I’m old enough to remember when computer viruses spread via floppy disks traded by kids in the school yard, and that was all there was to “Malware”. Few people bothered with anti-virus software because it was expensive, and there was no Internet to download new signatures with every day. Getting updates meant buying a whole new version at a bricks-and-mortar computer store (or y’know, trading it with a mate in the school yard).

The Dotcom boom changed that. Email-borne viruses like Melissa and ILOVEYOU found their way into millions of inboxes around the world, and suddenly anti-virus went from a nice-to-have to mandatory. Since then we’ve had trojans, worms and botnets, keyloggers and spyware, rootkits and zero days, ransomware and extortion-ware. Sophisticated cyber weapons like Stuxnet. All the way up to modular polymorphic multi-stage payload malware. Pretty soon we’re going to have rogue AI agents to worry about as well (we are living in the time of Cyberpunk after all).

With all that in mind, is it really any wonder that OpenCASE says…

Priority 3 - Protect against malware.

There’s no denying that malware is still one of the top cyber-threats facing small businesses in 2026. If anything, it has gotten worse in recent years. The 2026 Verizon DBIR report shows that “exploitation of vulnerabilities” has surpassed both phishing and credential abuse to become the top initial access vector in data breaches. Reading between the lines, we can infer that it’s become easier and more reliable for cyber-criminals to infect vulnerable systems with malware than rely on unpredictable, and increasingly more cyber-aware humans, to click dodgy on links.

Fortunately, malware protection is a lot more accessible and user friendly than it was in the bygone days of Norton and McAfee’s objectively terrible products. For a start, Windows comes with best-in-class malware protection built in, so for most people, the hard part is already done. Unfortunately, malware can now infect a lot more than just computers. Everything from your mobile phone to your TV to your doorbell has a computer in it these days, and they’re all connected to the Internet, which makes them targets. Malware has also learned a few new tricks over the years, not the least of which is disabling your security software entirely.

Implementation Level 1 - Install an anti-malware solution on all computers.

As usual, OpenCASE starts with the basics. One of the easiest, lowest friction, and most effective defenses against malware is to install an anti-malware solution on your computers. It’s not a bulletproof defense, but it will block or detect and clean the vast majority of infections which rely on old exploits or copied code - assuming you keep it up to date! Most anti-malware software updates itself these days, but it never hurts to check every now and then.

You might be thinking the bar for this Implementation Level is low, given that built-in Windows Defender ticks this box without any effort required, but it’s important to keep in mind that not every small business uses Windows. Macs are quite popular in small businesses, perhaps more so than in enterprise, because they don’t have to comply with corporate build standards or integrate nicely with the Microsoft ecosystem. Contrary to popular belief, Macs are not immune to malware (though it certainly is less common), so it’s important to make sure they are protected. I don’t want small business owner thinking “I don’t have to worry about malware because we use Macs”.

Implementation Level 2 - Block DNS requests to malicious domains.

Given modern malware often relies heavily on Internet connectivity to contact “command and control” (a.k.a. C2) servers or download second stage payloads, inspecting and filtering DNS requests is a surprisingly effective way to stop malware in its tracks. DNS filtering is also relatively simple to implement, and doesn’t really require much in the way of on-going upkeep once it’s set up, which is what we want for small business.

Some third-party anti-malware software includes this feature, so if yours does it may be as simple as turning the feature on, and you’re done. If not, the solution is almost as simple: it only requires setting your computers to use a DNS service which blocks requests to domains which are known to be malicious. There are even a few freely available options (Check out the GUIDANCE for details), so this protection won’t cost you anything, and the service takes care of all the hard work in figuring out what to block and what’s safe to let through. Of course, if you want something more configurable, that gives you more control over what gets blocked, that’s available too through commercial DNS security offerings.

Implementation Level 3 - Monitor computers for suspicious or malicious activity.

Early computer viruses were blunt instruments: static code that looked that the same on every computer, which made it easy to identify using “signatures”. Modern malware is much more elegant, and has evolved to evade detection by such simple methods. Often the first sign of a malware infection these days is behavioural - when your computer starts doing something it normally wouldn’t. Protecting against this kind of malware therefore requires real-time behavioural monitoring at the operating system level. In practice, this means you need what’s typically referred to as “next-gen endpoint security”, which is a fancy way of saying anti-virus software that looks for exactly this type of activity.

Admittedly, this is a big jump in both capability and complexity from ILv.2 (not to mention cost). Unlike the requirements for Implementation Levels 1 and 2, it’s not really set and forget. This sort of security solution requires both proactive configuration and tuning for your environment, as well as monitoring by someone capable of responding to any alerts it generates. Consequently, it’s almost definitely going to require an IT service provider or specialist IT support person in the business to implement properly. The payoff in risk reduction however, is substantial. Ransomware which may go undetected by traditional means should set off all sorts of alarms when it starts encrypting all your files. That distinction alone should be enough to sell it.

Conclusion

As we wrap up, it’s worth noting that the protections outlined in Priority 4 are specifically about computers, and by that I mean laptops and desktops. Mobile devices, IoT, network appliances, and other IT equipment are not explicitly in scope. That’s not to say malware is a any less relevant to those types of assets, or that small businesses shouldn’t implement malware protections for them, but from a technology perspective, they are harder (and more expensive) problems to solve. Given the design assumptions of OpenCASE, an organisation that has the maturity and capability to tackle those problems is likely already beyond the target audience.

With all that said, protecting against malware is something every small business needs to take seriously. The daily-driver computers used by employees are where the bulk of the risk lies for small business, because that’s typically where all the work gets done. OpenCASE reflects this by getting small business to focus their malware protections first. The hope is that sets them up well to tackle the harder malware problems as they grow and mature.