Three months ago, we moved the entire company home. I wrote about what that transition looked like back in April, while the adrenaline was still fresh, and at the time the focus was on speed: get people connected, get the VPN scaled, get collaboration tools deployed, keep the business running. We did all of that, and we did it well. But now that the dust has settled and it’s becoming clear that remote work isn’t a temporary arrangement, there’s a problem that most organizations still haven’t addressed, and it’s a big one. The home networks that our employees are working from were never designed for this, and most companies are treating them as though they’re fine when they are, in many cases, anything but.

Let me put a number on it that should concern anyone in IT or information security: as of April, research from BitSight found that 45% of home networks were already infected with some form of malware. Not corporate networks with dedicated security teams and enterprise firewalls. Home networks. The same networks that are now carrying VPN traffic, handling access to cloud applications, transmitting sensitive business data, and serving as the front door to your company’s infrastructure. Nearly half of them were compromised before your employees even started their first Zoom call of the morning.

The Gap Between What We Built and Where We Built It

When companies invest in office infrastructure, they think about security at every layer. There are enterprise-grade firewalls, network segmentation, intrusion detection systems, managed switches, and dedicated IT staff monitoring all of it. The average home network has a consumer-grade router that was configured once (probably with the default credentials still intact), a WiFi password that the whole family knows, and zero monitoring of any kind. There’s no firewall worth mentioning, no network segmentation between the laptop running a VPN connection to corporate headquarters and the smart TV streaming Netflix in the next room, and no way for your IT team to see what’s happening on that network or do anything about it.

This isn’t a criticism of employees or their home setups. Most people had no reason to think about network security at home before March, and the equipment their internet service provider gave them was designed for convenience, not enterprise-grade security. The problem is that we’ve built a new corporate infrastructure model on top of a foundation that was never intended to bear that weight, and three months in, most organizations still haven’t acknowledged the gap, let alone started closing it.

What the Threat Looks Like Right Now

The threat picture has shifted dramatically since March, and it’s shifted in ways that directly target remote workers. Phishing was already the most common attack vector before the pandemic, but since the transition to remote work, incidents have nearly doubled. An estimated 80% of businesses have reported increased phishing attacks since COVID-19 started, and the attacks themselves have become more sophisticated, often using pandemic-related themes to create urgency and bypass people’s usual skepticism. When you’re working from home, isolated from your team, and dealing with a constant stream of anxiety-inducing news, you’re more vulnerable to a well-crafted phishing email than you would be sitting in an office where you could lean over and ask a colleague if something looks suspicious.

VPN infrastructure has become a major target as well, with attackers probing for misconfigurations and exploiting security gaps that were created during the rapid deployments of March and April. The volume of VPN-targeted attacks has surged significantly, and many of those attacks are succeeding against organizations that stood up remote access solutions quickly without the time to harden them properly in the weeks that followed.

The insider threat picture has shifted as well, though not in the way most people think when they hear that phrase. This isn’t primarily about malicious employees; it’s about well-meaning people making mistakes in an environment that offers fewer guardrails than the office did. When someone is working from their kitchen table, distracted by the noise of a household that’s also suddenly a school and a daycare, the likelihood of clicking the wrong link, sending a file to the wrong recipient, or misconfiguring a sharing permission goes up considerably. The 61% of companies that reported insider-related incidents before the pandemic should expect that number to climb.

And then there’s the shadow IT problem, which has only grown since the initial transition. Employees who can’t get what they need through official channels continue to sign up for third-party cloud services on their own, creating data flows and access points that security teams can’t see and can’t protect. Every unsanctioned SaaS application is a potential entry point, and most security teams have limited visibility into how many of these services are actually in use across their organization. The solution isn’t to crack down on employees for finding workarounds; it’s to understand what they need that they’re not getting through official channels and to provide approved alternatives that are just as easy to use.

What IT Teams Should Be Doing Right Now

If your organization hasn’t already started addressing these gaps, the time to start was three months ago, but the second-best time is now. Here’s what I’d prioritize based on what I’m seeing across the industry and what we’ve been working on internally.

First, multi-factor authentication needs to be everywhere, not just on the VPN but on every cloud application, every email account, every system that touches company data. Stolen credentials are implicated in roughly 80% of data breach incidents, and MFA is the single most effective countermeasure available. If your organization hasn’t deployed MFA universally yet, that should be the top of your list before anything else.

Second, endpoint protection needs to extend to every device that accesses corporate resources, including personal devices if your organization permits BYOD. The days of assuming that the corporate firewall would catch most threats are over, because the corporate firewall is no longer sitting between your employees and the internet. AI-powered endpoint protection that can flag unusual behavior is worth the investment, and it needs to be deployed on every machine that connects to your systems, not just the ones IT provisioned.

Third, security awareness training needs to be ongoing and practical, not an annual compliance checkbox. The phishing threat has intensified dramatically, and your employees are your first line of defense. Regular phishing simulations, clear reporting procedures, and consistent reminders about what to watch for can reduce phishing susceptibility by 50% within months and up to 90% within a year. That’s an extraordinary return on what is, comparatively, a modest investment of time and resources.

Fourth, IT teams need to provide clear, actionable guidance to employees about securing their home environments. This doesn’t mean asking people to become network engineers, but it does mean providing simple instructions for things like updating router firmware, changing default passwords, separating work devices from personal devices on the network where possible, and knowing who to call when something seems wrong. Fifty-three percent of remote workers reported receiving no security guidelines from their employer, and that’s a gap that costs nothing to close except the time it takes to write and distribute the guidance.

Fifth, and this one gets overlooked: IT and security teams need to audit what shadow IT has actually taken root over the last three months and make pragmatic decisions about what to bring under management versus what to replace. Pretending that employees haven’t signed up for dozens of unsanctioned cloud services won’t make those services go away, and it certainly won’t make the data that’s already flowing through them any more secure.

This Is a Career Opportunity, Not Just a Problem

I want to frame this for anyone who’s thinking about where their IT career goes from here, because the remote work security challenge isn’t going away. Twitter announced in May that employees can work from home permanently. Facebook said it expects half of its 45,000 employees to be remote within a decade. These aren’t outliers; they’re the leading edge of a structural shift that’s going to reshape how every company thinks about infrastructure and security.

That means the professionals who understand how to secure distributed work environments, who can build security programs that work when employees are scattered across hundreds of home networks instead of sitting behind a single corporate firewall, are going to be in extraordinary demand. Cloud security, endpoint management, identity and access management, security awareness program design, all of these skills were valuable before the pandemic, and they’re becoming essential now. If you’ve been thinking about specializing in security, or deepening the security expertise you already have, the case for doing so just got a lot stronger.

The Conversation We Need to Have

The remote work experiment has been, by most measures, a success in terms of keeping businesses operational. But the security foundation it’s sitting on is far less solid than most organizations want to admit, and the longer we go without addressing it, the more risk accumulates. The good news is that the solutions aren’t exotic or unproven. MFA, endpoint protection, security training, clear employee guidance: these are established practices that work. The challenge is getting organizations to invest in them with the same urgency they brought to getting everyone connected in March.

We moved fast when the priority was keeping the lights on. Now it’s time to move with the same purpose on making sure the house we moved into is actually secure.