A few habits and one tool keep you safe online. If something slips through, fast action limits the damage.
1. Use Microsoft Defender (it's built in)
Windows ships with Microsoft Defender. It's free, automatic, and good enough for most users:
- Settings → Privacy & security → Windows Security → Virus & threat protection
- Should say "Up to date" and "No actions needed"
- If it's been turned off (often by a previous AV install), turn it back on
You don't need a third-party AV unless your org provides one. Layering AV products typically makes things worse, not better.
2. Keep updates current
Most malware exploits known vulnerabilities that have patches. Just keeping Windows, browser, and Office up to date eliminates most attack vectors.
- Windows: Settings → Update — install promptly
- Browser: usually auto-updates, but check Help → About
- Office: File → Office Account → Update Options
3. Be skeptical of attachments
The attached file types to NEVER open from an unknown sender:
- .exe, .msi, .bat, .ps1, .cmd, .vbs — runs code
- .iso, .img — disk images that contain executables
- .scr, .com — old executable formats still functional
- Macro-enabled Office files (.docm, .xlsm, .pptm) — can run code on open
Even from known senders, if the email seems out of character ("Hey can you check this invoice?" from your VP at 3am), confirm via another channel before opening.
4. Be skeptical of links
Phishing links impersonate real services. Before clicking:
- Hover over the link (don't click). Look at the URL that pops up.
- The displayed text "microsoft.com" can hide an actual URL like
evilsite.com/login/microsoft - Banks and major services never email asking you to click to verify your account
When in doubt, navigate to the site yourself by typing the URL.
5. If you clicked a suspicious link
- Don't enter credentials if the page asks for them
- Close the browser tab immediately
- Run a Microsoft Defender quick scan: Settings → Privacy → Windows Security → Virus & threat protection → Quick scan
- If you did enter credentials, change your password immediately on the real site, and report to IT
6. If you opened a malicious attachment
- Disconnect from Wi-Fi/Ethernet immediately (limits any callback)
- Don't power off — that destroys evidence the IT team uses to assess damage
- Report to IT — they'll guide next steps
The faster you report, the smaller the blast radius. There's no shame here; phishing fools experienced engineers regularly.
7. Password breaches
Check if your email shows up in any known breach: haveibeenpwned.com. If yes:
- Change passwords on any account where you used the breached password
- Use a password manager so each account has a unique one going forward
8. Public Wi-Fi safety
Coffee shop, airport, hotel Wi-Fi:
- Avoid signing in to anything sensitive (banking, work email) without VPN
- Don't transfer files
- Look for HTTPS in the address bar before entering credentials
For work travel, always use the company VPN on public Wi-Fi.
9. Be careful with USB sticks
A USB stick you found, were given by an unknown person, or that came in unsolicited mail can autorun malware:
- Don't plug unknown USBs into work laptops, ever
- Even for transferring files: virus-scan first if possible
- USB sticks remain a common malware vector
10. Microsoft Authenticator app vs. SMS for MFA
Use the app, not SMS:
- SMS can be intercepted via SIM swap attacks (call your carrier, claim your number)
- App pushes require possession of your physical phone
- App also works without cellular (over Wi-Fi)
When to report
Tell IT immediately if you:
- Clicked a phishing link and entered credentials
- Opened a suspicious attachment that did anything (even if it looked harmless)
- Received an email impersonating an executive
- See "your computer has been hacked, call this number" popups
- Notice unfamiliar processes, accounts, or activity
Don't try to clean it up alone if it's beyond a simple scan — IT may need to image the disk for evidence first.