The best secure routers include a combination of intelligent firewalls and intrusion prevention systems that will keep you safe by recognizing and stopping typical online attacks, plus regular and frequent updates to make sure you’re always one step ahead of the bad guys. They often provide built-in VPN services to keep your browsing private from prying eyes, and come with settings that are secure by default, so you won’t have to be a networking expert to benefit from top-notch security. The best secure routers are ideal for anybody who wants to keep their online activities secure and private with minimal effort. The AX6000 speed rating means that you’ll get up to 6Gbps of bandwidth for all your devices, plus improved range and reliability, thanks to four powerful beamforming antennas. Wi-Fi 6 OFDMA and MU-MIMO support allow it to handle even more devices vying for your bandwidth, even with only dual-band Wi-Fi support. A very generous set of eight Gigabit Ethernet ports around the back also gives you plenty of options for wired devices without the need for an additional network hub or switch. Two versatile USB 3 ports can be used for anything from sharing media and printers to performing Time Machine backups from your Macs. Like most Asus routers, however, what really sets the RT-AX88U apart from the competition is its comprehensive AiProtection Pro suite of commercial-grade security features. Powered by Trend Micro, the router can automatically prevent you from accessing dangerous and malicious sites to protect you from malware, phishing, spam, adware, hacking, and ransomware attacks. A two-way intrusion prevention system also protects your devices from external threats such as distributed denial-of-service (DDoS) attacks, and blocks infected devices on your home network from connecting out to botnet servers. There’s also a built-in VPN server with support for the most popular VPN protocols such as OpenVPN, so you can make secure connections back into your home network. Advanced parental controls help keep your kids away from the darker corners of the internet and limit their online time. Best of all, unlike many other router manufacturers, Asus doesn’t charge any recurring subscription fees for these advanced security features, so you won’t be locked into recurring monthly costs just to keep your home network safe. Wireless Spec: 802.11ax | Security: AiProtection Pro, WPA3, 802.1x, OpenVPN/IPSec/PPTP | Standard/Speed: AX6000 | Bands: Dual-band | MU-MIMO: Yes | Beamforming: Yes | Wired Ports: 9 The AX3000 rating means you’ll get a solid 3Gbps of dual-band Wi-Fi, shared across the 5GHz and 2.4GHz frequencies. In addition to the beamforming antennas, it includes a nice assortment of other advanced features we don’t usually find in routers at this price range, including 160MHz-wide channels, plus static link aggregation to allow you to combine two of the Gigabit Ethernet ports into a single 2Gbps link for handling ultra-fast internet plans or even higher-performance NAS devices at home. While it’s not the more advanced 802.1AX LACP link aggregation that’s offered by some of TP-Link’s higher-end routers, it’s still a nice bonus at this price, and more than ample for the needs of most home users. The AX50 also offers a robust suite of security and parental control features through TP-Link’s free HomeCare suite, which is powered by Trend Micro. While the underlying anti-virus and anti-malware features are similar to what Asus’ AiProtection offers, the parental control features are much more granular, allowing for blocking of websites based on a wider variety of age-based categories, along with the usual time-based scheduling features. The security features are also rounded out with an OpenVPN server to give you secure access back into your network when you’re away from home, along with easily customizable QoS to make sure your streaming, gaming, and video calls get top priority. One word of caution: TP-Link sells another very similar version of the AX50 known as the AX3000 that looks the same and offers near-identical Wi-Fi specs, however it lacks the free HomeCare subscription and only sports a USB 2.0 port, so don’t be misled by the fact that both are AX3000 speed routers—it’s definitely the AX50 that you want. Wireless Spec: 802.11ax | Security: HomeCare, WPA3, OpenVPN | Standard/Speed: AX3000 | Bands: Dual-band | MU-MIMO: Yes | Beamforming: Yes | Wired Ports: 5 While you can technically buy a single Eero Pro to get 1,750 square feet of coverage, Eero works best with multiple units as a holistic mesh Wi-Fi system, with three units able to deliver over 5,000 square feet of strong and reliable Wi-Fi coverage throughout your home. If you need more than that, you can simply buy additional Eero Pro, Eero, or Eero Beacon units to expand into the farthest reaches of your home. Eero Pro units offer tri-band Wi-Fi with a single 2.4GHz and dual 5GHz bands, while standard Eero and Eero Beacon devices provide dual-band Wi-Fi, so you can mix and match to create the best system for your particular needs. The Eero Beacons sacrifice the two Gigabit Ethernet ports found on the other units in favour of an unobtrusive plug-in design that can also double as a nightlight around your home. Best of all, however, is that the Eero system is ridiculously easy to configure. All the setup is handled through a mobile app that requires no knowledge whatsoever of routers or network systems. It’s one of the most intuitive user interfaces we’ve seen, which probably isn’t all that surprising considering it was designed by former Apple engineers. It’s probably also not a coincidence that Eero is one of the first mesh Wi-Fi systems to be certified as a secure router for Apple HomeKit, so it’s a cinch to set it up to protect your smart home devices. While all of this basic security is built in at no extra charge, users who want more can opt into Eero Secure for a small monthly fee, adding real-time content filtering that dynamically blocks out unsafe and unsavoury websites. Unfortunately, as great of a system as Eero is, users of DSL internet plans that use PPPoE will want to look elsewhere, as Eero is one of the very few routers that doesn’t support this protocol. Wireless Spec: 802.11ac | Security: Eero Secure, WPA3 | Standard/Speed: AC2200 | Bands: Tri-band/Dual-band | MU-MIMO: Yes | Beamforming: Yes | Wired Ports: 2 (per unit) In fact, the GT-AX11000 actually adds a number of specialized security features designed expressly with gamers in mind. This includes VPN Fusion, which will let you keep your VPN up and running to secure your normal surfing and browsing traffic without the overhead that normally slows down your games. Asus’ AiProtection Pro is baked in here too, but it’s been enhanced with the kind of features gamers need, such as Open NAT for easily teaming up with your friends to join and host multiplayer games without compromising network security, and an intrusion prevention system (IPS) that won’t mistake your friends’ gaming traffic for an attack on your router. All of this comes with advanced tri-band 802.11ax Wi-Fi 6 that offers combined speeds of 10Gbps across the two 5GHz and single 2.4GHz bands, plus eight beamforming antennas that can blanket a 5,000 square foot home filled with dozens of Wi-Fi devices. Four Gigabit Ethernet ports around the back are joined by a specialized 2.5Gbps gaming port, and support for Asus’ AiMesh 2.0 technology lets you mix and match an assortment of other Asus routers to create a mesh network throughout your home. Wireless Spec: 802.11ax | Security: AiProtection Pro, WPA3, OpenVPN/IPSec/PPTP, VPN Fusion, Open NAT | Standard/Speed: AX11000 | Bands: Tri-band | MU-MIMO: Yes | Beamforming: Yes | Wired Ports: 5 To be clear, the RT2600ac is no slouch, with four powerful beamforming antennas delivering great range, plus AC2600 dual-band Wi-Fi that can deliver up to 1.7Gbps of bandwidth to your 5GHz devices and 800Gbps on the 2.4GHz channels. While it’s not designed to handle the largest and busiest homes, it still provides more than enough speed for the streaming, surfing, and gaming needs of a typical family, plus MU-MIMO to make sure every device gets its fair share of bandwidth. This means you’ll have no problem watching Netflix in 4K and keeping in touch with friends and family on Zoom and FaceTime. Keeping with its NAS expertise, Synology includes a pair of USB ports and an SD card reader, so you can easily share media files with your whole family. Where the RT2600ac shines, however, is in its Router Management System, which offers a level of flexibility and power that goes beyond the firmware found on most routers. This is more like a full router operating system, and not only is it effortless to set up, but the tile-based interface will be immediately recognizable to anybody who’s ever used one of Synology’s NAS devices. This makes the parental controls especially versatile, letting you set up general filtering rules for your entire network and your guest network separately, plus individual profiles for your kids to schedule their online time, set time limits, and block inappropriate content by category or specific URL. Like the company’s NAS devices, the RT2600ac also includes the same Package Center for downloading add-on apps, such as a VPN server or an intrusion prevention system, letting you tweak the security to your specific needs. Wireless Spec: 802.11ac | Security: SRM Safe Access, WPA2, SSL VPN | Standard/Speed: AC2600 | Bands: Dual-band | MU-MIMO: Yes | Beamforming: Yes | Wired Ports: 5 With advanced 802.11ax Wi-Fi 6 capabilities, the RAX80 is no slouch on the wireless side either. The large hawk-like wings conceal four powerful beamforming antennas that can deliver up to 2,500 square feet of coverage, and the dual-band AX6000 rating means you’ll get combined speeds of up to 6Gbps—4.8Gbps on the 5GHz band and 1.2Gbps on the 2.4GHz side. While Wi-Fi 6 compatible devices will give you the best performance, the RAX80 is also fully backward-compatible with your Wi-Fi 5 and older clients. Four Gigabit Ethernet ports around the back also support 802.3ad link aggregation, so you can pair one of them up with the WAN port to get a 2Gbps connection to a compatible cable modem or DSL router. The RAX80 also includes Netgear’s Armor cybersecurity suite, powered by Bitdefender, although you’ll have to pay a small annual fee to access this once the initial trial period is over. Netgear Armor protects your network devices from malware, viruses, and other internet attacks, whether that’s smartphones and laptops or connected home devices like thermostats and door locks. Thanks to Netgear’s mobile app, you can get instant alerts whenever a threat is detected and blocked by the router, along with automatic blocking of potentially harmful websites, and even a full-featured VPN to keep your browsing activity private and secure. Wireless Spec: 802.11ax | Security: Netgear Armor, WPA3, 802.1x, OpenVPN | Standard/Speed: AX6000 | Bands: Dual-band | MU-MIMO: Yes | Beamforming: Yes | Wired Ports: 5 This diminutive little box provides impressive AC750 dual-band WI-Fi, which is more than enough for the places most folks will be using it. Although the GL-AR750S doesn’t provide the range of a traditional home router, it’s important to remember that’s not the point; this one is purpose-built to deliver secure Wi-Fi to a handful of personal devices within a small area like a hotel room or conference room. Three Gigabit Ethernet ports let you share a connection to your wired devices as well, and there’s even a microSD card slot built in, so you can pack in 128GB of storage to use it as a portable file and media server. Of course, you can certainly share that with your colleagues too, and thanks to its OpenWRT firmware, it’s versatile enough to be used in a variety of different ways, such as creating a standard wireless network, or acting as a range extender, wireless bridge, Wi-Fi client, WISP network hotspot. The built-in USB 2.0 port also lets you share files or connect a cellular USB modem to use it as a mobile hotspot. Best of all, a built-in OpenVPN server included 25 preconfigured VPN service providers and Cloudflare’s encrypted DNS servers, so you can easily ensure that all of your internet activity is encrypted to guarantee maximum privacy and security, wherever you may land. Wireless Spec: 802.11ac | Security: OpenWrt, WPA2, OpenVPN, WireGuard, CloudFlare | Standard/Speed: AC750 | Bands: Dual-band | MU-MIMO: No | Beamforming: No | Wired Ports: 3 Although we wouldn’t recommend this one for covering a multi-floor home by itself, it can also double as a wireless access point or range extender, and at this price you could buy two or three for the cost of a single higher-end router and deploy them around your home. One of the more unique features the RT-N12 offers is the ability to configure four different SSIDs, each with different passwords. This means you can set up different networks for groups of devices, such as your kids’ tablets and your smart home devices, and then manage what can be accessed and even how much bandwidth is allocated to each one. Sadly, you won’t get anything more than a basic firewall at this price—it lacks the malware protection and intrusion prevention features of Asus’ more premium routers—but it does offer PPTP VPN support, so you can connect securely to your home network while you’re on the road. Wireless Spec: 802.11n | Security: WPA2, PPTP, Multiple SSIDs | Standard/Speed: N300 | Bands: Single-band | MU-MIMO: No | Beamforming: No | Wired Ports: 5 In terms of Wi-Fi performance, the WRT3200ACM sticks with the more traditional dual-band 802.11ac standard, but its AC3200 rating also means it delivers a whopping 3.2Gbps of bandwidth across its 5GHz and 2.4GHz bands, and with 2.6Gbps on the 5GHz side, it’s still among the fastest Wi-Fi 5 routers on the market. It was also one of the first Wi-Fi 5 routers to support 160MHz-wide channels, and while this is becoming a standard thing on the latest Wi-Fi 6 routers, it’s still a less common find in the 802.11ac world. Ultimately, though, the WRT3200ACM is a router for those who want to unlock a wide spectrum of customizable network security tools, since the open-source firmware lets you access a wide variety of firmware packages form source distributions like OpenWrt and DD-WRT that let you turn it the specific kind of secure router you need. This includes a wide range of advanced VPN solutions, intrusion prevention systems, and even stateful firewalls with deep-packet inspection. For those who want the ability to tinker and tweak their router, the WRT3200ACM is a dream come true. It’s also compatible with Linksys’ Smart Wi-Fi app, so you don’t need to be a networking expert to set it up, but realistically the WRT3200ACM is made for the networking enthusiast—at this price there are better options available for those who want a router that just works. Wireless Spec: 802.11ac | Security: WPA2, OpenWrt/DD-WRT | Standard/Speed: AC3200 | Bands: Dual-band | MU-MIMO: Yes | Beamforming: Yes | Wired Ports: 5 Jeremy Laukkonen is an experienced tech journalist with a background in automotive repair that has taught him the importance of breaking down complex technical subjects in understandable ways. He specializes in VPNs, antivirus, and home electronics, and manages his own automotive blog on the side. Benjamin Zeman is a business consultant, musician and writer based in southern Vermont who specializes in solving complex problems for businesses in need of an outside perspective. With more than 20 years of experience in the tech industry and an educational background in the arts, he has an eye for well-designed tech products and an understanding of how they fit into our lives.
The Ultimate Secure Router Buying Guide
Today’s internet can be a dangerous place, with perils that weren’t even dreamt of by the academics who built its foundations over 50 years ago. As a result, it’s no longer enough to trust a basic router to protect your home and your family from online threats, especially if you have kids and internet-connected smart devices around your home. This is where a good secure router comes in, offering features that can protect your home network not only from the traditional dangers of hackers trying to get into your network from outside, but also from malicious apps that might find their way onto your computers, smartphones, or internet-of-things devices. The best secure routers guard the digital borders of your home to keep the bad guys out while ensuring that all of your personal data stays where it’s supposed to.
Why Buy a Secure Router?
When choosing a secure router, it’s important to keep in mind that “secure” can be a pretty broad term; not all secure routers offer the same features, and you may not even need everything that’s possible with a secure router. For example, some secure routers can act as a Virtual Private Network (VPN) server, allowing you to access computers and other devices inside your network when you’re away from home, but of course if you never need to do this, it’s not going to be a priority when choosing a secure router. Similarly, while some routers provide secure guest networks, these are only useful if you regularly have people visiting your home and want to give them more limited access to your network. That said, there are a few key components that all secure routers should offer, including wireless encryption to keep your network safe from Wi-Fi squatters in your neighbourhood, a good advanced firewall to block both inbound and outbound traffic, and access control features to block unwanted devices that might show up. Since new internet threats and exploits are appearing all the time, it’s also important that your router have regular firmware updates available that can be applied automatically, so you won’t have to worry about whether you’re protected from the newest threats.
Wi-Fi Encryption
Every modern secure router should support Wi-Fi Protected Access 2 (WPA2) as a bare minimum to ensure that the wireless connections between your devices and your router are securely encrypted. This also keeps unwanted devices off your network, since WPA2 requires devices to supply a password before they can connect to your router. WPA2 is an improvement upon the older WPA standard, however any secure router worth its salt supports both, so there’s never any reason to use the less secure WPA; in fact some of the newest routers are even phasing out the older one entirely. Under no circumstances should you ever buy a router that only supports the much older Wired Equivalent Privacy (WEP) standard, as it was cracked years ago, and is basically as insecure as having no encryption at all. In fact, if you have a router that only supports WEP, even with its latest firmware, we’d suggest throwing it away and buying a new one with WPA2 support as soon as possible. Many of the very newest routers, particularly those supporting the latest Wi-Fi 6 802.11ax technology, include the even better WPA3 encryption standard. This is more secure if you can get a router that offers it, but keep in mind that WPA2 is still fully supported, and should be more than secure enough unless you’re being very specifically targeted by skilled hackers. Further, until all of your client devices support WPA3, you’ll still need to run your router in compatibility mode to support older WPA2 devices, which takes away some of the advantages of using WPA3. Also remember that all of these wireless encryption standards are only as good as the password that you choose to secure your network, so if you use something like “password” or your home address as your Wi-Fi password, even WPA3 isn’t going to be able to do much to protect your network against intruders.
Wi-Fi Protected Setup (WPS)
Most routers support a feature called Wi-Fi Protected Setup, or WPS, which is designed to help you quickly and easily connect supported devices by pressing a button on your router or using a PIN that’s much shorter and easier to type than your full WPA2/WPA3 password. From a security perspective, WPS is a bad idea. There have been a number of security vulnerabilities found with WPS that can let hackers into your network, and although the push button version of WPS is slightly more secure than the easily-hacked PIN method, it’s still designed so that whenever you push the button to add a new device, you’ve created a window during which any WPS device in your neighbourhood will be able to hop onto your network unchallenged. While most routers have WPS support, good secure routers give you the option to disable the feature, and actually do so when you tell them to. Some routers will also allow you to enable push-button WPS without also turning on PIN-based WPS, which is a good compromise if you really find yourself wanting to use the feature, but there are much safer ways to share Wi-Fi passwords than letting your devices bypass them entirely with WPS.
Guest Networks
A Guest Network is a second wireless network that’s broadcast by your router, using a different name (SSID) that you can give to friends, extended family, and other visitors to your home when you don’t want to hand out your primary Wi-Fi password and prefer to give them more restricted access to your network. Most routers offer guest networks that can be partitioned off from your main network, preventing your guests from accessing your computers, media servers, and smart devices. Some routers also let you specify different time limits or speed restrictions on your guest network as well, so you can keep visitors from eating up all of your internet bandwidth. Even though a guest network doesn’t normally allow access to your other devices, it still presents a security risk as it lets people use your internet connection, and many hackers look for insecure networks to download illegal material so that it can’t be traced back to them. Always use a secure password for your guest network, and turn it off when you don’t need it. In fact, some of the better routers let you easily switch your guest network on and off from either a smartphone app or even with Alexa voice commands like “My friends are leaving.”
Firewalls
It goes without saying that a good secure router should also provide a good firewall to protect the devices on your network from hackers. However, while almost every router provides a natural barrier from direct intrusion through the use of Network Address Translation and private IP addresses, a proper firewall takes that a few steps further through the use of features like packet inspection that can actually monitor and analyze what’s passing into your network to provide virus and malware detection as well. Also keep in mind that an inbound firewall isn’t nearly enough these days; a good secure router also needs to make sure that it’s looking at traffic that’s leaving your network, since even the best-managed PCs can occasionally get tripped up by a bit of malware, and there’s always the chance that a family member might inadvertently install and run something on their own computer that could poke a hole in your defenses.
Access and Parental Controls
While a firewall tends to just work in the background to protect your network, most secure routers also offer varying degrees of access control so that you can lock down individual devices in various ways, restricting what they can access online and when they can access it. While there’s naturally some overlap here with parental control routers, those actually form a more specialized category of their own, since parents are usually looking for age-appropriate controls and the ability to manage screen time—features which aren’t inherently necessary in a secure router. Nonetheless, any secure router should allow you to set basic access controls on a per-device basis, as well as “pausing” or blocking the internet for specific devices when you need to cut off access.
Smart Home Devices
The emergence of internet-connected smart home devices has given rise to a whole new set of potential security risks, as many devices that are used for features like lighting control regularly “phone home” to their own online services outside of your network. This creates another point of vulnerability, since if that service gets hacked or starts acting up, it can take all of your smart home devices along for the ride.
Virtual Private Networks
A Virtual Private Network, or VPN, can be used for several different purposes, but it’s basically a way of creating a secure network that encrypts your network traffic between two points to keep it safe from the prying eyes of your ISP or anybody else who may happen to be monitoring it. There are actually two different aspects to a VPN, however. A VPN server allows your secure router to act as a gateway so you can get back into your network when you’re away from home, while a VPN client allows you to establish a connection to another VPN service, whether it’s to access secure systems at your workplace or simply a commercial VPN provider to help protect your privacy. Using a VPN can also have additional benefits, such as letting you bypass geographic content restrictions and preventing your ISP from monitoring and slowing down, or “throttling,” certain types of internet traffic. When using a VPN, all your ISP sees is unidentifiable encrypted data. Some secure routers can serve as both VPN clients and VPN servers, while others may only do one or the other. Almost all of them can pass VPN connections through from your individual network devices, however, so you may not need VPN client support on your router unless you want to automatically send all of your outbound traffic through a VPN.
Regular Firmware Updates
The internet is a rapidly changing place, and new vulnerabilities are always being discovered in even some of the most secure operating systems and routers, with new threats and exploits being developed to go along with them. Therefore, it’s crucially important that you pick a secure router that’s going to be able to provide you with new firmware updates as quickly as possible to plug holes when new exploits are discovered. This not only means that manufacturers should have an aggressive update schedule, but your router should also be able to install these updates automatically without requiring your intervention. This saves you the trouble of managing it and also ensures these updates get applied as quickly as possible. While many router firmware updates are fairly routine, you don’t want to be caught off guard when a major exploit does surface.
A Word on Open Source Routers
If you like to tinker, or simply want more advanced security features, an open-source router that uses OpenWrt or DD-WRT can open up access to some really sophisticated solutions, since they offer a modular design with a wide variety of packages you can install to customize them for your needs. Popular open-source firmware systems can also theoretically be more secure as they have more people around the world scrutinizing them for flaws, as opposed to the closed-source solutions that don’t get reviewed beyond the manufacturer’s own engineers. That said, however, as long as you’re buying a router from a company with a solid track record, we wouldn’t worry too much about open source firmware. If you want to tinker, an open source router is a great choice, but if you want something that just works, you’re better off staying with one of the more standard solutions.
Top Brands
Asus Asus has become one of the leading brands in secure routers, offering strong firewall and VPN support for both client and server connections, fully configurable guest networks, and an AiProtection Pro suite of malware security features powered by Trend Micro that is included at no additional charge for the life of your router. This is all backed up by some of the best performance and coverage specs available, and they make especially great routers for gamers when it comes to security and VPN features. The only real downside is that Asus’ routers are so configurable that some users might find the wealth of options to be somewhat intimidating. Netgear Netgear has been building routers for almost two decades, and it’s one of the leaders in adopting new Wi-Fi technologies. In fact, its Nighthawk RAX80 was one of the first Wi-Fi 6 802.11ax routers available, and it’s built on that early success with its RAX120 and RAX200 models. It also offers the top-rated Orbi mesh system that can blanket even the largest homes with strong Wi-Fi coverage. Netgear’s routers provide all of the security features you’d expect, with a more streamlined approach to setting them up. There’s not much here for tinkerers to play with, so those with networking experience might be a bit frustrated by the lack of options, but you don’t necessarily need to be able to fine-tune your security features for them to work well. TP-Link TP-Link is another company that’s been in the networking game for a long time, although it’s perhaps best known for its more affordable entry-level routers. However, it’s brought this expertise to bear in building some Wi-Fi 6 routers that offer great value for the price, and its new HomeCare security suite offers advanced security features and parental controls without saddling you with the recurring monthly fees charged by many other manufacturers. Linksys Almost twenty years ago, Linksys led the way in the world of open source routers with the launch of its venerable WRT54G, which is still seen by many networking enthusiasts as one of the legendary routers of its era. It’s an obsolete router nowadays, but Linksys has released newer versions that not only share the same open source principles, but even reflect the classic design, and for users who like to have a lot of options and customization, Linksys’ WRT3200ACM is hard to beat. Eero A relative newcomer, Eero has taken the internet by storm with its mesh Wi-FI system, which provides solid whole-home coverage in a set of routers that are incredibly easy to setup and configure, thanks to its reliance on full-featured smartphone apps rather than a web browser interface. The best part of Eero is that you won’t need to do anything to ensure that it’s configured for basic security—in fact it’s even one of the first systems to get on board with Apple’s HomeKit Router program—but for a small monthly fee you can also add Eero Secure to get powerful real-time content filtering and parental controls.
Conclusion
You no longer need to be a network expert to secure your home against internet threats, thanks to modern secure routers that do most of the heavy lifting for you. While there are still some great solutions for advanced users to dig in and adjust settings to their hearts’ content, this is no longer necessary with most secure routers, which can have you up and running with a well-defended network perimeter within minutes. Always keep in mind, however, that installing a secure router is no substitute for practicing good security habits, such as choosing strong passwords, using malware protection on your computers, and being careful about wandering into some of the more questionable corners of the internet. Still, while there are many facets to defending your home network, a good secure router can be one of the best tools in your arsenal by blocking as many threats as possible before they even get in the front door.
