Blog · By · 12 Sept 2026 · 5 min read

Securing a Remote Team: Laptops, Wi-Fi, Accounts and the Boring Stuff That Works

A distributed team has no office firewall to hide behind — every laptop is the perimeter. The short list of controls that protect a remote company without turning it into a fortress nobody wants to work in.

Securing a Remote Team: Laptops, Wi-Fi, Accounts and the Boring Stuff That Works — cover

When a company had an office, security had a shape: a building, a network, a firewall at the edge. Remote teams have none of that. The "perimeter" is fourteen laptops on fourteen home networks, a few personal phones with work email, and a handful of cloud accounts that hold everything. That is not worse — it is often better, because the cloud tools are more secure than the old server room ever was — but it means the controls move to the device and the account.

Here is what actually works for a remote team of five to a hundred people, in order of impact.

1. Identity is the new perimeter

If your team signs in to everything through one identity provider — Google Workspace, Microsoft 365, Okta — then securing that one account secures most of the company.

  • Two-factor authentication for everyone, enforced, not optional. Prefer passkeys or hardware keys for admins and finance; authenticator apps for everyone else; SMS only as a last resort.
  • Single sign-on for every tool that supports it. One login to revoke when someone leaves, one audit log to read, one place to enforce policy.
  • Admin roles for the few. Two or three global administrators, each with a hardware key, each with a separate everyday account for ordinary work.
  • Offboarding in one step. Suspending the identity account should cut access to everything. Test it with a leaver; whatever they can still open is a tool that needs moving behind SSO.

2. The laptop is the perimeter

Whether the company buys the laptops or people use their own, the baseline is the same:

  • Full-disk encryption on (FileVault, BitLocker). A lost laptop is then a hardware loss, not a data breach.
  • Automatic updates on, for the operating system and the browser. Most real-world compromises of a laptop exploit a patch that was available.
  • Screen lock after a few minutes, with a password or biometric to unlock.
  • A standard user account for daily work, not an administrator account.
  • Endpoint protection running — the built-in options (Microsoft Defender, macOS's protections) are good; a managed product adds central visibility.

If the company owns the devices, a mobile device management (MDM) tool enforces all of the above from one screen and can wipe a lost machine. For a small team on personal devices, a written baseline plus a quarterly "show me your settings" check is a realistic substitute.

3. Home Wi-Fi and coffee shops

The good news: with everything over HTTPS, the network matters far less than it did. The realistic risks are a home router with a default password and an out-of-date firmware, and captive portals on public Wi-Fi.

  • Ask people to change the router admin password and turn on automatic firmware updates. That is the whole home-network policy.
  • A company VPN is useful if you have internal systems that should not be on the public internet; it is not a substitute for the device and identity controls above. If you deploy one, use a modern protocol (WireGuard-based) and make it low-friction or people will turn it off.
  • Phones as hotspots are fine and often safer than public Wi-Fi.

4. Phones with work email

Work email on a personal phone is normal and, with a few conditions, acceptable:

  • The phone has a PIN or biometric lock and is running a supported OS version.
  • Work data lives in apps that can be remotely wiped independently of personal data — the mail and chat apps from your identity provider support this.
  • Messaging about customers or credentials happens in the company's tools, not in personal WhatsApp groups. Personal chat apps are the least controlled channel a company has and the one attackers increasingly target.

5. Shared files and "who can see this?"

Cloud storage makes sharing easy, which is exactly the problem. Two rules:

  • Default to "specific people", not "anyone with the link". Set that as the organisation default in the admin console; most platforms allow it.
  • Quarterly, run the sharing report. Every platform can list files shared publicly or outside the domain. Read it, and unshare what should not be.

Customer data in particular lives in the system built for it — the CRM, the support desk — not in a spreadsheet in someone's personal drive.

6. Passwords and secrets

A company password manager is non-negotiable for a remote team; it is how shared credentials are shared without being pasted into chat. Combined with SSO, the number of passwords anyone has to manage drops to a handful. If you have not rolled one out, that is the first afternoon to spend.

7. Phishing is the remote attack

With no colleague at the next desk to ask "did you send this?", remote workers are more exposed to impersonation — of the CEO, of IT, of a vendor. Two practical defences:

  • A verification rule for anything involving money or credentials: confirm by voice or video, on a number or channel you already had.
  • A culture where reporting is fast and blameless. A "this looks odd" message in a security channel, answered within minutes, is worth more than any training video.

8. Meetings, screens and recordings

Small things that leak: screen-sharing with a password manager or a customer list open in another window; meeting links posted publicly; recordings stored in a shared drive with wide permissions. Use waiting rooms for external meetings, share a window rather than a whole screen, and treat recordings as documents with the same sharing rules.

9. Write it down, one page

A remote team cannot absorb security by osmosis. One page, in the onboarding pack:

  • Your identity account, two-factor, and how to get help.
  • Laptop baseline (encryption, updates, lock, standard user).
  • Where files go, and the sharing default.
  • The verification rule for money and credentials.
  • How to report something suspicious and what happens next.

10. Check, gently, every quarter

Fifteen minutes with the identity console: who has admin, who has not signed in for ninety days, which apps have OAuth access, what is shared publicly. Fifteen minutes with the device list: encryption on, updates current. Not a surveillance programme — a maintenance routine, like backups.

A remote company done this way is often more secure than the office it replaced, because everything important is behind one well-defended identity and the laptops are treated as what they are: the edge of the company, sitting on a kitchen table.