Antivirus vs firewall vs monitoring is a comparison most owners never get a straight answer to, even though they pay for all three. The short version is that a firewall controls what is allowed to travel in and out of your network, antivirus looks at files and programs on individual computers, and monitoring is the only one of the three whose job is to notice that something has already gone wrong and tell a human being about it.
That distinction is worth twenty minutes of your attention, because it is the difference between a line on an invoice and a protection you can actually rely on. Two of these three work whether or not anybody is paying attention. The third one only works if somebody is.
What a firewall covers
A firewall sits at the edge of your network and decides what traffic is allowed through, in both directions. It is the equivalent of a locked front door with a list of who is expected today.
What it does not cover is anybody who arrives with a valid key. When an employee signs in to a fake page and hands over a password, the person using that password afterwards is not breaking through the door. They are walking in through it, at a normal hour, from a connection that looks unremarkable. The firewall has no opinion about that, and it should not, because it is doing exactly what you configured it to do.
What antivirus covers
Antivirus, and the more modern versions your provider may call something else, watches the files and programs on each computer and blocks the ones it recognizes as harmful. It works well against the mass-market attacks that arrive by the thousand, which is the majority of what reaches a small company.
Its blind spot is the attack that involves no harmful file at all. Somebody signing in to your email with a stolen password installs nothing, and somebody reading your invoices for three weeks runs no program worth flagging. There is nothing for the software to catch, because from where it sits, nothing is happening.
What monitoring covers that the other two do not
Monitoring means somebody is watching the record of what happened on your systems and acting when the pattern looks wrong. A sign-in from two countries within the same hour, a mailbox suddenly forwarding everything to an outside address, a file server being read at three in the morning.
Every system you already own writes most of this down by itself. The value you are buying is not the writing down, which happens anyway. It is that a person or a service reads it, decides which two lines matter this week, and picks up the phone. This is the part of the security operations service that people find hardest to picture, and it is also the part that shortens an incident from months to days.
The number that shows where the gap sits
Across the companies IBM studied in its 2026 Cost of a Data Breach Report, it took an average of 247 days to find a breach and shut it down, made up of 183 days to notice it and another 64 to close it. That figure went up this year, after five years of getting shorter.
Six months of somebody reading your email is not a technology problem you can solve with a better product at the door. It is the absence of anybody looking at the record. Antivirus and firewalls were running in most of those companies the entire time.
Read these numbers honestly
IBM studied 602 organizations across 16 countries and 17 industries that had already suffered a breach. Most of them are considerably larger than a 40-person company, and most of them have security staff of their own. These are not directly your numbers.
What transfers is the direction. If organizations with in-house security teams take six months to notice, a company whose provider checks in during business hours is not going to do better by accident. The gap gets closed by somebody being responsible for looking, not by owning more equipment.
The same incident, seen by all three
Take an ordinary case. An employee in accounts receives a message that looks like it came from a supplier, signs in on a page that looks like the supplier portal, and goes back to work. Nothing on her screen suggests anything happened.
The firewall sees a normal visit to a website and allows it, which is correct behavior. The antivirus sees no file arrive and nothing installed, so it stays quiet, which is also correct. Three days later somebody signs in to her mailbox from another country, reads the payment conversations for a fortnight, and sends one invoice with an altered bank line.
The only point in that sequence where anything could have been caught is the sign-in from another country, and catching it requires somebody to be reading the record that your systems were writing the whole time. That is the job of the third protection, and it is the reason it cannot be replaced by buying a better version of the first two.
Antivirus vs firewall vs monitoring on the same invoice
An invoice that lists all three tends to read as complete coverage. In practice the first two protect the boundary and the machines, and the third is the only one that concerns itself with what happens after something gets through.
If your provider covers the first two and describes the third in vague terms, you are not underprotected in an unusual way. You are in the same position as most companies your size, and it is a position that becomes visible only during the incident, when you find out how long something had been running before anybody said anything. This is worth clarifying before renewal rather than after, particularly if your current agreement has not been reviewed in a year or more.
There is a cost conversation attached to this, and it is a smaller one than most owners expect. Watching the record around the clock is usually priced per person or per computer rather than as a project, so the decision in front of you is normally whether to add a line to an existing agreement, not whether to fund something new. Ask for the price both ways, with business-hours coverage and with overnight coverage, and the difference tells you what the after-hours risk is actually worth to your provider.
The questions to ask your IT provider
- Which of these three do I pay you for today, and can you show me the line for each?
- Who reads our security alerts, and what are their hours on a weekend and a holiday?
- If somebody signed in to our email from another country tonight, how would that reach me, and how long would it take?
- How long could an intruder sit in our systems before somebody noticed?
- If I asked you what happened on our network last Tuesday, could you tell me?
That last question sorts the two situations quickly. A provider who can answer it is keeping and reading the record. A provider who cannot is selling you the first two protections and letting you assume the third.
If you would like help working through the answers you get, we do this with owners regularly. Our frequently asked questions cover the ground most of them start on.
