How to Secure Your Laptop | Update First, Then Encrypt

A secure laptop runs a supported operating system, installs its updates automatically, uses full-disk encryption, and keeps a tested backup.

Losing a laptop is a hardware problem. Losing what’s on it — tax returns, saved passwords, client files — is a different category of bad day, and how to secure your laptop decides which one you get. Roughly twenty minutes of setup covers most of the risk, and order matters more than the tool list.

Windows 11, macOS, and ChromeOS all ship with every control below, so the built-in protection holds up unless an employer hands you a corporate product to run instead. Nobody needs to buy antivirus to reach the baseline.

Securing Your Laptop: Where Each Setting Lives

Every control on this list ships free with the operating system; turning each one on takes longer to find than to enable.

Device encryption covers most consumer machines; full BitLocker appears only on editions and hardware that support it, so look under Settings > Privacy & security before assuming it’s there. Biometric sign-in needs a compatible fingerprint reader or infrared camera, and the fallback PIN still has to be a strong one. Anyone shopping rather than fixing will find which models clear those hardware requirements in this roundup of laptops tested for security work.

Check where a machine stands under Settings > About ChromeOS > Additional details > Update schedule; a “Final software update” line means ChromeOS and browser patches have stopped arriving, and that laptop should be retired. ChromeOS also verifies its own startup files and rolls back to a known-good state if tampering shows up.

macOS renames the same controls. FileVault encrypts the startup disk, Find My Mac locates or remotely erases a lost machine, and the firewall sits under System Settings > Network. Lockdown Mode exists for the small group facing sophisticated targeted attacks; it restricts features and does not replace updates, encryption, or care about phishing.

Which Two Steps Do Most People Skip?

Saving the encryption recovery key and test-restoring a backup are the two steps that decide whether encryption and backups ever rescue you.

Store it somewhere other than the laptop — a password manager entry, or a printed copy in a drawer — and never delete it just to silence the prompt.

A backup that has never been restored is a hope rather than a safeguard. Keep one copy on a drive that stays offline so ransomware can’t reach it, then pull a folder back once and open the files to confirm they arrive readable.

Everyday Habits That Matter More Than Antivirus

Most malware arrives through the person rather than the operating system, so software sources, network choice, and physical care do as much work as any setting.

• Install programs from official stores or the developer’s own site, check the publisher name, and uninstall what you stopped using. Pirated installers and stray browser extensions remain the usual delivery vehicle.
• Treat public Wi-Fi as hostile. Cellular tethering or a VPN from an employer or reputable provider beats hotel Wi-Fi, and HTTPS on one site does not make the network itself trustworthy.
• Do daily work from a standard user account, leave the built-in firewall and anti-malware running, and don’t click past a warning about an unsigned installer.
• Keep the machine out of sight in a parked car, use a cable lock at a shared desk, and set the screen to lock after a few idle minutes.

Work through the setup in this order:

1. Install every pending update, then leave automatic updates on.
2. Turn on Windows Hello, Touch ID, or a long password, and add multifactor authentication to email and cloud storage.
3. Enable Device encryption, BitLocker, or FileVault.
4. Save the recovery key somewhere off the machine.
5. Restore one folder from the offline backup.
6. Move daily work to a standard account, keeping administrator rights for installs.