WorkAuditor Blog

What are the biggest remote worker security risks right now? If you guessed "hackers attacking the VPN," you're wrong — and that's the problem. In my investigations, remote incidents almost always begin at the edge of the company's control: a personal device, a home router, a borrowed laptop. An accounting firm client's bookkeeper worked from home on her personal machine; when that machine was compromised, the attacker used her cached VPN session to browse client payroll files. Roughly 200 employees' tax records were exposed. The VPN did its job. Everything around it didn't. Here is the risk ranking I use with clients, and what to do about each one.

Remote worker security risks: the ranked list

1. Personal devices without management. BYOD machines that lack endpoint protection, encryption, and update enforcement are the single largest risk. Require managed, enrolled devices for any role that touches sensitive data — or at minimum MDM with remote wipe and disk encryption.
2. Home networks. The bookkeeper's compromise likely began on a home router with default credentials and no patching. Provide a company router for remote staff, or require VPN for every session and MFA for every app — never persistent "remember me" sessions.
3. Shadow IT. Remote workers adopt personal tools — cloud drives, messaging, note apps — because no sanctioned alternative is obvious. Publish the approved tool list and make onboarding include a fifteen-minute tour of it.
4. Shared and public Wi-Fi. Coffee-shop sessions leak credentials. Enforce VPN-by-default and consider session-level MFA on every sensitive app.
5. Device loss and theft. Remote laptops travel. Full-disk encryption and remote wipe are non-negotiable for every managed device.

Mitigation starts with the device policy

The single highest-return mitigation is device ownership and management. At one client, moving all finance and sales staff to managed, encrypted laptops with enforced updates cut reportable security events by 60 percent in two quarters. If your company can't manage the device, it can't manage the risk the device carries.

Identity controls are the second wall

Remote work multiplies logins, so identity hygiene matters more: MFA everywhere, SSO for every cloud app, and short session timeouts. The cached-session attack on the bookkeeper succeeded because the session never expired. Enforce session timeouts below the office norm — a 15-minute idle timeout is reasonable for remote access to sensitive systems.

Monitor remote file access without crossing into surveillance

The remote office is invisible by default, and that's where the risk hides. Monitor what your endpoints do — file access, uploads, application use — with clear policies about what monitoring covers and why. This is the line between security and surveillance: be transparent in the handbook, measure work output on outcomes, and keep monitoring focused on data movement rather than keystrokes. A client in professional services caught a remote contractor moving client files to a personal cloud account within a week of deployment because uploads to unknown destinations alerted automatically.

Make the home office part of the review

Add remote-work security to the quarterly review: devices still managed? VPN enforced? Personal cloud tools still in use? Remote workers drift toward convenience; the review pulls them back. One client found that 30 percent of remote staff had installed personal cloud clients on company laptops within a year of launch — fixed by a monthly scan and a one-click uninstall prompt.

Incident response when there's no office to walk across

Remote incidents demand a runbook, because nobody can walk to the desk. The sequence I use: isolate the device — disconnect from the network, don't wipe yet — preserve the logs, secure the account, then talk to the employee by video with a witness present. One client's bookkeeper incident was contained to the compromised device because the response steps were posted on the intranet and the IT lead executed them in order within the hour. A remote response runbook, tested once a year, is cheaper than the alternatives and faster than improvisation.

Write the remote-work policy down

The most common remote-work failure I see isn't technical; it's unspecified. "Use good security hygiene" means nothing at 11 p.m. on a kitchen table. Document: which devices are allowed, what happens on public Wi-Fi, how files are stored, and who to call when a device is lost. One client's remote policy was a single page and reduced their incident-answer time from days to hours, because everyone finally knew the answer.

When did you last verify what remote laptops are running right now — not what they should be running? For visibility into file and application activity on Windows and Mac machines across your remote workforce, WorkAuditor is cloud-based employee monitoring software that logs what your endpoints actually do. See how it helps at https://www.workauditor.com.