Good security on a budget: what is worth paying for and what is not
The security industry sells a lot of products. A surprising amount of real protection costs nothing, and some of the things people pay for add very little. Here is an honest ranking.
Free, and worth more than anything you can buy
Automatic updates, everywhere. See the update guide. Nothing you can purchase compensates for an unpatched device.
Two-factor authentication on your email first. Email is the master key: whoever controls it can reset everything else. Turn it on there before anywhere else, then on banking and your phone account.
Prefer an authenticator app or a passkey over text-message codes. SMS codes are much better than nothing, but they can be intercepted by someone who takes over your phone number.
A password manager. Apple, Google, and Firefox all include one at no cost, and they are genuinely good. The point is not strength, it is uniqueness: one breached password should not open your other accounts.
A credit freeze. Free by law in the US at all three bureaus, Equifax, Experian, and TransUnion. It stops new accounts being opened in your name and you can lift it temporarily whenever you need credit. This does more than most paid identity-monitoring services, which mostly tell you after the fact.
The antivirus you already have. Microsoft Defender is included with Windows and is good. On iPhone and Android, third-party antivirus apps cannot do much, because the operating system does not let them.
Sometimes worth paying for
A hardware security key, around $25 to $60, if you are a plausible target or manage other people's money. It is the strongest protection against account takeover that exists.
A newer phone or router. Not exciting, but a device still receiving security updates is doing more for you than most subscriptions. Check how long your phone's manufacturer promises updates before you buy.
Paid password managers, if you need family sharing or support across mixed platforms. The free built-in ones are fine for most people.
Usually not worth it
Consumer VPNs, for security. They are useful for privacy from your internet provider and for geography. They do not stop scams, phishing, or malware, despite how they are advertised. Nearly all web traffic is already encrypted.
Dark web monitoring, sold on its own. It tells you that data already leaked. Assume it did, and freeze your credit instead. Free breach checks are available at Have I Been Pwned.
Registry cleaners, speed boosters, and driver updaters. At best useless. Some are the thing you needed protecting from.
Where we fit
We will not pretend Pocket Protect replaces any of the above. Do the free things first. They matter more.
What the free list does not solve is the moment itself: a message is in front of you right now, it looks real, and you do not want to ring your daughter about it. That gap is the one we are built for.
Last checked 2026-09-23. Prices, dates, and bank policies change; verify anything time-sensitive against the linked source.