Secure&IT warns that mobile and distributed work requires protecting users, devices and data outside the corporate environment.
The workplace is no longer a physical location and, in response to this new reality, security must also no longer be understood as a physical perimeter.
On the occasion of International Telework Day, Secure&IT warns of the new security challenges posed by an increasingly distributed working environment, in which access to corporate resources takes place from more locations, networks and devices. Security must therefore be able to follow users wherever they work and connect.
According to the latest survey on the use of ICT and e-commerce in enterprises conducted by the Spanish National Statistics Institute (INE), 37.4% of Spanish companies with 10 or more employees allowed teleworking in the first quarter of 2025, a figure that reached 78% among companies with 250 or more employees. In addition, 20% of employees worked remotely on a regular basis.
Furthermore, as early as 2024, 81% of companies in the European Union provided their employees with remote access to corporate email, 69% to documents and 66% to business applications or software. In addition, six out of ten companies (60.2%) provided remote access to all three types of resources.
“A VPN is no longer enough to protect remote work. Organisations need to know who is accessing their systems, from which device and under what conditions, and be able to detect any anomalous behaviour,” says Francisco Valencia, Managing Director of Secure&IT.
MOBILE DEVICES ARE ALSO CORPORATE ENDPOINTS
One of the critical areas is the protection of mobile devices, which are increasingly used to access email, corporate applications, cloud services and authentication mechanisms, but do not always receive the same level of protection as corporate computers.
ENISA’s Threat Landscape 2025, which analyses 4,875 incidents occurring between July 2024 and June 2025, warns of an increase in attacks targeting mobile devices and specifically highlights the exploitation of outdated devices, with Android among the main targets. Meanwhile, NIST includes both company-provided devices and personal devices used for professional purposes in its recommendations.
“If a smartphone allows access to corporate email, documentation or applications, it is already part of the attack surface. We cannot continue treating it as a secondary device,” explains Valencia.
For this reason, Secure&IT recommends implementing a specific mobile device management and security strategy, keeping devices inventoried and up to date and establishing controls over configurations, applications and permissions. This strategy should also cover personal devices used for professional purposes (BYOD) and enable organisations to respond to the loss, theft or compromise of a device.
SECURITY THAT FOLLOWS THE USER
For Secure&IT, protecting mobile and distributed work requires security to follow the user regardless of their location, network or device. This means combining endpoint and mobile device protection; identity management and multi-factor authentication; privilege and access control; information encryption; secure remote connections and access; email, browsing and application protection; vulnerability management and patching; and continuous monitoring.
The level of protection should also adapt to the context. Accessing systems from an up-to-date corporate device does not present the same level of risk as accessing them from an unmanaged device or an unexpected location. Identifying these differences makes it possible to strengthen authentication, restrict access or block suspicious activity.
This must be complemented by detection and response capabilities. Monitoring from a SOC, supported by SIEM and SOAR technologies, makes it possible to correlate information from identities, endpoints, networks and applications to detect anomalous behaviour and respond quickly to potential threats.
“The office can no longer be the security perimeter. Identity, device, access and information must remain protected wherever the user is working. Mobility should not force us to choose between productivity and security,” concludes Francisco Valencia, Managing Director of Secure&IT.