What should you do to stay secure when working from home?

Working from home has become routine for many organisations, but it also changes the security landscape. Home networks, personal devices and shared spaces rarely have the same protections as corporate offices.

Without a security-conscious approach, remote working can unintentionally expose organisations to cyber, physical and information security risks.

Fast checklist for working from home securely

• Secure your home Wi-Fi network
• Use strong, unique passwords and multi-factor authentication
• Keep all devices and software fully updated
• Use a VPN when working remotely or on public networks (e.g. in a cafe, or on a train)
• Stay alert to phishing and social engineering attempts
• Protect your physical workspace and documents
• Be mindful of who can see or hear your work

Why working from home changes the security risk

Remote working alters the threat landscape in subtle but important ways. Traditional office environments benefit from layered protections such as managed networks, physical access controls and on-site support. When employees work remotely, many of these controls are reduced, decentralised or removed.

This shift increases exposure to phishing, credential theft, unauthorised access and accidental data exposure. Understanding this context helps individuals appreciate why consistent security behaviours matter just as much at home as they do in the office.

Working from home: how to reduce security risk

Step 1: Secure your home network

Your home network is often the first line of defence, yet it is frequently overlooked.

Many home routers are installed with default usernames, passwords, and insecure settings that are widely known or easy to exploit. To reduce risk:

• Change all default router login credentials
• Use WPA3 encryption (or WPA2 if WPA3 is unavailable)
• Keep your router firmware up to date
• Regularly review which devices are connected to your network

These steps significantly reduce the risk of unauthorised access. A poorly secured home network can allow attackers to reach work devices, intercept traffic, or gain a foothold into cloud and corporate systems.

Step 2: Follow cyber security basics

Strong fundamentals remain one of the most effective security controls, regardless of where you work.

• Use strong, unique passwords for every account
• Enable multi-factor authentication wherever available
• Avoid reusing personal passwords for work systems

Password hygiene is still one of the most common causes of security breaches. If your reason for reusing passwords is that they are difficult to remember, speak to your organisation about using a secure, approved password manager. These tools remove the burden from individuals while significantly improving security.

Step 3: Keep devices and software up to date

Security updates are not optional.

• Regularly update operating systems and applications
• Restart devices to allow patches to install
• Keep personal devices updated if they are used for work

Failure to update software can have serious consequences. Attackers can gain access to a corporate environment by exploiting unpatched third-party software on an employee’s home computer, leading to long-term reputational and operational damage.

Step 4: Use a VPN when working remotely

A Virtual Private Network (VPN) encrypts your internet connection and protects data in transit.

• Always use a VPN when accessing company systems remotely
• Never connect to public Wi-Fi without protection
• Avoid free VPNs unless approved by your organisation

If you regularly work from cafés, hotels or shared spaces, a VPN should be considered essential.

Step 5: Stay alert to phishing and social engineering

Remote workers are frequently targeted by well-crafted attacks.

• Be cautious of unexpected emails, calls or messages
• Verify requests for credentials, payments or approvals
• Report suspicious communications immediately

AI is now widely used by attackers to create highly convincing phishing emails, fake login pages, and impersonated support messages that closely resemble Microsoft and internal IT teams. AI-generated voice and video are also being used to impersonate colleagues or service desks, making social engineering attacks far more believable and harder to detect.

Physical security matters too

Step 6: Secure your home workspace

Your home office should be treated as an extension of the workplace.

• Keep doors and windows locked while working, especially if you are in a ground-floor or shared building.
• Position your workspace so screens cannot be seen from outside or by others in the home.
• Use door locks, cameras, or alarms where appropriate to reduce the risk of unauthorised entry.
• In apartments or shared housing, be aware that communal areas, delivery points, and maintenance access can all be exploited.

Step 7: Protect sensitive information

Paper, screens, and devices are all targets.

• Shred confidential documents before disposal.
• Store paperwork, laptops, USB drives, and backups in locked drawers or cabinets when not in use.
• Do not leave sensitive documents, notebooks, or open screens unattended.
• Treat printed material with the same care as digital data.

Step 8: Avoid oversharing

Remote working often increases the risk of accidental exposure.

• Use privacy screen filters on laptops
• Wear headphones to prevent conversations being overheard
• Be mindful of what can be seen through windows, reflected in mirrors, or visible to people moving through the room.
• Avoid discussing confidential matters in shared spaces or near smart devices.

Ask yourself: If someone were sitting behind me, what could they see or hear?

Step 9: Limit access to your environment

Not everyone who enters your home should have access to your work.

• Know who can physically access your workspace.
• Ensure visitors, cleaners, or contractors cannot view screens, documents, or devices.
• Always lock your computer when stepping away even for a minute.
• Log out and shut down devices when work is finished.

Threat actors may exploit home environments just as they would an office.

How organisations can support secure remote working

Individuals play a critical role, but organisations must also enable secure behaviours.

This includes providing approved devices and security tools, offering VPNs and password managers, delivering practical security awareness training, and creating clear reporting routes for incidents or concerns.

When employees feel supported rather than monitored, they are far more likely to report issues early and prevent escalation.

Frequently asked questions about working from home security