnerabilities. An engine running signatures frozen in September 2024 offers the appearance of protection without the substance, which leaves a business worse off than knowing it is unprotected. For a US small business the action is replacement, not renewal.

Outside the United States the product continues to be sold and updated normally, and technically it remains capable cyber security software for homes and businesses across small business, mid market and enterprise. The entry is kept here because readers arrive looking for it and deserve the current position, but within the US it is not a candidate.

The BIS Kaspersky page, checked on 6 October 2026, still sets out that Final Determination. In the 2026 business tests Kaspersky Endpoint Security scored 99.8% real-world protection with AV-Comparatives and 18 of 18 with AV-TEST, so outside the US the case against it is about jurisdiction and policy, not detection.

Features

• Kaspersky Small Office Security: for very small offices without an administrator
• Kaspersky Endpoint Security: managed from Kaspersky Security Center, the product AV-Comparatives tested
• File, web and mail threat protection and vulnerability scanning

Some screenshots of Kaspersky

Strengths outside the US

• Joint-highest real-world protection in AV-Comparatives’ 2026 business test (99.8%)
• AV-TEST Top Product for both Small Office Security and Endpoint Security in July and August 2026

Limitations

• Cannot be sold to, or updated for, US customers
• Has not taken part in a MITRE enterprise evaluation since 2020

10. Avast Business

Avast Business sells three tiers online from a single device, managed from its Business Hub console. It is not an independent alternative to Norton: both are Gen Digital brands, and AV-Comparatives notes that Norton uses the Avast engine. This page previously showed Avast One and Avast Premium Security prices, which are home products, and Avast’s licence licenses every product it does not designate for business use only for “personal, noncommercial purposes.”

Features

• Essential Business Security: Business Hub console, antivirus, ransomware and data protection, phishing protection and Windows server protection
• Premium Business Security: adds web control, a VPN and USB protection
• Ultimate Business Security: adds patch management

Some screenshots of Avast

Strengths

• The lowest published per-device business price on this list
• Windows Server protection included in the entry tier
• AV-TEST Top Product (6, 6 and 6) and AV-Comparatives Approved in 2026

Limitations

• The same engine and parent company as Norton
• Renewal costs 25% more than the first year
• No EDR

Other details

Detail	What the vendor states
Sold as	Online from one device
Servers	Included in Essential: Windows Server 2012 to 2025, excluding Server Core
Independent tests	AV-Comparatives, March to June 2026 (Ultimate Business Security): 99.0% real-world, 99.8% malware, Approved; AV-TEST, July and August 2026: 6 / 6 / 6, Top Product

Protecting a Windows Server in a small business

A server is where a small business keeps its shared files and often its accounts, and almost every vendor licenses it differently from a laptop. Check this before comparing headline prices.

Product	How servers are licensed	Server systems named by the vendor
Microsoft Defender for Business	Extra servers licence at $3 per server instance, up to 60 per subscription	Windows Server and Linux
Bitdefender GravityZone	Counted as devices, up to 30% of the total; Linux machines count as servers	Windows Server 2016 to 2025; 2012 and 2012 R2 as legacy
CrowdStrike Falcon	Priced per device; Falcon Go’s server terms are not stated	Server 2008 R2 SP1 to Server 2025
ThreatDown	Separate licence: Core for Servers, $129.00 per server	Windows Server 2016 to 2025 and Linux; no Server Core
ESET PROTECT	One seat per operating system, server or workstation	Windows and Linux servers in Core
OpenText Core Endpoint Protection	No separate server price published	Windows Server 2019, 2022 and 2025
Sophos	Separate per-server subscription; $222.00 a year with EDR on AWS	Windows and Linux
SentinelOne	Counted as endpoints, at the same price	Not listed on the pricing page
Norton Small Business	Not supported	Workstations only
Avast Business	Included in Essential, priced per device	Windows Server 2012 to 2025, excluding Server Core

Two patterns stand out. Server licences are where cheap quotes become expensive: Sophos’s EDR price on AWS doubles for a server ($222.00 against $110.00), and ThreatDown’s server licence costs almost twice its workstation licence ($129.00 against $69.00). And a product that suits a five-person office’s laptops may not run on its server at all, as Norton Small Business shows.

UK businesses: what Cyber Essentials requires

For UK businesses working towards Cyber Essentials, the malware protection control is the one this page answers. The current requirements, version 3.3, have applied since 27 April 2026, and their wording is short: “You must make sure that a malware protection mechanism is active on all devices in scope.”

Anti-malware software qualifies on Windows and macOS devices, including servers, if it is configured to “be updated in line with vendor recommendations; prevent malware from running; prevent the execution of malicious code; prevent connections to malicious websites over the internet.” Application allow listing is the alternative for any device. Two consequences follow. Built-in protection can be enough, because the standard notes that “in most modern products these options are built into the software supplied,” so built-in tools such as Microsoft Defender Antivirus can meet it on Windows if they are active, updated and set up as the standard lists. And the control covers every in-scope device, so a product that cannot run on your server does not meet it on that server. NCSC’s Cyber Essentials resources page lists the current and previous versions.

Which one should you choose?

If you	Choose	Why
Already pay for Microsoft 365 Business Premium	Microsoft Defender for Business	Already licensed, includes EDR; switch its features on first
Want the strongest lab protection you can buy online	Bitdefender GravityZone Business Security or Premium	99.8% real-world protection with very few false alarms
Run Windows PCs and a Windows server on a tight budget	Avast Essential Business Security	Server protection included, from $31.37 a device in the first year
Run a mix of Windows, Mac and Linux	ESET PROTECT Core	All three, plus servers and phones, in one plan
Need EDR but have no one to watch alerts	ThreatDown Elite or ESET PROTECT Premium	24/7 managed detection and response at a published price
Have up to 10 people on laptops and phones and no server	Norton Small Business	Top lab scores, plus backup and a password vault
Want to grow from antivirus to EDR to a managed service	CrowdStrike Falcon	Go, Enterprise and Complete run on one platform
Buy through an IT provider	Sophos or SentinelOne	Both sell through partners, with EDR and managed options
Are in the US and still run Kaspersky	Replace it	No signature updates since 29 September 2024

The best EDR is the one you manage. Every EDR has his good and bad stuff. But all are equally bad if you don’t manage them.

tc982, the accepted answer to a small-business EDR question on r/msp, 15 December 2024

FAQs

Conclusion

Start with what you already pay for. A business on Microsoft 365 Business Premium owns Defender for Business and should switch its features on before buying anything else. For everyone else, the evidence on this page points to Bitdefender GravityZone for protection, Avast Business for price, ESET PROTECT for offices that mix Windows, Mac and Linux, and ThreatDown for affordable EDR with a managed option.

Whatever you choose, check three things before you pay: that the licence is a business licence, that it covers your server, and what the second year costs.

Sources

Checked on 6 October 2026 unless stated otherwise:

• AV-Comparatives, Business Security Test 2026 (March to June), released 15 July 2026
• AV-TEST, business Windows test results, July and August 2026
• MITRE ATT&CK Evaluations, Enterprise 2025 participants
• CISA Known Exploited Vulnerabilities catalog, catalog version 2026.10.04
• Microsoft Security Response Center, CVE-2026-33825
• Microsoft Defender for Business pricing and Defender for Business FAQ
• US Bureau of Industry and Security, Kaspersky Final Determination
• CrowdStrike, Channel File 291 root cause analysis (6 August 2024) and Microsoft, 20 July 2024
• Verizon, 2026 Data Breach Investigations Report, published May 2026
• FBI Internet Crime Complaint Center, Internet Crime Report 2025
• UK Department for Science, Innovation and Technology, Cyber Security Breaches Survey 2025/2026, published 30 April 2026
• NCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3
• Norton licence and services agreement and Avast end user licence agreement
• Gen Digital annual report on Form 10-K, 2026

Using Google Search? Add erp-information.com as a preferred source.