Hybrid and remote work has permanently changed where business happens. It has also permanently changed the security threat landscape. Home networks, personal devices, public Wi-Fi, and the blurring of personal and professional activity create a security environment fundamentally different from a managed office.
Key takeaways
- 1Work laptop on a separate Wi-Fi SSID from personal devices (most modern routers support this)
- 2Work device fully managed and patched by IT team
- 3MFA active on all business accounts
- 4Business VPN for any use of public Wi-Fi
- 5No personal software installed on work devices
When the pandemic moved knowledge workers home in 2020, most businesses scrambled to make remote work functional with little time to make it secure. Four years later, hybrid work is permanent — but many of the security compromises made in the scramble are still in place. Home networks that were meant to be temporary have become the primary working environment for a significant portion of the workforce.
The Home Network Problem
A managed office network has a firewall, controlled access points, network monitoring, and traffic filtering. A home network has a router provided by the ISP, configured with default settings, shared with family members and their personal devices, and receiving security attention approximately never. Home routers run outdated firmware. Home networks have smart TVs, IoT devices, gaming consoles, and family member computers — any of which could be compromised and used as a pivot point to attack connected work devices.
The specific risk: a family member's device on the same home network as a work laptop, infected with malware, may be able to reach network shares, intercept credentials, or capture traffic that includes business data. Network segmentation (a guest Wi-Fi SSID for personal devices, keeping work devices on a separate network segment) significantly reduces this risk.
Personal Device Risk
Many small businesses allow staff to use personal devices for work — accessing business email, Teams, SharePoint, and other systems from a personal laptop or phone. Personal devices are not managed by the business: they may be running outdated operating systems, have no endpoint security, have software from untrusted sources installed, and be shared with other family members.
Optimyze's recommended approach for BYOD (Bring Your Own Device) is Microsoft Intune App Protection Policies — which enforce security controls (PIN, encryption, remote wipe) on business data within managed apps (Outlook, Teams, OneDrive) on personal devices, without touching personal data or requiring full device management. This provides a meaningful baseline without the privacy concerns of full device management on personal hardware.
Public Wi-Fi Risk
Coffee shops, airports, hotel lobbies — any public Wi-Fi network is untrusted. Traffic on public Wi-Fi can be intercepted. A network called "Coffee Shop Free WiFi" may be a rogue access point set up by an attacker to capture credentials from business applications that don't enforce certificate pinning. For staff who regularly work from public locations, a business VPN or per-app VPN through Microsoft Intune is a necessary control.
The Home Worker Security Checklist
- Work laptop on a separate Wi-Fi SSID from personal devices (most modern routers support this)
- Work device fully managed and patched by IT team
- MFA active on all business accounts
- Business VPN for any use of public Wi-Fi
- No personal software installed on work devices
- Screen locked when leaving work area (even at home)
- Business applications on personal devices enrolled in Intune App Protection
- Home router firmware updated and admin password changed from default
Remote work didn't create new attack types — it widened the attack surface by moving work devices from managed environments to unmanaged ones. Bringing structure to home working environments closes that gap without requiring everyone to return to the office.
