Remote work stopped being a temporary measure and became the standard. But while the way of working changed overnight, security in many companies stayed at the level of "we'll manage". And every laptop on a home Wi-Fi is an extension of your business network. Whether you like it or not.
The most common mistake: exposed RDP
When working from home had to be enabled fast, many companies simply opened remote desktop access (RDP) to the internet. The problem: bots scan the internet for exactly such exposed access points and try passwords around the clock. Exposed RDP has been among the most common ransomware entry points for years. If it's still open at your company. That's the first thing to fix, today.
VPN: a private tunnel to the office
A VPN (virtual private network) creates an encrypted tunnel between an employee's computer and the business network. Everything travelling through that tunnel is unreadable to anyone intercepting the traffic, including the public Wi-Fi at a café. For the company, it means services no longer need to face the internet: from outside, nothing is visible, while employees work as if they were sitting in the office.
Modern solutions like WireGuard or OpenVPN are stable, fast and don't require expensive licences: provided someone sets them up properly, because a badly configured VPN can become a hole instead of a shield.
Access on a "need, not could" basis
A VPN by itself must not mean access to everything. The accountant needs the accounting system, not the server with technical documentation. The principle of least privilege, everyone sees only what their job requires, limits the damage even when things go wrong, because a stolen laptop or compromised account then opens one door, not all of them.
Add two more things: MFA on the VPN login (a stolen password is worthless without the phone) and disk encryption on laptops (a lost laptop then costs you hardware, not a data breach).
A quick check for your company
Does everyone working remotely use a VPN, or do they "manage somehow"? Is there a list of who has access to what? What happens to access when someone leaves the company? If any of these lacks a clear answer, your remote work runs on luck. And luck is not a security strategy.