Most Utah business owners believe two things about their network. The router has a firewall, and that means the business is protected. Both are technically true. Together they create a false sense of coverage. We hear the same sentence in security conversations across the state: we have a router with a firewall built in, so we’re fine. That belief is partially right and mostly wrong, and this article maps out exactly where it runs out.
Key Takeaways
- Consumer routers and ISP gateways do include a firewall. It runs NAT and stateful packet inspection (SPI), which block opportunistic inbound attacks and very little else.
- The attacks actually reaching Utah businesses in 2026, including ransomware delivered over encrypted HTTPS, command-and-control traffic, and IoT lateral movement, pass through SPI-based hardware uninspected.
- A managed firewall adds deep packet inspection, SSL/TLS inspection, intrusion prevention, DNS filtering, and VLAN segmentation, with 24/7 monitoring by people whose job is to respond.
- The “free” ISP gateway isn’t free over 36 months. No patching, no monitoring, and no incident response means the full cost of anything that gets through lands on your business.
- Some businesses really are fine with a consumer router. If you have employees sharing a network, client data, IoT devices, or compliance obligations, you aren’t one of them.
Here’s the part your router’s spec sheet gets right. It does run a firewall. NAT and SPI block a real category of opportunistic inbound attacks aimed at your public IP address. What your router doesn’t have is visibility into encrypted traffic, intrusion prevention, application-layer filtering, or anyone watching it. Those are the capabilities it takes to catch the attacks that actually target Utah businesses today, and they’re the difference between a router and a managed firewall.
What a Consumer Router Actually Does (and Where It Stops)
Credit where it’s due: the equipment you already have is doing real work.
Every consumer router and ISP gateway runs Network Address Translation (NAT). Your internal devices get private IP addresses, the router presents one public address to the internet, and inbound traffic nobody requested gets dropped. That blocks a real category of attack: opportunistic port scanners sweeping the internet for open services. It does nothing about traffic your users invite in by clicking a link, opening an attachment, or visiting a compromised website. If you want the fundamentals in more depth, our guide to what a firewall does covers them.
Most routers also run stateful packet inspection (SPI). The router tracks active connections and rejects packets that don’t belong to a known session. This is the firewall your router’s packaging advertises. It catches malformed packets and connection-state attacks. What it never does is read the content of the packets it passes. SPI checks whether traffic belongs to a valid session, not whether that session is carrying ransomware.
Here’s what NAT and SPI don’t give you:
- Deep packet inspection (DPI), which reads packet content instead of just session state
- SSL/TLS inspection, which decrypts and inspects encrypted HTTPS traffic
- Intrusion prevention (IPS/IDS), which matches traffic against known attack signatures
- Application-layer filtering, which identifies and controls specific apps and protocols
- DNS filtering, which blocks known malicious domains before a connection is ever made
- Behavioral monitoring, which flags a device inside your network acting like a compromised host
None of this ships on a TP-Link Archer, a Netgear Nighthawk, or the gateway your ISP technician left behind and called all set.
One honest exception before we go further. A solo operator with no employees, no client data stored on the network, no remote access, and no compliance requirements may be adequately covered by a consumer router. That’s a real category of business. It’s just not most of the Utah businesses reading this.
Where Consumer Routers Fall Short for Utah Businesses
The gap between SPI and a managed firewall stops being abstract the moment you put it inside a real office. Here are four scenarios we see across Utah, and they’re the categories of event our monitoring exists to catch.
Ransomware over encrypted traffic. Most ransomware in 2026 arrives over HTTPS: a link in an email, a drive-by download from a compromised legitimate site, a malicious ad. A consumer router sees an encrypted connection and passes it through, because it has no way to look inside. When a paralegal at a Murray law firm clicks a link in an email spoofed to look like it came from a client, that’s a ransomware event on a consumer router. On a managed firewall, SSL/TLS inspection decrypts the traffic, inspects it, and drops the payload before it reaches her machine. We’ve written a full breakdown on protecting your business from ransomware if you want the mechanics.
Command-and-control traffic. After an initial infection, malware phones home to a command-and-control (C2) server to receive instructions. Consumer routers don’t inspect outbound traffic, so a compromised workstation at a Provo manufacturing company can talk to an attacker for three weeks without generating a single alert. On a managed firewall, DNS filtering blocks the C2 domain before the connection is established, and behavioral monitoring flags the outbound pattern even when the domain is too new to be on anyone’s blocklist.
IoT devices on a flat network. Walk through an Ogden dental office and count the connected devices: X-ray machines, a digital sign, a smart thermostat, a VoIP system, staff laptops. On an ISP gateway they all share one network segment. When the thermostat is compromised (and IoT devices are compromised routinely, since most ship with default credentials and rarely see firmware updates), it has a direct route to the practice management server and patient records. A managed firewall puts each device class on its own VLAN with controlled access between segments. Consumer routers don’t support this in any meaningful way. Securing IoT devices is worth its own read if your office is filling up with smart hardware.
Stale remote access. Plenty of Utah businesses set up remote desktop, VPN tunnels, or port forwarding for remote staff and never revisit the rules. Picture a Salt Lake City accounting firm with RDP open on port 3389 for a bookkeeper who left 18 months ago. Nobody has reviewed the rules since, because consumer routers have no policy lifecycle. A port opened in 2022 stays open until someone remembers it exists. A managed firewall comes with defined access policies, scheduled policy reviews, and logs that show who accessed what and when.
Attack Scenarios – Consumer Router vs. Managed Firewall
| Attack Type | Why a Consumer Router Misses It | Utah Business Example | What Catches It |
|---|---|---|---|
| Ransomware via encrypted HTTPS | Consumer routers pass HTTPS traffic without inspection. They can’t see inside the encrypted payload. | A Murray law firm paralegal clicks a link in a spoofed client email. Ransomware downloads over HTTPS and encrypts the file server overnight. | SSL/TLS inspection on a managed firewall decrypts, inspects, and drops the payload before it reaches the endpoint. |
| Command-and-control (C2) outbound traffic | Consumer routers don’t inspect or log outbound traffic for C2 patterns. An infected device communicates freely. | A Provo manufacturing company has a compromised workstation phoning home to a C2 server for three weeks. The consumer router logs nothing. | DNS filtering blocks the C2 domain. Behavioral monitoring flags the outbound traffic pattern even if the domain is new. |
| IoT lateral movement | A flat network means all devices share the same segment. A compromised IoT device has direct access to everything else. | Ogden dental office: a compromised smart thermostat has network access to the practice management server and patient records. | VLAN segmentation on a managed firewall puts IoT devices on an isolated segment with no direct route to clinical systems. |
| Stale remote access exposure | Consumer routers have no policy lifecycle. Open ports and VPN rules stay open indefinitely after the reason for them changes. | A Salt Lake City accounting firm has RDP open on port 3389 for a bookkeeper who left 18 months ago. No one has reviewed the rules since. | A managed firewall with a policy review cadence and defined access lifecycles built into the service agreement. |
| Drive-by download from a compromised legitimate site | No DNS filtering or web category controls. Legitimate-looking sites serving malicious content pass through. | A Draper construction company employee visits a supplier’s website that’s been compromised. A malicious script downloads silently. | DNS filtering blocks the malicious domain. Application-layer filtering catches the download attempt before execution. |
| Credential stuffing against VoIP or cloud services | No application-layer visibility into authentication traffic. Failed login floods go undetected. | An Orem property management company’s VoIP system is hit with credential stuffing over a weekend: $4,200 in fraudulent international calls before Monday morning. | Application-layer filtering with rate limiting and behavioral detection on authentication traffic. |
The attack types most likely to reach a Utah business network through a consumer router or ISP gateway, and what stops them.
What a Managed Firewall Actually Includes
Our Managed Firewall service closes these gaps specifically. The service runs on enterprise-grade Fortinet FortiGate hardware with deep packet inspection, IPS/IDS, SSL inspection, and application-layer filtering. Around the hardware sit the pieces that consumer gear never gets: DNS filtering against known malicious domains, network segmentation by device class or department, centralized policy management across all of your Utah locations, 24/7 monitoring with proactive threat response, a defined firmware patch schedule, and detailed logging for compliance and incident response.
The hardware matters less than the management behind it. You could buy a FortiGate and run it yourself, and with a capable network engineer on staff that’s a defensible setup. The firmware still needs patching. Policies still need reviewing as the business changes. Logs still need someone reading them, and alerts still need someone answering. If you have IT staff and you’re weighing that option, we’ve covered why your IT team shouldn’t be managing network security alone. The managed service is what turns good hardware into a working security layer: we design the deployment, configure the policies, watch the network around the clock, and respond when something trips.
Two things worth knowing alongside the technical detail. The firewall covers the network perimeter while Managed Email Security covers the inbox, and the two work as complementary layers of the same defense. And if you’re an existing 1Wire customer, Managed Firewall currently comes with two months free. If you’d rather see the case framed by outcome instead of capability, we’ve also laid out five reasons businesses choose firewall managed services.
The Real Cost Comparison Over 36 Months
A consumer router looks free. The ISP supplied it, or it cost a few hundred dollars once. Over 36 months, the real picture includes costs the spec sheet never mentions.
Consumer router or ISP gateway: hardware runs $0 to $500. There’s no management fee, which means the management time falls on whoever handles it internally, often the owner’s weekend. Firmware updates are manual and usually deferred. Nobody monitors the logs. Nobody responds to incidents. When something gets through, the recovery cost, the downtime, and any compliance penalty land entirely on the business. Utah’s average small business data breach cost $108,000 in 2024, per the FBI IC3 figures in our Utah cyber threat outlook. That number never shows up in a router’s cost of ownership until the day it does.
A managed firewall over the same 36 months: hardware included in the service. Management, monitoring, patching, and policy reviews included. Incident response included. One predictable monthly cost, no capital outlay.
Consumer Router vs. Managed Firewall – Capability Comparison
| Capability | ISP Gateway | Consumer Router (Netgear / Asus / TP-Link) | 1Wire Managed Firewall (FortiGate) |
|---|---|---|---|
| NAT (hides internal IPs from the internet) | Yes | Yes | Yes |
| Stateful packet inspection (SPI) | Basic | Yes | Yes, enterprise-grade |
| Deep packet inspection (DPI) | No | No | Yes |
| SSL/TLS inspection (encrypted traffic) | No | No | Yes |
| Intrusion prevention system (IPS/IDS) | No | No | Yes |
| Application-layer filtering | No | No | Yes |
| DNS filtering (blocks malicious domains) | No | No | Yes |
| VLAN segmentation (staff / IoT / guest) | No | Limited / manual | Yes, managed and maintained |
| Behavioral anomaly detection | No | No | Yes |
| 24/7 managed monitoring | No | No | Yes |
| Defined firmware patch schedule | No (ISP-controlled, often delayed) | Manual, often deferred | Yes, managed by 1Wire |
| Centralized policy management (multi-site) | No | No | Yes, single console across all Utah locations |
| Compliance logging (HIPAA / PCI-DSS) | No | No | Yes |
| Incident response (when something trips) | No | No | Yes, 1Wire responds |
| Upfront cost | $0 (ISP-supplied) | $150–$500 | $0 upfront, hardware included in managed service |
Network security capabilities by device type. Most Utah SMBs run a consumer router or ISP gateway as their primary network perimeter. This is what that covers and what it doesn’t.
For a deeper look at the numbers, our article on whether the cost of firewalls is worth it walks through the same comparison from a small business budget perspective.
When a Consumer Router Is Actually Fine
We’d rather be straight with you than sell you hardware you don’t need. If you run a single-operator business with no employees on the network, no client data stored locally, no remote access, no IoT devices, and no compliance obligations, a consumer router probably covers you. Your attack surface is small, the data at risk is limited, and the math doesn’t clearly favor a managed firewall. If that’s your situation, this article has done its job and you can close the tab with a clear conscience.
The picture changes when more than five employees share a network, when you store medical, legal, financial, or personal client data, when you run IoT or smart building technology, when you use VoIP, when remote workers access the network, or when you operate under HIPAA, PCI-DSS, or similar requirements. That describes the majority of Utah businesses in healthcare, legal, accounting, property management, and professional services. It’s the same line we draw between managed WiFi and self-managed hardware: doing it yourself is legitimate right up until the stakes and the complexity outgrow the equipment.
Find Out What Your Current Setup Actually Covers
If you’re running an ISP-supplied gateway or a consumer router, and your business carries employee data, client records, payment information, or any compliance obligation, a free network security review will show you exactly what your current setup covers and where it doesn’t. We review your network, identify the gaps, and can have a managed firewall deployed within one to two business days. It’s one piece of our broader managed IT solutions for Utah businesses.
Book your free network security review →
You can take a closer look at the full Managed Firewall service and its features.
Questions Utah Business Owners Ask Before Switching
Does my ISP router have a firewall?
Yes. It runs NAT and SPI, which block a category of opportunistic inbound attacks. It doesn’t run deep packet inspection, SSL inspection, intrusion prevention, application filtering, or DNS filtering. Whether that’s sufficient depends on what your network carries and who you’re responsible to for keeping it safe.
Can I run a business-grade firewall myself without a managed service?
Yes, with the right expertise. A FortiGate or Palo Alto unit self-managed by a competent network engineer is a legitimate setup. The managed service exists for businesses that don’t have that person on staff and don’t want to hire one.
Does 1Wire replace my existing router?
In most deployments, our managed firewall sits between your ISP connection and your internal network, replacing or supplementing the gateway. The exact configuration depends on your current setup, and we review it with you before deployment.
How quickly can a managed firewall be deployed?
Most Utah businesses are up and running within one to two business days. We handle configuration and installation.
