Do I really need antivirus? I only use my computer for business and never visit sketchy websites.

The mental model behind this question is that infections come from visiting bad neighborhoods on the internet, so good behavior equals safety. That model is about fifteen years out of date. Today the most common attack paths come to you: a convincing email with a malicious attachment or link (invoices and shipping notices are favorites), a legitimate website you visit every week that got compromised, poisoned search results and ads for ordinary software, and credential attacks that never involve a website at all. Being sensible helps; it just no longer covers the actual threat surface.

Using the computer 'just for business' makes it more attractive, not less. Business machines touch bank accounts, payroll, customer records, and email that can authorize payments. Attackers automate their targeting and specifically favor small businesses because the money is real and the defenses are usually thin. Nobody is deciding whether your machine is worth attacking; software is scanning and phishing everyone, always.

What a business machine needs is more than the old antivirus anyway: modern endpoint detection and response (EDR) watches for malicious behavior rather than just known virus signatures, catches the newer attack styles, and lets a responder isolate an infected machine before a problem becomes an incident. Paired with email filtering and MFA, it is standard equipment for any machine that touches business money or data. It runs silently; you will forget it exists until the day it earns its keep.