How does remote work change IoT security risk?

Remote work changes IoT security risk by putting work laptops on home networks shared with cameras, speakers, plugs and other connected products that often lack strong security features. The practical response is to separate work devices from IoT, keep devices updated, change defaults and prefer products with documented security capabilities.

What changed when work moved home?

Before remote work became common, corporate laptops sat behind an office network with managed devices. At home, the same laptop shares a router with whatever the household has bought: a baby monitor, a smart TV, a thermostat, a printer. The company has no inventory of these devices and no control over their patching.

This post is about the general shift, not any single year or event. The risk comes from three facts: IoT products vary widely in security, home networks are usually flat, and employees reach company resources from those networks.

Why are IoT products a weak point?

NIST's guidance on IoT manufacturer activities starts from the observation that IoT products often lack product cybersecurity capabilities that customers, whether organizations or individuals, can use to reduce their own risk. NIST's Revision 1 of this publication, issued in April 2026 and superseding the 2020 original, recommends that manufacturers improve how securable their products are by providing needed cybersecurity functionality and by giving customers the information they need.

That puts a limit on what a customer can do. If a product has no way to update, no way to change a default password and no documentation, the buyer cannot make it safe. Choice at purchase time is the strongest control.

What is the actual threat to a remote worker?

The most direct path is lateral movement. A compromised camera or smart speaker on the same flat home network may be able to see other devices, including the work laptop. Another path is the router itself: if it is compromised, traffic from every device is exposed. A third is credentials: a vulnerable device can leak the Wi-Fi password.

CISA's ransomware guidance describes the same logic at company scale. It says network segmentation can help contain the impact of an intrusion and limit lateral movement, and provides figures contrasting flat and segmented networks. The idea applies at home: separate networks for work and IoT.

What should a company ask of remote staff?

Keep the asks few and feasible:

• Put work devices on a separate network from IoT products. Many routers offer a guest network or a second network name, which achieves a basic split.
• Change default passwords on the router and every connected device.
• Turn on automatic updates for the router and for devices that support them.
• Replace devices that no longer receive updates.
• Use the company's VPN or per-application access, not trust in the home network.

NIST SP 800-46 Revision 2 on telework and remote access says remote access components, including client devices, should be secured against expected threats found through threat modeling. A company policy that names home networks and IoT as a threat category is consistent with that.

What about people who build or buy IoT for the business?

If your company makes connected products, the NIST publication is your checklist for what to ship: security features customers can use, documentation, and a way to receive updates. If you buy them, ask the vendor for those same things before signing. An office building's smart devices can carry the same weaknesses as a home's.

Constructed example. An employee's home router has the factory password and a connected doorbell camera on the same network. A flaw in the camera lets an attacker on the internet run commands on it. From there the attacker scans the home network and finds the work laptop's file sharing turned on. If the laptop had been on a separate guest network, and the camera on the main one, the scan would have stopped at the camera.

How to check or apply this

1. Add home networks and IoT to the remote work threat model.
2. Publish a one page guide: separate network, change defaults, update, replace unsupported devices.
3. Require VPN or per-application access with MFA for company resources.
4. Keep file sharing and unneeded services off on work laptops.
5. When buying connected products for the business, ask for update policy, default credential handling and security documentation.
6. Revisit the guide yearly, since devices and routers change.

Quick check

Sources

• NIST IR 8259 Rev. 1, Foundational Cybersecurity Activities for IoT Product Manufacturers
• NIST SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and BYOD Security
• CISA #StopRansomware Guide

Last reviewed: 18 October 2026.