In short: Remote working security training teaches hybrid staff to secure their home Wi-Fi, avoid risky public networks, keep work devices to themselves, protect their screen and conversations in public, report lost devices immediately and connect through approved secure access. It also covers safe online meetings and phishing that targets people working away from colleagues.
Why remote workers need their own module
Remote and hybrid working changes the risks in a few specific ways. Staff are often alone when an odd message arrives, so there is no colleague to ask. Devices travel and can be lost. Home networks and public Wi-Fi are outside IT's control. And conversations that would be private in an office happen on trains and in cafés.
The NCSC's free Top Tips for Staff e-learning, which covers phishing, passwords, securing devices and reporting incidents, is a sensible baseline for every remote worker; see free security awareness training. A good platform builds on that with short, scenario-based lessons and reminders that reflect where and how your people actually work.
Home Wi-Fi and public networks
Two simple checklists cover most of what staff need.
At home:
- Change the router's default admin password and Wi-Fi password if they are still the ones on the sticker
- Keep the router's software up to date, or ask the broadband provider how it is updated
- Use modern Wi-Fi security (WPA2 or WPA3) and a guest network for visitors and smart devices
- Keep work devices on the main network, not the guest one used by everything else
Away from home:
- Prefer your mobile hotspot to public Wi-Fi when working with sensitive information
- If you use public Wi-Fi, connect through the organisation's secure access (VPN or zero trust client) first
- Be wary of networks with generic names and of sign-in pages that ask for work credentials
- Do not use public USB charging points for work devices; use your own charger and plug
On the technology side, modern ZTNA (zero trust network access) checks the user and device before granting access to each application, which is a better fit for hybrid working than an always-open VPN.
Devices: shared use, updates and loss
Work devices are for work. Training should make these expectations clear and explain why:
| Habit | Why it matters |
|---|---|
| Do not let family members use your work laptop | Children's games and downloads are a common way to pick up malware, and they can see confidential data |
| Install updates promptly | Updates close the security holes attackers use |
| Lock the screen whenever you step away | Someone else in the house or café can see or use it |
| Keep personal and work data separate | Personal cloud storage and email are outside your organisation's protection |
| Report a lost or stolen device immediately | IT can lock or wipe it remotely and reset passwords before anyone uses it |
Reporting a lost device quickly must never lead to blame. Device encryption and mobile device management make loss much less serious; see Sophos Central Device Encryption and Forever Group's Microsoft Intune service.
Screen privacy and conversations in public
Shoulder surfing and overheard calls are low-tech but real. Staff should:
- Sit with their back to a wall where possible, and consider a privacy screen filter for travelling staff
- Avoid discussing client names, deals or personal data on trains and in public spaces
- Use headphones for calls and keep the volume down
- Never leave a laptop or phone unattended, even briefly, and lock it in the boot rather than leaving it on a car seat
- Take care with printed papers at home and dispose of them securely, as covered in physical security awareness
Online meetings and remote-worker phishing
The NCSC's guidance "How to secure your online meetings", published in March 2026, is a practical basis for staff training. In our own words, its main points are:
- Download meeting apps only from trusted sources, such as official app stores or the provider's website, and keep them updated
- Protect admin accounts with a strong, unique password and two-step verification, and use passkeys where the provider offers them
- Let in only authenticated users and invited guests, use the waiting room (lobby) and politely ask anyone you do not recognise who they are
- Do not post meeting links or passcodes in public places
- Check what is behind you before joining, and consider background blur
- Know where recordings, transcripts, chat logs and shared files are stored, and be aware of AI attendees that record, transcribe or analyse the meeting
Remote staff are also targeted with messages that exploit distance: a fake 'IT support' chat asking to install a remote-access tool, an urgent request from a director who 'cannot talk right now', or a QR code in an email that moves the attack to a personal phone. See Microsoft Teams phishing, QR code phishing and business email compromise for those topics.
How we help
We include a remote and hybrid working module in your programme, schedule short reminders before holiday travel seasons, run simulations that reflect the messages remote staff actually receive, and review the device management, encryption and secure access that back the training up.
Contact us to add remote working security to your training programme.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is it safe to work on public Wi-Fi?
It is safer than it used to be because most services encrypt traffic, but staff should still prefer a mobile hotspot for sensitive work, connect through the organisation's VPN or zero trust client, and never enter work credentials into a Wi-Fi sign-in page.
What should I do if I lose my work laptop or phone?
Report it to IT straight away, even out of hours. IT can lock or wipe the device and reset passwords. If it was stolen, also report it to the police. Fast reporting matters far more than how it happened.
Can family members use my work laptop?
No. Work devices should only be used by the person they are issued to. Family use increases the chance of malware and exposes confidential information. Use a personal device for personal and family activities.
How do I secure my home Wi-Fi for work?
Change the router's default passwords, keep its software up to date, use WPA2 or WPA3 security, and put visitors and smart devices on a separate guest network. Ask your broadband provider if you are unsure how to update the router.
What NCSC guidance helps remote workers?
The NCSC's free Top Tips for Staff e-learning covers phishing, passwords, securing devices and reporting incidents, and its Top Tips for Staying Secure Online cover email passwords, updates, 2-step verification and backups. Its March 2026 guidance on securing online meetings covers meeting apps, access controls, recordings and AI attendees.