Do we need a real firewall, or is the router from our internet provider enough?

The equipment your internet provider supplies is built to get you online cheaply. It is not built to protect a business, and it is worth being clear about what it does not do.

It generally cannot inspect traffic for threats, filter web content, separate your guest or camera network from everything else, give you usable logs when something goes wrong, or support remote access securely. It is also managed by your provider rather than by you, which means you often cannot change what you need to change.

Where the provider's router is genuinely fine: a very small office, everything in the cloud, no servers, no sensitive data, no compliance obligations, and nobody working remotely.

Where it is not: you take card payments, you hold health or financial records, you have staff connecting from outside, you have cameras or a server, or your cyber insurance application asks what firewall you run. That last one catches people, because answering it inaccurately can affect a claim.