Some of our staff work from home. What does that mean for our security?

When work happens at kitchen tables, your security perimeter stops being your office walls. The specific new risks: home networks with default router passwords and unpatched consumer gear; personal computers (shared with kids and their downloads) touching business email and files; business data flowing to personal cloud accounts because it is convenient; and the loss or theft of devices that now live in cars and coffee shops. None of this is a reason to fight remote work; all of it is a reason to secure it deliberately instead of hoping.

The core principle: put the security on the device and the account, not the building. Company-managed laptops carry endpoint protection, encryption, patching, and remote-wipe wherever they go. MFA on email and business systems makes a phished password survivable regardless of where it was phished. Business data stays in business systems (your Microsoft 365 or Google environment) rather than migrating onto personal machines and drives; if personal-device use is unavoidable, it happens through controlled access rather than local copies. Add a written policy so expectations are explicit: what devices may touch business data, what belongs where, what to do when a laptop disappears.

Done this way, a remote worker is no riskier than an office worker, and the same controls improve your office security too, because the office worker's laptop also leaves the building. What does not work is the default many businesses drifted into during 2020 and never revisited: personal machines, no MFA, no visibility. If that describes your setup, it is the most common and most fixable security gap in the remote-work era.