Remote and hybrid work removed two things IT had quietly depended on: a controlled network and physical access to devices. Most of what changes follows from those two losses.
The businesses that handle it well are not the ones with the most tooling. They are the ones that stopped treating the office as the default and designed for distribution deliberately.
The perimeter is gone
Traditional security assumed a trusted inside and an untrusted outside, with a firewall between them. When staff work from home, from client sites, and from wherever else, that model no longer describes reality.
The replacement is identity-centred: every access request is authenticated and authorised regardless of origin. In practice this means:
- MFA everywhere, not only on external access — because there is no longer an inside
- Conditional access policies evaluating device health, location and risk at each sign-in
- Endpoint protection that works off the corporate network, because that is where devices now live
- Data protection travelling with the data rather than depending on where it is stored
This is what "zero trust" describes, and for a small business it is less a product purchase than a sequence of configuration decisions in tools you probably already own.
Device management becomes non-optional
In an office, a device that drifts out of compliance is visible and reachable. Remotely it is neither. Device management is what replaces walking over to someone's desk.
At minimum you need the ability to:
- Enforce encryption and confirm it is active
- Push updates and verify they applied
- Deploy and remove software remotely
- Enforce screen lock and password policy
- Wipe a device that is lost or belongs to someone who has left
- See compliance status without asking the user
That last capability is the one that changes daily operations most. Without it you are relying on self-reporting, and users do not know whether their machine is compliant.
The home network problem
Home networks are outside your control and will remain so. Consumer routers years past their last firmware update, shared with everything else in the household, occasionally already compromised.
The workable approach is to stop depending on network trust rather than trying to secure networks you do not own:
- Treat every network as hostile, including the office
- Protect data in transit at the application layer rather than relying on the connection
- Use DNS filtering that follows the device rather than sitting on the network
- Give guidance on home network basics — change default credentials, keep firmware updated, use a separate network for work if the router supports it — as advice rather than an enforceable policy
Requiring VPN for everything is the instinctive answer and is increasingly the wrong one. It backhauls all traffic through a chokepoint, degrades performance, and provides limited benefit when most applications are cloud-hosted and already encrypted.
Support without physical access
The practical mechanics change more than people expect:
- Remote support tooling must work reliably even when the machine is partly broken
- Hardware failure means shipping, which means spare devices held in stock rather than ordered on demand
- New starters need devices configured centrally and shipped ready to work, with zero-touch enrolment doing the setup on first boot
- Offboarding means recovering hardware from someone who may not be motivated to return it, which is a policy and HR question as much as a technical one
Spare stock is the item most often skipped. Without it, a failed laptop means a person unable to work for however long shipping takes, which for a remote worker is the whole outage.
What to standardise
Distributed teams punish inconsistency, because every variation has to be diagnosed remotely without seeing the machine.
- One device build. Same model where possible, same image, same software set.
- One collaboration platform. Split tooling produces split conversations and duplicated files.
- One place files live, with a clear rule that work stored elsewhere is not backed up.
- One support channel with a documented process for people who cannot reach it because their machine is down.
- One identity, one MFA method, applied uniformly.
The hybrid-specific complications
Hybrid is harder than fully remote, because the environment changes underneath the same device repeatedly.
- Devices moving between networks daily, picking up problems in one and manifesting them in the other
- Meeting rooms needing to work for in-person and remote participants simultaneously, which is a genuine and frequently underestimated investment
- Hot-desking, which requires devices that any employee can log into cleanly
- Printing, which remains disproportionately difficult in hybrid environments
- The tendency for in-office staff to get faster informal support, which quietly disadvantages remote colleagues
That last one is a management problem rather than a technical one, and it is worth watching. If remote staff learn that grabbing someone in the office is the fast route, your ticket data stops reflecting reality.