The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Choose cybersecurity tools by starting with the research data and systems your organisation cannot afford to lose, then shortlist controls you can operate and test—not the longest list of features. For a small research organisation, the practical priorities are usually protecting important accounts, keeping devices and software supported, maintaining recoverable backups, and making sure someone can respond to useful alerts. The right mix depends on your data, workflows, existing systems, and capacity to manage the tools.
What should a small research organisation protect first?
Start by identifying the information and services whose loss, exposure, or alteration would disrupt research or create harm. CISA’s Cyber Essentials Toolkit 5, dated October 15, 2020, explicitly includes proprietary research among the kinds of data an organisation may need to protect to maintain operations. Research organisations may also handle participant information, unpublished findings, administrative records, or data held by collaborators; which of these apply depends on the organisation’s actual work.
Make a short inventory before comparing products. It is more useful to know which accounts and systems hold important data, who can reach them, and how they are restored than to begin with a catalogue of security features.
Map the data, systems, people, and access paths
- Data: List the important research and business information, where it is stored, who uses it, and whether it can be recreated if changed or lost.
- Systems: Record the services and devices that store, process, or provide access to that data: for example, email, file storage, research applications, laptops, servers, and network or remote-access systems.
- People and accounts: Identify ordinary staff accounts, administrator accounts, external collaborators, service accounts, and any accounts that can change security settings or access sensitive information.
- Access paths: Note how people connect—including remote access, shared links, mobile devices, and access granted through an outside IT provider.
This inventory does not have to be a formal database to be useful. A table with an owner, location, access group, criticality, and recovery method for each major data set or system gives you a basis for identifying gaps and asking vendors precise questions.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Rank confidentiality, integrity, and availability needs
For each item, decide whether the main concern is preventing disclosure, preventing unauthorised changes, restoring access after an outage, or some combination. A data set may need confidentiality because it contains sensitive information, integrity because altered results would undermine the work, and availability because the team needs it to continue an active project. This distinction helps avoid buying a tool that addresses one risk while leaving a more consequential one uncovered.
Record dependencies as well. A research file may be intact but unusable if its application, identity account, encryption key, or specialist device is unavailable. Include those dependencies when deciding what to protect and what a workable recovery would require.
How do you turn the inventory into a manageable shortlist?
Compare candidate controls against the same questions, not just their feature lists. A small team should favour controls that cover important risks and that named people can configure, review, and maintain consistently.
| Decision axis | Questions to ask | Evidence to request or verify |
|---|---|---|
| Risk coverage | Which important data, accounts, devices, cloud services, and remote access paths does this protect? What remains outside its scope? | A clear list of covered systems and exclusions, matched against your inventory. |
| Compatibility | Does it work with your identity provider, devices, operating systems, research workflows, and existing licences? | Documented requirements and a small pilot using representative accounts and devices. |
| Operational burden | Who configures it, reviews alerts, applies updates, and responds when it reports a problem? | A named internal owner, an agreed review process, and a realistic estimate of ongoing staff effort. |
| Recovery and evidence | Can you restore the research data or account it protects? Can you obtain records useful for investigating an incident? | A recovery test and a demonstration of how relevant logs or records can be retrieved. |
| Access and supplier risk | What privileges does the tool or provider receive? How are those privileges controlled, monitored, and removed? | Permission details, account oversight arrangements, security terms, and incident-notification commitments. |
| Cost and scale | Can the organisation sustain licensing and administration as people, devices, and systems change? | A complete estimate for the intended deployment and clarity on what administration it leaves to your team. |
There is no commercial price comparison in the CISA materials cited here, so costs must be checked with the relevant provider and against your own staffing and licensing situation. A low purchase price is not the same as a sustainable choice if the organisation cannot operate the control or respond to what it detects.
Use the shortlist to expose trade-offs. For example, if a tool protects only managed laptops, decide whether unmanaged personal devices are permitted to reach the same research data. If a service provider will administer it, include that provider’s access and notification arrangements in the decision rather than treating them as a separate concern.
Which baseline security controls should come before specialised tools?
Establish a few foundational practices before adding specialist products: use supported software and apply updates, protect important accounts with strong authentication, keep recoverable backups, and help staff recognise phishing attempts. CISA’s Small and Medium-Sized Business Resources identifies software updates as a foundational practice, while its Cyber Essentials material advises protecting backups and testing recovery.
Keep software supported and updated
Include operating systems and applications used for research, not only general office software. Unsupported or unpatched software can leave a control gap that a new security product may not address. Check which devices can receive updates, who is responsible for applying them, and what happens when an essential research application or instrument depends on software that cannot be updated promptly.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For systems where an update needs compatibility review, assign an owner and a process to assess and manage the exposure rather than letting the exception disappear from view. The applicable approach depends on the system and its use; the important selection question is whether your organisation can sustain the process around the tool.
Make phishing awareness part of the control plan
People may receive convincing requests to reveal credentials, approve a sign-in, or open a malicious file. Awareness is not a substitute for technical controls, but it belongs alongside them: staff should know how to report a suspicious message or unexpected authentication request and whom to contact when something seems wrong. CISA includes phishing awareness among its small-business resource topics.
How should you choose identity and multifactor authentication tools?
Prioritise identity controls for email, file storage, remote access, administrator accounts, and people who handle sensitive data. These accounts often provide a route to important systems, so verify that your identity service can enforce multifactor authentication (MFA) where it matters and that staff can use the chosen methods on their actual devices.
CISA’s Require Multifactor Authentication guidance identifies physical security keys as its strongest MFA option in the guidance reviewed. It describes a security key as a physical device that plugs in or taps a device and says the method provides the best protection against phishing and is easy to use. Treat that as CISA’s guidance on the method, not as a guarantee that every key will work with every account or device.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Test compatibility before choosing a method
Check whether the identity provider, operating systems, browsers, phones, and research workflows support the MFA methods you plan to require. If considering a FIDO2-compatible hardware security key, verify support with the relevant account provider and devices, including how staff will authenticate when travelling, using a replacement device, or working without their usual equipment. A method that is technically strong but cannot be used in a real workflow can lead to workarounds that weaken the intended protection.
Plan for enrolment and recovery at the same time. Determine who can add or replace a factor, how a locked-out user’s identity is checked, and how administrative access is recovered if the usual method is unavailable. Test those procedures with a small number of representative accounts before making a requirement organisation-wide.
Apply stronger attention to privileged accounts
Administrator accounts can change access, disable controls, or affect multiple systems. Identify them explicitly, limit their use to administrative tasks where your setup allows, and confirm that MFA applies to them. Also review service accounts and outside-provider accounts: these may not be used interactively like staff accounts, but they can still have consequential access that needs an owner and oversight.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What endpoint, logging, and monitoring capabilities are worth shortlisting?
Choose endpoint protection and monitoring capabilities based on the devices and systems in your inventory, and on whether the team can act on what they report. A tool that generates alerts without a clear reviewer, escalation route, or response plan may create noise instead of useful protection.
Free tools Windows power users keep installed
One-click scans. No signup required.
Match endpoint coverage to the actual device estate
List the operating systems and device types used for research and administration, including any equipment that cannot be managed in the same way as staff laptops. Ask which devices the proposed control covers, what it can detect or manage on each, and what remains uncovered. Verify the answers in a pilot: product names and feature claims alone do not establish that the control works with a particular operating system, research application, or device configuration.
Decide how exceptions will be recorded and handled. A specialised device may have a legitimate compatibility constraint; document its owner, access to research systems, and any alternative safeguards the organisation can actually maintain. Do not assume that an endpoint tool can protect devices it does not support or manage.
Set up logs so somebody can use them
CISA’s Use Logging on Business Systems guidance says small teams can use logs to establish normal system behaviour and identify unusual activity. It advises setting alerts for high-risk activity, centralising logs where feasible, protecting logs from tampering, and assigning incident-response responsibilities. CISA also points to its no-cost Logging Made Easy tool; whether it is suitable depends on your environment and ability to operate it.
Ask a monitoring provider or tool owner to show what a useful alert looks like, where supporting records are found, and how a reviewer determines whether it needs action. Decide which events matter to your organisation, who reviews them, and how the reviewer contacts the person responsible for investigating. Without those decisions, additional logging may produce records that nobody checks when they are most needed.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow can you tell whether backups will protect research continuity?
Backups are useful only if they contain the data you need and you can restore it in a form the organisation can use. CISA’s Cyber Essentials Toolkit recommends automated, protected backups and recovery testing, so include both the backup mechanism and a practical restore test when evaluating options.
Define what a successful restore means
For each priority data set or system, identify the copy that would be used for recovery, who can access it, and what else must be restored to resume the work. Consider whether the necessary application, accounts, configuration, and access credentials would also be available. The exact recovery requirements vary by project; a file copy alone may not prove that a research workflow can be brought back into operation.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Ask how backups are protected from unauthorised changes or deletion, including an incident that affects the systems where the original data lives. Offline copies may be appropriate for some organisations, but their suitability depends on how they are created, secured, and restored. Avoid assuming that a backup is isolated or protected simply because a provider calls it a backup.
Test recovery rather than relying on a status indicator
Run a controlled restore using representative research data and confirm that the responsible staff can access and use the result. Record what was restored, what dependencies were needed, and any problem that would delay the real recovery. The test should validate the path from the backup to usable work, not just that a job reported completion.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWho should respond when a tool raises an alert?
Before rollout, assign ownership for configuration, routine review, incident escalation, and recovery. Small organisations may distribute these duties across staff or use external support, but each responsibility still needs a named owner and a practical handoff.
Write down the first response to an alert: who receives it, how they decide whether it is credible, whom they contact, and who can take containment or recovery action. Include a route for reporting a suspected incident even when no security tool has raised an alert. CISA’s logging guidance calls for assigned incident-response responsibilities; a tool cannot make that assignment on the organisation’s behalf.
For a shortlist, ask the provider to demonstrate how alerts are delivered and what information is available to the person investigating them. Confirm what happens outside normal working hours if the service claims to monitor then, and identify which decisions remain the organisation’s responsibility. Do not infer a response commitment from a monitoring feature unless it is explicitly established.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should you check before giving an IT provider access?
Using outside IT or cybersecurity support can be relevant when internal capacity is limited, but it is not automatically safer or simpler. Evaluate the provider’s privileges, account oversight, monitoring, contract protections, and incident-notification commitments before granting access.
CISA’s Mitigations and Hardening Guidance for MSPs and Small- and Mid-sized Businesses covers least privilege, service-account oversight, contractual security controls, monitoring, and incident notification. Use these as due-diligence topics, not as a blanket recommendation to outsource.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
- Least privilege: Ask which systems and data the provider can reach, why each permission is needed, and how access is limited to the work it performs.
- Account oversight: Establish who owns provider and service accounts, how their use is reviewed, and how access is changed or removed when staff or responsibilities change.
- Monitoring and evidence: Find out what activity is logged, who can review it, and whether the organisation can obtain records needed to understand an event.
- Contract safeguards: Clarify security responsibilities and the provider’s commitments in writing, including how incidents are reported and what information is supplied.
- Operational handoff: Determine what the provider does during an alert or recovery and what decisions, approvals, or actions remain with your organisation.
These checks matter even if a provider will manage the security tool itself. Your organisation remains dependent on how access is granted, supervised, and handled when there is a problem.
How do you pilot a shortlist without disrupting research?
Use a small, representative pilot to test the most important assumptions before broader deployment. Include the kinds of accounts, devices, and workflows that are likely to expose compatibility problems, while keeping the pilot’s scope clear enough that staff know where new controls apply.
- Choose a limited scope: Select representative users and systems, including an account with administrative responsibilities and a workflow involving important research data.
- Check normal work: Confirm that sign-in, file access, research applications, collaboration, and any required remote access still work as intended.
- Exercise exceptions: Test a lost or unavailable authentication method, a supported-device limitation, and the route for requesting help.
- Review signals: Confirm that expected activity is visible in logs, that high-risk events can reach the assigned reviewer, and that the alert includes enough information to act.
- Test recovery: Restore representative data and verify its usability, along with the access and applications needed to work with it.
- Decide and document: Record what the control covers, what it misses, who will operate it, and any unresolved risk before expanding its use.
A pilot is not proof against every incident. Its value is in surfacing practical failures—unsupported devices, confusing recovery, unreviewed alerts, or permissions broader than expected—while the scope is still manageable.
Recommended Free Tools
When should you revisit the tools you chose?
Revisit the shortlist when the organisation’s research data, systems, people, funder terms, or risks change. A tool that fit a small team’s earlier setup may no longer cover a new research platform, collaborator access route, or data-handling obligation.
Keep the inventory and ownership notes current enough to make those changes visible. Review whether the chosen controls still cover critical data and accounts, whether someone is carrying out the operational duties, whether recovery tests remain useful, and whether provider access and incident arrangements still match the work being performed.
Legal, funder, participant-data, and contract obligations depend on jurisdiction and the organisation’s actual activities. The CISA guidance cited here does not determine those obligations for a particular organisation; obtain appropriate organisation-specific review rather than treating a security-tool choice as proof of compliance.
Frequently Asked Questions
What should we do if a research instrument cannot run supported software?
Document the instrument, its owner, the reason it cannot be updated, and the systems or data it can reach. Have the people responsible for the instrument and security agree on a workable way to manage the exposure; the right safeguards depend on the device and research workflow.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Can we rely on a provider to decide whether an alert is serious?
Only if the provider’s responsibilities and escalation commitments are clear and agreed. Decide in advance who in your organisation can authorise actions that affect research access, devices, or data.
Do security tools establish that our organisation meets funder or privacy requirements?
No tool choice by itself establishes compliance. Requirements depend on your jurisdiction, research activity, contracts, and funder terms, so assess those obligations for your organisation separately.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
