VPN, MDM, secured workstations, Zero Trust… Remote work security is not an obstacle to deployment, it is a well-tooled discipline. An overview of practices, real costs and common misconceptions to debunk.
Remote work is no longer a perk granted to a few tech profiles. It is a mature organisational model, widely supported by employees and documented as beneficial for productivity — provided it is properly structured. IT security is often held up as the decisive argument against its deployment. This is rarely justified, and almost always refutable with data.
What the employee gains
The first thing a remote worker recovers is time. Two hours of commuting saved per day amount to ten hours per week — the equivalent of a full working day. This recovery translates into reduced fatigue, better sleep quality, and greater mental availability for work itself.
In terms of autonomy, remote work forces a shift from visibility to results. For senior profiles, this is a normal acknowledgement of professional maturity. For juniors, it accelerates self-organisation skills.
Work-life balance improves structurally: being able to handle a sick child without taking half a day off, eating lunch at home, or escaping noisy open-plan offices for focused tasks.
What the employer gains
The first saving is real estate: fewer fixed workstations required, space pooled through flex office arrangements. For a 100-person company with 40% regular remote work, the savings on square metres are measurable in tens of thousands of francs annually.
The second saving, less intuitive but well-documented, is talent retention. Remote work consistently ranks among the top employer selection criteria for IT profiles. Refusing it means cutting off a pool of candidates and increasing turnover — where replacing a developer is estimated to cost between 30% and 150% of their annual salary.
Finally, productivity. Several studies (Stanford, Buffer, GitLab) show a 10–20% increase in individual output during remote work, primarily due to fewer interruptions and flexible focus windows.
Security best practices
Workstation encryption
The first security perimeter is not the network — it is the machine. A laptop lost or stolen on a train must not expose company data. FileVault (macOS) and BitLocker (Windows) encrypt the entire disk. Activation takes less than five minutes. This is non-negotiable.
VPN or Zero Trust Network Access (ZTNA)
A traditional VPN creates an encrypted tunnel to the company network. Properly configured, it makes traffic unreadable on home or public networks. For modern architectures, ZTNA (Zero Trust Network Access) goes further: it grants access only to the requested application — not the entire network — after continuous verification of identity and device health.
Proven solutions:
| Tool | Type | Typical use |
|---|---|---|
| WireGuard / OpenVPN | Open-source VPN | SMBs, technical teams |
| Tailscale | WireGuard mesh VPN | Distributed teams, easy deployment |
| Cloudflare Access | ZTNA | Per-application access, no global VPN |
| Zscaler Private Access | Enterprise ZTNA | Large organisations, compliance |
| Cisco AnyConnect | Enterprise VPN | Existing Cisco environments |
Strong authentication
Remote access without strong authentication is an open door. The minimum combination is strong password + 2FA (TOTP or passkey). For privileged access (VPN, servers, back-office), a physical FIDO2 key (YubiKey, Titan Key) eliminates phishing risk.
Centralised SSO authentication (Okta, Keycloak, Microsoft Entra) simplifies access management and enables instant revocation of all access when an employee leaves — something account-by-account management never guarantees.
MDM — Mobile Device Management
An MDM allows the company to enforce a security policy on remote devices: mandatory encryption, forced updates, corporate certificate deployment, remote lock or wipe in case of loss.
Common solutions:
- Jamf — the reference for macOS/iOS fleets
- Microsoft Intune — native for Windows/Azure environments
- Kandji — modern, Apple-focused, automated onboarding
- Fleet — open source, security and compliance-oriented
Internet connection assessment
Before deploying a VPN or MDM, the first question to ask is: is the employee's internet connection adequate? This is not a minor detail — an unstable or under-dimensioned connection is the primary source of friction in remote work, and is often mistaken for a tooling problem.
Metrics to measure:
| Indicator | Recommended minimum | Impact if insufficient |
|---|---|---|
| Download speed | 25 Mbit/s | Degraded video calls, choppy screen sharing |
| Upload speed | 10 Mbit/s | Slow uploads, stuttering screen share |
| Latency (ping) | < 40 ms | Poor VoIP quality, slow VPN |
| Jitter | < 10 ms | Robotic voice, drops during meetings |
| Packet loss | < 1 % | Frequent VPN reconnections, video artefacts |
Tools like Speedtest CLI, iPerf3, or fast.com measure throughput. For latency and jitter, ping and mtr are sufficient. Some companies deploy a lightweight network monitoring agent (e.g. Obkio, ThousandEyes) on the employee's device, providing continuous visibility into link quality — useful for distinguishing a network issue from an application issue during an incident.
Connection assessment should happen before remote work onboarding, ideally with a standardised test script or link that the employee runs from home. If the connection falls short, options include partial employer contribution to the internet subscription, fibre upgrade, or deployment of a 4G/5G backup router.
Home network
Once the connection is assessed, securing the home network follows. Minimum recommendations to share: change the default credentials on the router, enable WPA3 on Wi-Fi, and isolate IoT devices on a guest network. A filtering DNS (Cloudflare Gateway, NextDNS) blocks malicious domains before any connection is even established.
Usage separation
The work device must not be used for personal purposes, and vice versa. This protects the company (no uncontrolled software installed) and the employee (no personal data exposed on an auditable device). On mobile, MAM (Mobile Application Management) solutions create a sandboxed work environment without touching personal data.
Updates and patch management
The vast majority of attacks exploit vulnerabilities that have been patched for months. Patch management policies (automatic updates, version inventory) apply to remote devices exactly as to office ones — via MDM.
Awareness training
The most underused tool is training. An employee who recognises a phishing email is worth more than an additional firewall. Phishing simulation campaigns (KnowBe4, Proofpoint Security Awareness) measure click-through rates and personalise training accordingly.
The real cost of the tooling
The cost argument is often used to justify refusing remote work. The actual pricing in 2026:
| Tool | Monthly cost / user |
|---|---|
| Tailscale (Teams) | ~$6 |
| Cloudflare Access | ~$3 (free up to 50 users) |
| Microsoft Intune | Included in Microsoft 365 Business |
| Jamf | ~$10–16 |
| 1Password Teams (passwords) | ~$4 |
| KnowBe4 (awareness) | ~$2–5 |
For a properly equipped employee, the remote work security budget amounts to roughly $15–25 per month. Compare that to the cost of one working day — or to the cost of a security incident, estimated on average at several tens of thousands of euros for an SMB.
False objections debunked
"We can't control what happens at the employee's home"
True without MDM. False with it. An MDM enforces exactly the same security policies on a remote device as on an office one. Control is not geographical — it is software-based.
"Our data is too sensitive"
Sensitive data doesn't circulate any less when everyone is in the office: it already flows through webmail, cloud services, and SaaS tools. Remote work doesn't worsen the problem — it exposes it. The right answer is a data classification policy and segmented access management, applied everywhere.
"The employee's network isn't secure"
A VPN or ZTNA makes the home network as relevant as an airport Wi-Fi for company data: it transits encrypted end-to-end. The company doesn't control the network — but it controls the tunnel.
"It's complicated to set up"
A Tailscale + Microsoft Intune + 1Password deployment in a 50-person organisation takes one working day for a competent system administrator. This is not a digital transformation project — it is a configuration task.
"It slows down the connection"
WireGuard, on which Tailscale and several other modern solutions are based, has near-zero network overhead. Benchmarks show performance close to native connectivity. This argument belongs to the OpenVPN era of the 2010s.
"Employees will use it as an excuse to work less"
This is a trust argument, not a security one. It belongs to management, not the IT department. The answer is management by objectives — a best practice regardless of the work location.
Conclusion
Remote work security is a solved problem. The tools exist, they are affordable, deployable quickly, and maintain a level of control equivalent to the office. What often remains unsolved is the organisational willingness to trust employees and invest $20 per month to equip them properly.
Companies that block remote work for unsubstantiated security reasons are in fact paying an invisible cost: high turnover, recruitment difficulties, disengagement of senior profiles. This cost is far higher than that of an MDM and a VPN.