A network attached storage device is a small computer that exists to hold files and serve them to everything else in the house. That description makes it sound simpler than the buying decision actually is, because the specifications that get advertised are largely not the ones that determine whether you will be happy with it in three years.
Two decisions dominate: how many bays, and how you back it up.
What changed in 2026
- Drive capacities rose and prices per terabyte fell. Larger drives made small-bay units more viable, though rebuild times after a failure grew correspondingly longer.
- NAS units became ransomware targets. Internet-exposed devices with weak credentials or unpatched software were attacked at scale, which made network configuration a first-order security decision.
- Container hosting became a standard use. Running applications on the NAS rather than just storing files pushed buyers toward better processors and more memory.
- Private network tunnels replaced port forwarding. Mesh networking tools made remote access straightforward without exposing anything publicly.
What to prioritize
| Specification |
Matters if |
Guidance |
| Bay count |
Always |
Buy more than you need; expansion is the whole point |
| Drive capacity |
Always |
Larger drives, fewer of them, is generally simpler |
| Processor |
You transcode video or run containers |
Otherwise almost irrelevant |
| Memory |
You run applications or use caching filesystems |
Upgradeable memory is worth prioritizing |
| Network ports |
You move very large files regularly |
Faster networking helps only if the rest of your network matches |
| Solid state cache slots |
Random-access workloads |
Little benefit for media streaming |
| Drive bays hot-swappable |
You want to replace without downtime |
Convenient rather than essential |
Bay count is the decision people most often regret. Filling every bay in a two-bay unit means the only expansion path is replacing both drives with larger ones and rebuilding — slow, risky, and wasteful. A four-bay unit half full leaves room to grow by simply adding a drive.
RAID is not backup
This is the single most important thing to understand and the most commonly misunderstood. A redundant array protects against a drive failing. It does absolutely nothing against accidental deletion, ransomware, filesystem corruption, fire, theft, or a power event that kills the whole unit. In every one of those cases, the redundancy faithfully replicates the problem.
Plan around three copies of anything you care about: the working copy, the NAS, and an off-site copy. Off-site can be a cloud backup service or a second drive kept elsewhere and rotated. The specific mechanism matters less than the copy not being in the same building.
Rebuild time deserves a thought at large drive capacities. When a drive fails in a redundant array and you replace it, the array rebuilds by reading every remaining drive completely — which takes a long time with large drives and stresses the surviving drives exactly when you can least afford another failure. Configurations tolerating two simultaneous failures are worth the extra drive for large arrays.
Security setup
Do not expose the management interface to the internet. Do not forward ports to it. NAS devices running slightly outdated firmware with reachable admin panels are actively scanned for and exploited, and the results are widely documented.
Use a private network tunnel for remote access instead. Modern mesh networking tools make this straightforward, and the device stays invisible to the public internet entirely. Keep firmware updated, disable services you do not use, and use a unique strong credential — ideally with a second factor. The broader household version of this review is in home network security audit.
Common mistakes
- Buying too few bays. The most common and most expensive regret.
- Treating RAID as backup. It is not, and the moment you learn this the hard way is expensive.
- Exposing it to the internet. These devices are a known target with a known attack pattern.
- Over-specifying the processor for file storage. Pure storage needs very little compute.
- Mixing drive sizes carelessly. Most array configurations use only the smallest drive's capacity from each member.
FAQ
How many drives do I need?
For a first build, four bays with two or three drives populated is a sensible starting shape — redundancy plus room to grow.
Should I use drives rated for NAS use?
Yes. They are specified for continuous operation and vibration in multi-drive enclosures, and the price difference is small relative to the data.
Can I build my own instead?
Absolutely, and it is cheaper and more flexible. It also means you are the support team. Prebuilt units trade money for a maintained software stack.
Do I still need cloud backup if I have a NAS?
Yes. The NAS is one copy in one building. Off-site is what protects against the events that take out the building.
Where to go next
For securing the network around it, read home network security audit. For the disaster-planning angle, home inventory for insurance.