Securing Remote Workers Beyond the VPN: Zero Trust, EDR, and DLP Together

Imagine an organization with a strong VPN, two-step verification turned on, and antivirus on every office laptop. An attacker still gets in, and the reason is not a broken password. An employee's session cookie was stolen by infostealer malware on a home computer shared with other people. This scenario is no longer rare, and it shows that remote work security cannot be solved with a VPN and antivirus alone.

Why the personal device is the weak link

The Verizon Data Breach Investigations Report for 2025 found that about 46 percent of devices with corporate login credentials in infostealer logs were unmanaged, meaning computers outside the IT team's control. The same report found that 54 percent of ransomware victims had their credentials visible in such logs before the attack. The security boundary of an organization now extends to the employee's kitchen table.

The problem is not only passwords. A remote user connects to the whole network through a flat VPN, files are copied to home disks or personal USB drives, and a laptop that has not reached the network for weeks receives neither patches nor new policies.

Four layers that must work together

• Device posture checks and least-privilege access: users reach only the applications their role requires, and before each connection the system checks disk encryption, active antivirus, and current patches.
• EDR with remote isolation: suspicious behavior, such as browser cookie theft, is detected, and the device can be contained even when it is off the corporate network.
• Endpoint DLP: copying to USB, uploading to personal cloud storage, and printing classified documents are controlled and logged.
• Off-network web filtering and log correlation: the office web policy also applies at home, and logs are reviewed together in a SIEM so that suspicious patterns trigger alerts quickly.

Four common mistakes

• Treating MFA as the end of the story. A stolen cookie passes straight through it.
• Split tunneling without web filtering. The user's internet traffic goes uncontrolled.
• One policy for every device. The weakest device sets the security standard.
• A console reachable only inside the internal network. A device that has not connected for weeks receives no patches and sends no reports.

A 90-day starting plan

Map who connects from outside, with which devices, and to which systems. Enable phishing-resistant MFA and short session lifetimes. Deploy EDR and full disk encryption on all corporate laptops. Run DLP in monitoring mode first, then turn on blocking for USB and cloud uploads. Finally, move from flat VPN access to application-based access and connect the logs to your SIEM.

Remote worker security is a chain. Its weakest link is any device that has the right password.

For the full English guide, checklist, and details: Remote Worker Security: When a Home Laptop Holds the Keys to the Network

— Kazem Mortazavi, independent network-security consultant