Securing Remote and Hybrid Teams

Decide what a trusted device is, enforce that decision at sign-in, and stop treating the office network as a security boundary. That is the whole of remote security for a small business, and a VPN is optional within it rather than central to it. The hard part is not technical. It is making the personal-laptop decision explicitly instead of letting it happen by accident.

The perimeter you were defending no longer exists

The old model was simple and it worked for a while: inside the office network you were trusted, outside it you were not, and the VPN existed to make outside look like inside. Hybrid work broke that model, and the data has caught up.

Verizon’s 2026 DBIR found that breaches involving a third party rose 60% year on year and now account for 48% of all breaches. Your staff authenticate to services you do not run, stored on infrastructure you do not own, from networks you have never seen. The report also found exploitation of software vulnerabilities overtook stolen credentials as the top initial access vector for the first time in 19 years, at 31% of breaches, and that unpatched edge devices were a distinguishing feature of 29% of ransomware victims. Those edge devices are, very often, the remote access kit.

There is a second shift that is easy to miss. The DBIR’s data on phishing simulations shows the median click rate on voice and text message campaigns running about 40% higher than on email. People check work messages on a phone while walking between things, and the care they apply at a desk does not travel.

What zero trust means in a thirty-person business

Zero trust has been sold badly, so it is worth going back to the definition. NIST’s SP 800-207 states that zero trust assumes no implicit trust is granted to assets or user accounts based solely on their physical or network location, or on who owns the asset. That is it. It is a design principle, not a product, and nothing in it requires a seven-figure programme.

CISA’s Zero Trust Maturity Model version 2 turns the principle into five pillars: identity, devices, networks, applications and workloads, and data. For a thirty-person business you will make real progress on the first two and partial progress on the rest, and that is a reasonable place to stop.

In practice, three decisions get you most of the way. Every application authenticates through one identity provider, so there is one place to enforce policy and one place to revoke. Access to the data that would hurt most requires a device you can see the state of. And nothing is trusted because of the network it came from, which means the office Wi-Fi gets the same scrutiny as a cafe.

Devices: the decision you have to make out loud

Most businesses have never actually decided whether personal laptops are allowed. What they have is a de facto policy, arrived at by nobody, in which personal devices are tolerated for some things and nobody is sure which. That ambiguity is the risk.

The UK Cyber Security Breaches Survey 2025/2026 found 66% of businesses only allow access via organisation-owned devices, and 61% apply security controls to those devices. Among micro businesses, the proportion restricting access to company-owned devices rose from 58% to 64% in a year, which suggests the smallest organisations are making this decision deliberately for the first time.

You have three honest options. Issue company devices to everyone, which is cleanest and costs the most. Allow personal devices but require enrolment in management for work access, which is cheaper and needs a frank conversation about what you can and cannot see on someone’s own laptop. Or allow personal devices with no management, and accept that work data is sitting somewhere you have no control over, which is a decision rather than an oversight only if you have written it down.

The middle option works well when scoped properly: application protection policies that govern company data inside company apps, without claiming the whole device. The UK NCSC’s device security guidance covers the platform-specific detail, and it is worth reading before you promise staff anything about privacy.

VPN, ZTNA or conditional access

A classic VPN authenticates you once and then puts you on the network, where you can reach a great deal more than you need. Zero trust network access flips that: each application is brokered individually, access is evaluated per request, and the device’s state is part of the decision. Conditional access, which you probably already own in Microsoft 365 or Google Workspace, does much of the same work at the identity layer.

Start with conditional access, because the licence is already paid for and the policies are quick. Require multi-factor authentication for everyone, with phishing-resistant methods on administrative and finance accounts. Block legacy authentication protocols that cannot honour policy. Require a compliant or managed device for the mail store and the finance system. Then look at what is left that still needs a tunnel, and you will usually find it is one file server and one accounting application.

Shadow AI became a data-loss channel in one year

This is the fastest-moving risk in the DBIR’s data and it arrived almost entirely in one year. Verizon found that frequent use of AI tools by employees surged from 15% to 45% of employees, and that shadow AI, meaning unapproved AI tools used at work, is now the third most common non-malicious data leakage activity.

For a remote team this matters more than for an office-based one, because there is no colleague glancing at the screen and the fastest route to finishing a task at 9pm is whichever tool is already open in a browser tab. Client data, draft contracts and source code get pasted into services whose terms nobody read.

Banning it does not work, as several large organisations have demonstrated at some expense. What works is providing an approved tool with a business agreement that does not train on your data, saying clearly which categories of information must never leave your systems, and checking your data loss prevention rules cover the browser as well as email. If you process personal data on behalf of clients, this intersects directly with your data protection obligations and the processor terms you have signed. Where the contracts are ambiguous, that is a question for a lawyer rather than for your IT provider.

Home networks, hotel Wi-Fi and the things you cannot control

Home networks are not your network and you should not try to manage them. What you can do is make them irrelevant. If every connection is authenticated and encrypted at the application layer, and access decisions depend on identity and device state rather than network location, then a badly configured home router is the householder’s problem rather than yours.

A short list of genuinely useful advice for staff: change the router’s default administrator password, keep its firmware updated, put smart devices on a guest network, and never use a public network for anything without full encryption. The NCSC’s home-working guidance is a good thing to send people because it is written for humans rather than for administrators.

Travel deserves its own two paragraphs in your policy. Devices get taken through borders, left in taxis and used on hotel networks with captive portals that look exactly like phishing pages. Disk encryption, a short lock timeout, remote wipe and a reporting number that works internationally cover most of it. For higher-risk destinations, consider a clean loan device rather than the laptop with everything on it.

What you stop seeing when devices are unmanaged

There is a line in the DBIR that deserves more attention than it got. Discussing the mobile phishing attempts it counted, Verizon notes those detections were only visible because the devices were managed, either corporate owned or enrolled in device management, and that employees using purely unmanaged personal devices for organisational work represents a risky gap in visibility.

That is the real cost of the unmanaged option, and it is not about control. It is that you cannot count what you cannot see. If half your team reads work mail on unenrolled phones, your phishing statistics describe the other half. The same applies to credential theft: the DBIR’s earlier work on personal devices found it was relatively common for employees to have corporate credentials saved on them, which is exactly what infostealer malware collects.

You do not need a large monitoring capability to close the gap. Sign-in logs from your identity provider, alerts on impossible travel and new MFA registrations, mail-rule change alerts, and device compliance reporting will tell you most of what matters. The UK survey found only 33% of businesses monitor user activity at all, so even a modest start puts you ahead. IBM’s 2026 report found organisations using AI and automation in security operations saved an average of USD 1.93 million per breach, against a global average breach cost of USD 4.99 million. The mechanism is simply time.

A rollout order that will not ruin anyone’s week

The order below front-loads the changes that remove risk without changing how anyone works, and leaves the disruptive ones until people have seen the benefit.

1. Week one: one front door. Get every business application behind your identity provider, with multi-factor authentication required. Note what will not federate.
2. Week two: the device decision. Write down which devices may access work data and what state they must be in. Circulate it, and mean it.
3. Week three: enrol and encrypt. Management enrolment, disk encryption, automatic updates and remote wipe on every device in scope.
4. Week four: conditional access. Require a compliant device for the mail store and the finance system. Block legacy authentication. Watch the logs for a week before tightening further.
5. Week five: the AI and data rules. Approve a tool, state what must not be pasted anywhere, and check your data loss prevention covers the browser.
6. Week six: rehearse. Walk through a lost-laptop scenario and a compromised-mailbox scenario with the people who would handle them.

Two things make this fail. Enforcing a device policy before the devices are enrolled, which locks people out on a Tuesday morning and costs you their goodwill for a year. And not writing down who decides when something breaks. Our guide to building a simple incident response plan covers the second, and the small-business checklist sets the baseline the rest of this sits on.

We design and run identity, device management and conditional access for distributed teams remotely, worldwide, as part of our cybersecurity services, including the device policy conversation nobody enjoys having. Get in touch with Eudora Technology to talk about your project.