Anyone who sells you 100 percent security is selling fiction. This page lists, plainly, what the four layers cannot do - because a setup you understand honestly protects you better than one you believe in blindly.
The firewall, endpoint, antivirus and backup layers stop the overwhelming majority of real attacks. But a professional guide owes you the other list too: the attacks that get through anyway. Insiders, zero-day flaws and patient social engineering do not respect product brochures. This page names each limit honestly and - more useful - shows what a small office can still do about every one of them. Layers reduce risk. They never erase it, and planning for the remainder is part of real security.
Every layer assumes the attacker lacks valid access. An insider has it: the accounts clerk who can already open the billing data does not need to hack anything to copy it. Technology's honest answers are least privilege (each person can reach only what their job needs), logs that someone reads (unusual downloads and after-hours access get noticed), separation of duties for payments, and same-day offboarding when employment ends. None of these make a determined insider harmless - they make misuse harder, visible, and attributable, which is what actually deters it.
A zero-day is a flaw attackers know before the vendor does - by definition, there is no patch on day one. This is where defence in depth stops being a slogan: the firewall limits what can reach the flaw, EDR watches behaviour rather than signatures, standard-user accounts limit what exploited software can do, network separation contains the blast, and the backup decides whether the worst case is survivable. When the patch lands - often within days - the patching routine from this series is what closes the hole before the mass attacks begin.
The most reliable modern attack does not break in; it asks. A convincing call or message persuades an employee to approve an MFA prompt, read out a code, install a remote-support tool, or change a supplier's bank details. Products help at the margins; process is the real defence: no bank-detail change without a callback to a known number, no MFA approval for a login you did not just start, no urgent payment that bypasses the second person's check - ever, for anyone, including the boss. Write these three rules down. They have saved more money than most software.
Mature security ends with a sober step: for the risk that remains, have a response ready. Know who you will call (your IT provider, your bank's fraud line, the cyber-crime reporting portal), keep the offline backup and admin recovery codes reachable, and consider cyber insurance once the basics are provably in place - insurers increasingly demand exactly the four layers in this series before they will cover you. The goal was never a perfect wall. It is an office where an attack is unlikely, contained if it lands, survivable if it spreads, and answered with a plan instead of panic.
See the complete security setup live - firewall, endpoint, antivirus and backup, all in one video.
Watch Full VideoBecause most insider damage is opportunistic, not masterminded. Least privilege shrinks what any one account can reach, logs make misuse visible, and together they stop the common cases and deter the rest.
You cannot patch what has no patch - so you contain: patched everything else, standard-user accounts, EDR behaviour monitoring, network separation, and tested backups. Then apply the official patch the moment it releases.
It can be, as the last layer for the risk you cannot remove - but read the conditions. Insurers increasingly require MFA, patching and tested backups before paying claims, which is exactly the setup in this series.