July 10, 202611 min read

Remote and Hybrid Workforce Security: Closing the Home Network and Endpoint Gaps

Sources:Cloudflare 2025 Remote Work Security Report|Forrester 2025: The State of Remote Worker Security|NIST SP 800-46: Guide to Enterprise Telework, Remote Access, and BYOD Security

Eric Bang

Founder & Cybersecurity Evangelist

83%

of home routers used by employees have never had their firmware updated since initial setup — creating a persistent network-level vulnerability in the remote work path

more security incidents affecting remote workers compared to office workers in 2025 — Forrester

45%

of organizations using full-tunnel VPN for remote access report employees using split-tunnel workarounds or VPN disconnection to avoid performance issues

0 seconds

detection time for a compromised home router that performs man-in-the-middle interception of VPN traffic — the attack is invisible to corporate security tools

The home network threat model

A home network hosting a corporate endpoint is a threat model distinct from a corporate LAN. Understanding the specific risks clarifies which controls are highest priority.

Compromised home router as a man-in-the-middle

Home routers are often purchased once and operated indefinitely without firmware updates. Router vulnerabilities that are publicly disclosed and patched by vendors go unpatched on most home networks. An attacker who exploits a home router vulnerability can position themselves between the employee's workstation and the internet — capturing unencrypted traffic, redirecting DNS queries to malicious resolvers, or selectively dropping security tool communications while allowing normal traffic through. The corporate security stack has no visibility into what is happening on the home network between the endpoint and the router.

Lateral movement from compromised home devices

Home networks typically include IoT devices (smart home systems, cameras, printers, gaming consoles) that are often unpatched and vulnerable. An attacker who compromises an IoT device on the home network can use it to scan and attack other devices on the same network segment — including the corporate endpoint used for work. From the corporate endpoint, they gain a foothold in the corporate environment. This is an attack path that did not exist before widespread remote work.

Split tunneling and direct internet exposure

Full-tunnel VPN routes all remote worker traffic through the corporate network — providing visibility and filtering. Split-tunnel VPN routes only corporate-destined traffic through the VPN and sends all other traffic (personal browsing, streaming, cloud app access) directly to the internet. Split tunneling is common for performance reasons. The security risk: in split-tunnel mode, corporate DNS queries and internal resource access are protected, but the device is simultaneously browsing the internet without corporate proxy or content filtering protection. Malicious downloads, phishing page visits, and drive-by infections occur on the unprotected internet interface.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

VPN versus ZTNA for remote access

Traditional VPN gives remote workers network-level access — once authenticated, the user is on the corporate network with access to all resources the network allows. ZTNA (Zero Trust Network Access) gives application-level access — the user authenticates and receives access to specific, authorized applications rather than network access.

For organizations planning remote access infrastructure or evaluating upgrades, the comparison matters for both security and operational reasons.

VPN: what you give up

Full-tunnel VPN provides complete network visibility for the security team but at a cost: network-level access means a compromised remote worker credential provides an attacker with the same network access as the employee, including access to systems the employee doesn't use day-to-day. VPN also creates a bottleneck at the VPN concentrator — all remote worker traffic flowing through corporate infrastructure creates performance issues that drive workarounds (VPN disconnection, split tunnel changes).

ZTNA: what you gain and what you lose

ZTNA grants access per-application based on: identity verification (strong authentication), device posture check (is the endpoint compliant?), and policy (what applications is this user/role authorized to access?). A compromised ZTNA credential provides access only to the applications that credential is authorized for — not network-level access. The trade-off: ZTNA requires mapping every application a user accesses to an access policy, which is implementation effort, and does not support legacy applications that require network-level access (applications that use broad IP ranges, network discovery, or broadcast protocols).

Practical migration path: start with new applications

For organizations not ready for full ZTNA migration, deploy ZTNA for new SaaS applications and internal web applications while keeping VPN for legacy applications that require network access. This hybrid approach reduces VPN load, improves security for new applications, and creates operational experience with ZTNA before committing to full migration. Major ZTNA platforms (Cloudflare Access, Zscaler Private Access, Cisco Duo Access) support this hybrid deployment model.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Free daily briefing

Briefings like this, every morning before 9am.

Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.

Endpoint security controls for remote workers

The corporate endpoint used by a remote worker is the primary security control surface — it must compensate for the absence of network-level controls that apply in the office.

EDR with cloud connectivity and offline detection

Your endpoint detection and response platform must be able to detect and respond to threats even when the endpoint is not on VPN. EDR agents with cloud-connected telemetry (CrowdStrike Falcon, SentinelOne, Microsoft Defender) continue to receive threat intelligence updates and send detection telemetry over the internet — they do not require VPN connectivity to the corporate SIEM. Ensure EDR is deployed on all endpoints, including those primarily used for remote work, and that the agent is not disabled when VPN is not connected.

DNS filtering as a universal control

Corporate DNS filtering (Cisco Umbrella, Cloudflare Gateway, Zscaler DNS Security) applied to all remote endpoints blocks access to malicious domains regardless of VPN status. DNS filtering is applied at the endpoint or at the DNS resolver level — in split-tunnel configurations, corporate DNS queries go through the VPN; configuring the DNS filtering agent to apply to all DNS queries (not just VPN-routed queries) extends the control to the full remote work context. DNS filtering is low-friction, high-impact, and works on both managed and BYOD devices.

Device compliance checking before access

Before granting VPN or ZTNA access, verify device posture: is the EDR agent running and up to date? Is the OS patched to the required minimum version? Is disk encryption enabled? Is the managed browser profile (for web application DLP) loaded? Conditional access policies in your identity provider (Entra ID, Okta) can enforce device compliance as a condition of authentication. A device that fails compliance checks receives a reduced-access session or is redirected to a remediation page rather than receiving full corporate access.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Guidance for employees: reducing home network risk

IT security teams cannot manage employee home networks. But providing specific, actionable guidance to employees — not generic 'use a secure network' advice — materially reduces home network risk.

Router firmware update instructions by ISP/router model

Provide employees with a one-page guide specific to the most common ISP-issued and retail router models in your employee population: how to check the current firmware version, how to enable automatic firmware updates (where available), and how to check if the router uses a default password. This is specific enough to actually be followed, unlike 'keep your router updated.'

Work on a separate Wi-Fi network or VLAN

Many modern home routers support a guest network or secondary SSID. Recommend employees connect work devices to a separate network segment from personal IoT devices and family devices — this limits the lateral movement path from a compromised smart TV or gaming console to the work endpoint. Provide VLAN setup instructions for the most common router models.

Screen lock and physical workspace security

For remote workers with children, roommates, or shared living spaces, physical access to a logged-in work computer is a real risk. Reinforce: screen lock shortcut (Windows+L, Ctrl+Command+Q on Mac) and configuring auto-lock after a maximum of 5 minutes. Also: work calls and video meetings should occur in spaces where sensitive business information cannot be overheard by household members.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

The bottom line

Remote work security is not solved by a single control — not by VPN alone, not by EDR alone, and not by ZTNA alone. The combination that works is: device posture enforcement as a condition of access (ensuring the endpoint is managed and compliant), application-level access control (ZTNA where possible, VPN with least-privilege segmentation where not), DNS filtering as a universal layer that applies regardless of VPN state, and specific actionable guidance that employees can actually implement at home. The organizations that struggle most with remote work security are those that applied office security controls to remote workers without recognizing that the network, the device context, and the physical environment are all fundamentally different.

Frequently asked questions

Should we require employees to use corporate-issued devices for remote work?

Corporate-issued, fully managed devices are the gold standard for remote work security — they allow complete EDR, MDM, and DLP coverage, device compliance enforcement, and centralized management. BYOD introduces variables the security team cannot control. The practical answer depends on your threat model and workforce: for roles handling sensitive financial, health, or classified data, corporate-issued devices are essential. For lower-sensitivity roles where BYOD is a strong employee expectation, a managed container approach (separate corporate profile managed by MDM on the personal device) is a workable compromise. The cost of corporate device programs is high; weigh it against the breach risk of unmanaged BYOD for your specific context.

Is a consumer VPN (like ExpressVPN) appropriate for corporate remote work?

No. Consumer VPN services route employee traffic through the VPN provider's infrastructure, not through your corporate network. They provide no corporate security visibility, no content filtering, no DLP, and no integration with your identity or endpoint management. They do protect against some home network snooping, but they introduce a different trust dependency (the VPN provider). Corporate remote access should use a corporate-managed VPN or ZTNA solution where you control the infrastructure and access policies.

How do we handle remote workers in high-risk geographies?

Remote workers physically located in countries with active state-sponsored threat actor programs (China, Russia, North Korea, Iran in the context of their adversarial posture) present elevated risk — both for targeted surveillance of the employee's work and for local network infrastructure compromise. Controls for high-risk geography remote work: require full-tunnel VPN (never split tunnel), require hardware MFA (FIDO2 token, not authenticator app), apply enhanced monitoring to the account's authentication and data access patterns, and avoid storing sensitive data on the endpoint (use virtual desktop infrastructure instead of full local data access).

Sources & references

Cloudflare 2025 Remote Work Security Report
Forrester 2025: The State of Remote Worker Security
NIST SP 800-46: Guide to Enterprise Telework, Remote Access, and BYOD Security

Free resources

Free download

Critical CVE Reference Card 2025–2026

25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.

Free download

Ransomware Incident Response Playbook

Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.

Free newsletter

Get threat intel before your inbox does.

50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.

Unsubscribe anytime. We never sell your data.

Author

Eric BangCISSP

Founder & Cybersecurity Evangelist, Decryption Digest

Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.

View profile →LinkedIn

Back to all briefings

Subscribe for Updates

remote work security hybrid workforce security home network security corporate remote endpoint security VPN vs ZTNA remote work split tunnel security BYOD remote work work from home security 2026

Black Hat Giveaway

Win a $2,495 Black Hat pass.

Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.

Remote and Hybrid Workforce Security: Closing the Home Network and Endpoint Gaps

The home network threat model

VPN versus ZTNA for remote access

Endpoint security controls for remote workers

Guidance for employees: reducing home network risk

The bottom line

Frequently asked questions

Should we require employees to use corporate-issued devices for remote work?

Is a consumer VPN (like ExpressVPN) appropriate for corporate remote work?

How do we handle remote workers in high-risk geographies?

Sources & references

Critical CVE Reference Card 2025–2026

Ransomware Incident Response Playbook

Get threat intel before your inbox does.

Subscribe to enter the giveaway