All but a small number of the items in NVT OSArmor are checked. These are mostly where there is a slightly more aggressive version of a setting available. I don't mind going to the trouble of making exclusions for portables on flash drives, etc. All script engines are blocked with OSArmor. Part of the price of operating safely. BIOS is updated so PC is protected from Meltdown and Spectre. Considering hardening KSC security, but it seems strict in the first place.
Periodic malware scanners
Emsisoft Emergency Kit portable
Malware sample testing
I do not participate in malware testing
Browser(s) and extensions
Internet Explorer 11 with SmartScreen
Google Chrome: HTTPS Everywhere, Netcraft Anti-pfishing, uBlock with 10 custom hosts links, uBlock Extra, Privacy Badger, The Great Suspender (suspend unused tabs)
Maintenance tools
Wise Cleaner Free (run cleaner once a day), RegOrganizer, EraserDrop (secure delete all files), CCleaner (Wipe free space monthly), Startup Sentinel (Manage startups), Comodo Programs Manager (uninstall programs and leftovers). I use them to maintain privacy, so they are the same. Also, Autoruns, System Explorer, and TreeSizeFree
File and Photo backup
File syncing via FreeFileSync to a flash drive on every boot when the flash drive is attached.
System recovery
Paragon Backup and Restore 10 (2012). Rock solid for me acquired via giveaway, thanks Paragon...
Risk factors
Logging into my bank account
Browsing to popular websites
Downloading software and files from reputable sites
Working from home
Streaming audio/video content from trusted sites or paid subscriptions
Computer specs
HP 8460p
Intel i5-2500
8 GB RAM
Samsung 120 GB SSD
Standard graphics