A hybrid workforce means the company network is no longer where people, devices and data stay. Risk moves to identity, unmanaged home networks, personal devices and cloud services. Respond by securing accounts and devices, limiting data exposure, and applying consistent policy wherever people work.
What changes when people work in both places?
The same laptop connects from the office, a kitchen table, a hotel and an airport. The old picture, a trusted internal network protected by a perimeter, stops matching how work happens. NIST SP 800-46 Rev. 2, the guide to enterprise telework, remote access and bring your own device security, treats remote access as something to plan for as a first class concern, with attention to the client device, the remote access method and the enterprise resources reached.
The consequences fall into four areas.
Which risks grow?
Identity. Staff sign in to cloud services from everywhere, so a stolen password works from anywhere. Phishing against remote staff is easier because there is no colleague at the next desk to ask.
Devices. Laptops travel and get lost. Personal phones and tablets reach work email. Home computers shared with family are a risk if they are used for work.
Networks. Home routers are rarely updated, and public wireless networks are untrusted. Work traffic crosses networks you do not control.
Data. Files are copied to personal storage, printed at home and shared through consumer tools because the approved way is slow.
How does the guidance respond?
NIST SP 800-46 recommends a telework security policy that defines which kinds of access are allowed, from which devices and with which protections. It discusses securing the endpoint, protecting data in transit with encrypted connections, controlling remote access methods and managing personally owned devices.
NIST's zero trust architecture, SP 800-207, gives the design principle underneath. Do not grant trust because a device is on a particular network. Authenticate and authorise each access to each resource, using the identity and the device's state.
What should an employer do?
Start with the controls with the highest effect.
- Strong sign-in. Multi-factor authentication for everything reachable from outside, with phishing resistant factors for administrators.
- Managed devices. Full disk encryption, automatic updates, screen lock and the ability to wipe a lost device.
- Clear rules for personal devices. Decide what they may access and under which conditions, such as a managed work profile.
- Least privilege. Hybrid blurs boundaries, so access should be limited by role in any case.
- Data controls. Approved sharing tools that are easy enough to be used, plus labels and retention rules.
- Visibility. Log sign-ins and device state, and alert on unusual access.
- Home network advice. Short, plain guidance: update the router, change default passwords, separate work devices where possible.
- Training that matches reality. Teach staff to spot phishing and tell them how to report quickly.
A constructed example
A consultancy with 80 staff splits time between an office and home. Audit finds that a quarter use personal tablets for email, and two shared drive folders are reachable by link with no sign-in. The company enforces MFA, moves email on personal devices to a managed work profile, removes the open links, and publishes a one page home setup guide. None of this needed new network equipment. It needed decisions about identity, devices and data.
What about the code and software side?
Hybrid teams also build software from anywhere. Developer laptops hold source code, credentials and package registry tokens. Protect those with the same controls, keep secrets out of repositories, and check dependencies in the pull request rather than relying on an office network to filter bad traffic. Safeguard's secrets scanning and dependency checks run in the editor and in review, so they apply wherever a developer sits.
How to check or apply this
- Write or refresh the telework and personal device policy.
- Enforce MFA on every externally reachable service.
- Inventory devices and confirm encryption and update status.
- Review which data can be shared outside the company and how.
- Log and review sign-in anomalies.
- Publish short home working security guidance.
- Re-test lost device and incident reporting procedures twice a year.
Quick check
Is a VPN enough for hybrid work?
Not alone. It protects traffic in transit but does not verify device health or limit access to what each person needs.
Should personal devices be allowed?
They can be, under written rules that limit access and keep work data in a managed space.
Sources
- NIST SP 800-46 Rev. 2: Guide to Enterprise Telework, Remote Access, and BYOD Security
- NIST SP 800-207: Zero Trust Architecture
- CISA: Multifactor authentication
Last reviewed: 18 October 2026.
