Cybersecurity for remote and hybrid teams: eight practices that matter

When the office is a kitchen table, the security perimeter moves with it. Company data now passes over home routers, personal phones and cafe Wi-Fi, and the person who would have noticed a strange email may be in another city. Attackers have noticed too, and phishing and credential theft aimed at remote staff are routine.

None of this means remote work is unsafe. It means security has to be designed around people and devices, not around a building. These are eight practices that matter most.

1. Keep training current

Threats change, and last year’s advice may be out of date. Fluent, personalised phishing messages, voice cloning and fake video calls are now cheap for attackers. Brief, regular sessions that show real examples work better than an annual module. Cover phishing, fake invoices and payment-change requests, ransomware and the social engineering of help desks. Agree a simple rule: any change to bank details or any urgent payment request is confirmed by calling a number you already hold.

2. Use strong sign-in and multi-factor authentication

Require multi-factor authentication on email, cloud services, VPN, finance and admin accounts. Prefer app-based prompts or security keys to text messages where possible, and passkeys where supported. Give everyone a password manager, ask for long, unique passphrases and check them against known breached passwords. Current NIST guidance advises against forcing routine password changes, and recommends changing them when there is a reason to think they’ve been exposed.

3. Manage the devices

A device you can’t see is a device you can’t protect.

• Prefer company-managed laptops and phones that can be encrypted, updated and wiped remotely.
• Require disk encryption and a screen lock on every device that touches company data.
• Run endpoint protection and keep it up to date.
• If personal devices are allowed, set minimum rules and keep company data in managed apps that can be removed separately.
• Know what to do when a device is lost: who to tell, and how it gets locked or wiped.

4. Secure access to company systems

Where staff reach company systems from untrusted networks, use a VPN or, better, a secure access service that checks the person, the device and the request each time. Give each person access to only what their role needs, and review it when roles change. Verify identity properly when staff contact the help desk, since impersonating an employee to reset a password is a classic attack.

5. Use a trusted home network

Staff shouldn’t use open public Wi-Fi for work without protection. A home network is safer if the router is set up properly:

• change the default admin password
• use WPA3 or, at minimum, WPA2 with a long passphrase
• keep the router’s firmware updated and turn off remote management
• put guests and smart-home devices on a separate network

Offer a short guide, or a stipend for equipment, rather than expecting everyone to work this out alone.

6. Use business-grade cloud tools

Mainstream cloud suites such as Microsoft 365 and Google Workspace invest heavily in security, and make it easy to work from anywhere with proper sign-in. Using them, rather than files emailed between personal accounts, keeps company data in one controlled place with an audit trail. Check the security settings, because the defaults aren’t always the strictest.

7. Keep everything updated

Software flaws are found constantly. Push updates to company devices automatically, set deadlines for critical patches and check that updates are actually installed. Include home routers and the apps that staff install themselves.

8. Draw clear lines between work and personal use

Work on work devices, and personal browsing and shopping on personal ones, where you can. It reduces the chance that a fake shop or a compromised site reaches company data. Also remind people about the less obvious leaks: sensitive documents visible behind them on a video call, screen sharing the wrong window, printing at home and discussing confidential matters where others can hear. Set rules for using AI tools, and make clear that company or customer data doesn’t go into services you haven’t approved.

A one-page remote work policy

A short document that people can read in five minutes is more effective than a long one. Cover:

• which devices can be used and how they must be set up
• how to sign in, and the need for multi-factor authentication
• where company data may be stored and shared
• what to do if a device is lost or something looks suspicious, and who to tell
• rules for public networks, video calls, printing and AI tools
• who to contact for help

Review it every six months, and after any incident.

Where to go next

Remote security rests on the same foundations as any other security work, applied to a wider perimeter. Our guides to basic cybersecurity practices, common threats and running a phishing simulation will help you build on them. If you’d like help writing a policy or reviewing how your team works remotely, you can talk to us.