This article was first written with 2022 in mind, but the underlying question, "do I really need a firewall?", still comes up regularly from business owners across the West Midlands. The short answer is yes, but what a firewall needs to do has changed, and it's worth understanding why.
The question behind the question
When people ask if they still need a firewall, they're usually really asking whether traditional network security still matters now that so much work happens in the cloud, on laptops, and outside the office. It's a fair question. If your team works from Microsoft 365, home offices and mobile devices, the old picture of a single office network protected by one box at the edge doesn't fully apply any more.
The answer is that firewalls are still necessary, but they're now one layer among several, not the whole defence.
What has changed is the type of firewall that counts. A cheap box bought once and forgotten is no longer a real option. Attackers now use AI to find and exploit weaknesses far faster than they used to, and the protection that blocks that, intrusion prevention, gateway antivirus, web filtering and threat detection, only works while an active security subscription is in place. That is why we recommend WatchGuard firewalls, kept licensed, patched and monitored rather than left to quietly expire.
What's changed since 2022
- Hybrid and remote working is now standard. Traffic no longer all passes through one office network, so firewalls need to work alongside endpoint protection and secure remote access, not instead of it.
- Cloud applications carry more of the risk. Attacks increasingly target Microsoft 365 accounts, cloud storage and SaaS logins directly, which is why cloud security and identity controls like MFA matter as much as network defences.
- Attacks have become more automated. Scanning tools probe internet-facing systems constantly, meaning misconfigured or unpatched firewalls are found and exploited faster than before.
- Cyber insurance requirements have tightened. Many insurers now explicitly ask about firewall configuration, patching and monitoring as a condition of cover.
- Next-generation features are now standard. Modern firewalls include intrusion prevention, application-level filtering and integrated threat intelligence, well beyond simple port blocking.
So, do you still need a firewall?
Yes. A firewall remains the first checkpoint between your network and the internet, controlling what traffic is allowed in and out and providing visibility into unusual activity. Without one, every device on your network is directly exposed to the internet, regardless of how good your other protections are.
What's changed is that a firewall alone is no longer sufficient. It needs to work as part of a layered approach.
A modern layered setup typically includes:
| Layer | Purpose |
|---|---|
| Firewall | Controls network traffic in and out, blocks known threats |
| Endpoint protection | Defends individual laptops and servers, including remote devices |
| Identity and access controls | MFA and conditional access to protect cloud logins |
| Email security | Filters phishing and malicious attachments before they reach staff |
| Monitoring | Ongoing visibility so unusual activity is spotted quickly |
| Backup | Ensures recovery is possible if something does get through |
Common firewall mistakes we still see
- Firewalls left on default settings since installation
- Firmware and security patches not applied for months at a time
- Rules that were added for a temporary reason years ago and never removed
- No logging or monitoring, so a breach could go unnoticed
- Treating the firewall as the only line of defence, with no endpoint or email protection behind it
Where LeapIT fits in
Our cyber security service covers firewall selection, configuration and ongoing management, alongside the other layers that make it effective, such as endpoint protection and monitoring. For businesses wanting an outside view of their current setup, our cyber security consultancy team can review existing firewalls and identify gaps without needing to rip and replace everything.
This usually sits within a broader IT support arrangement, so firewall management isn't a one-off project but part of ongoing helpdesk and monitoring cover. It's a common area of focus for regulated sectors including finance, healthcare and legal businesses, as well as manufacturing firms with connected production systems.
We support businesses across Birmingham, Solihull, Worcester and the wider West Midlands with both new firewall deployments and reviews of existing kit.
FAQs
Is a home broadband router's built-in firewall enough for a business?
No. Consumer routers lack the logging, rule granularity and support needed for business use. A dedicated business firewall gives far better control and visibility.
Do we still need a firewall if we're fully cloud-based?
Yes, in most cases. Office networks, guest Wi-Fi and remote access still need protecting, and many businesses retain some on-premise equipment even after moving core services to the cloud.
How often should firewall rules be reviewed?
At least twice a year, and whenever there's a significant change such as a new office, new supplier connection or system decommissioning.
What's the biggest firewall mistake small businesses make?
Installing one and then never updating or reviewing it again. A firewall is only as good as its configuration and patch status.
If you're not sure whether your current firewall setup still holds up, book a call or get in touch and we'll take a look.
