Cybersecurity Risks Your Remote Staff Are Creating Right Now
Your team is spread across home offices, coffee shops, and maybe a few co-working spaces. Work gets done, clients are happy, and you have stopped paying for half the desk space you used to need. Then someone clicks the wrong link, connects to the wrong network, or reuses a password from a personal account - and suddenly you have a serious problem on your hands.
Remote and hybrid work has genuinely changed what it means to keep a business secure. When everyone worked from one office on one network, your IT security had a clear boundary. Now that boundary is gone. Every home router, every laptop on a hotel Wi-Fi, every personal device used to check work email is a potential entry point. Research suggests that nearly two-thirds of businesses have experienced a data breach linked to remote employees. That number is not surprising when you consider how little most businesses have changed their security approach since staff started working from home.
The risks are real, but they are also manageable. The main ones are weak or reused passwords, staff connecting through unsecured Wi-Fi networks, phishing emails that are getting harder to spot, and devices that never get updated because nobody is prompting people to do it. Each of these is exploitable on its own. Together they are a significant exposure. Under the NZ Privacy Act 2020, if a breach results in serious harm to individuals whose information you hold, you are required to notify the Office of the Privacy Commissioner at privacy.org.nz and the affected people. That is a conversation no practice manager wants to have.
When remote work security is handled properly, your staff barely notice it. They log in the same way they always have, but behind the scenes there are protections in place that make a real difference. Multi-factor authentication - where staff confirm their identity with a second step, like a code sent to their phone - stops most account takeover attempts cold. A secure connection tool called a VPN protects staff when they are working from public Wi-Fi. Devices are kept up to date automatically rather than waiting for someone to remember. And staff know what a suspicious email looks like because someone has shown them, not just sent a policy document nobody read.
None of this requires your staff to become IT-aware. It requires someone to set it up correctly and keep it running. That is the difference between ad hoc IT and proper managed IT support. Good security for a remote or hybrid team is mostly invisible when it is working well. You notice it when something is blocked that should have been a problem, not when something slips through that should have been caught.
If you are not sure how well your current setup handles remote work risks, that is worth finding out before something goes wrong. More detail on what a secure setup looks like for professional services businesses is on the ITstuffed cyber security page. If you want to see how a Canterbury professional services business handled this, the ITstuffed case study covers the approach in practice. If you want to report an incident or get guidance after a suspected breach, CERT NZ at cert.govt.nz is the right starting point.
ITstuffed works with professional services businesses across Canterbury to make sure remote and hybrid teams are not their biggest security liability. A 15-minute IT Fit Check is a good way to see where things stand.