Working Remotely? The Security Gaps to Close First

Working from home removes the security layers of an office network: the managed firewall, the IT team down the corridor and the locked server room. Laptops travel to kitchens, cafés and airports, family members share devices, and home routers are often running on factory settings. Most security incidents involving remote workers start with a small number of predictable gaps. Here they are, roughly in order of how often they cause problems, with the fix for each.

1. Phishing and impersonation

The risk: fake emails, texts and messages remain the most common way attackers get in. Remote workers are more exposed because they rely on email and chat to confirm requests and cannot simply walk over to a colleague's desk. Attackers impersonate managers, IT support or suppliers, often asking for urgent payments, gift cards, password resets or login codes. Increasingly, voice calls and even AI-generated voices are used to make requests sound genuine.

The fix: slow down on any message that is urgent, unexpected or asks for money or credentials. Check the sender's real address, and verify unusual requests through a different channel, such as calling a known number. Report suspicious messages to your IT or security team, even if you did not click. Reporting quickly helps protect colleagues who received the same message.

2. Weak or reused passwords

The risk: when one website is breached, attackers try the same email and password on many other services, a technique called credential stuffing. Reused passwords turn one breach into many.

The fix: use a password manager to create a long, unique password for every account. Turn on multi-factor authentication wherever possible, preferably with an authenticator app, security key or passkey rather than text messages. Never approve a login prompt you did not start, since attackers sometimes bombard users with requests hoping one will be accepted.

3. Unpatched devices and software

The risk: attackers exploit known vulnerabilities in operating systems, browsers and apps. Devices that miss updates stay vulnerable long after fixes are available.

The fix: turn on automatic updates and restart when prompted. Keep company-managed security software running. Uninstall apps and browser extensions you no longer use, as each one is a potential entry point.

4. Insecure home networks

The risk: home routers with default admin passwords, outdated firmware or weak Wi-Fi encryption can be compromised, and smart home gadgets on the same network may have their own weaknesses.

The fix: change the router's default admin password, use WPA3 or at least WPA2 encryption with a strong Wi-Fi password, and update the router's firmware or replace very old routers that no longer receive updates. Where the router supports it, put smart devices and guests on a separate network from work devices.

5. Public Wi-Fi

The risk: networks in cafés, hotels and airports may be poorly secured, and attackers can set up fake hotspots with convincing names.

The fix: use your company's VPN when working away from home, or use your phone's personal hotspot instead. Check the exact network name with staff, and avoid accessing sensitive systems on networks you cannot verify.

6. Shared and personal devices

The risk: family members using a work laptop, or work files stored on personal devices, can lead to accidental deletion, malware infections or data leaks outside company control.

The fix: keep work and personal use separate. Don't let others use your work device, and follow your employer's policies on personal devices. Lock your screen whenever you step away, even at home.

7. Unapproved apps and file sharing

The risk: using personal email, free file-sharing services or unapproved AI tools to move or process work documents can expose confidential information and breach data protection rules.

The fix: stick to the tools your organization provides. If they don't meet your needs, ask IT rather than finding a workaround. Be careful about pasting confidential information into online tools whose data handling you don't know.

8. Physical security

The risk: laptops left in cars, screens visible to strangers on trains and printed documents in household recycling all create exposure.

The fix: make sure full-disk encryption is turned on, never leave devices unattended in public or visible in vehicles, use a privacy screen when working in public, and shred sensitive paperwork. Report lost or stolen devices to your employer immediately so access can be cut off.

9. Video call privacy

The risk: uninvited guests joining meetings, or confidential information visible in the background or on a shared screen.

The fix: use meeting passcodes and waiting rooms for sensitive calls, close unrelated windows and notifications before sharing your screen, and check what is visible behind you.

A quick weekly check

• Are updates installed and the device restarted?
• Is multi-factor authentication turned on for every work account?
• Are work files saved only in approved locations?
• Have any suspicious messages been reported?

Most of these steps take minutes to put in place, and together they close the gaps attackers rely on most.