Secure&IT warns that distributed work expands organisations’ security perimeter and requires the protection of not only access, but also identity, information and all devices used, including smartphones and tablets.
Working remotely no longer necessarily means working from home. An airport, a train, a hotel, a client’s premises, a professional event or any journey can today become a temporary extension of the workplace. On the occasion of International Telework Day, Secure&IT is highlighting a reality that goes beyond this working arrangement: access to corporate resources increasingly takes place from more locations, networks and devices, and security must be able to follow users across all of them.
The data shows that this way of working is fully integrated into organisations. According to the latest survey on the use of ICT and e-commerce in enterprises conducted by the Spanish National Statistics Institute (INE), 37.4% of Spanish companies with 10 or more employees allowed teleworking in the first quarter of 2025, a figure that reached 78% among companies with 250 or more employees. In addition, 20% of employees worked remotely on a regular basis.
But the issue goes beyond who has formally established a teleworking model. As early as 2024, 81% of companies in the European Union provided their employees with remote access to corporate email, 69% to documents and 66% to business applications or software. In addition, six out of ten companies (60.2%) provided remote access to all three types of resources.
This ability to work from anywhere requires security controls to evolve at the same pace. “For a long time, we have associated remote-work security mainly with VPN connections. Today, that is no longer sufficient as an approach. An organisation needs to know who is accessing its resources, from which device, the condition that device is in, what information they are trying to access and whether that behaviour is consistent with their usual activity,” says Francisco Valencia, Managing Director of Secure&IT.
The mobile phone is also a corporate endpoint
One of the areas requiring particular attention is the protection of mobile devices. Smartphones and tablets are now routinely used to access email, collaboration tools, corporate applications, cloud services, documentation and authentication mechanisms.
However, their integration into security strategies does not always receive the same level of attention as that of corporate computers. This situation is particularly relevant given the evolution of the threat landscape. In its Threat Landscape 2025, which analyses 4,875 incidents occurring between July 2024 and June 2025, the European Union Agency for Cybersecurity (ENISA) warns of an increase in attacks targeting mobile devices and specifically highlights the exploitation of outdated devices, with Android among the main targets.
NIST itself points out that mobile devices have become permanent elements of enterprise environments and are used to access corporate systems and process sensitive information. Its recommendations cover both company-provided devices and personal devices used for professional purposes, as well as centralised management mechanisms and endpoint protection technologies.
“A smartphone should not be considered a secondary device from a cybersecurity perspective. If it allows users to check corporate email, access documentation or applications, approve an authentication request or handle company information, it is part of the attack surface in exactly the same way as any other endpoint,” explains Valencia.
Protection must include a specific mobile device management and security strategy that makes it possible to keep devices inventoried and up to date, control their configuration, protect stored information, manage applications and permissions and respond to the loss, theft or compromise of a device. In fact, ENISA expressly recommends including smartphones and tablets in asset management and defining a mobile device management strategy, including BYOD (*Bring Your Own Device) scenarios.
Security that follows the user
For Secure&IT, protecting mobile and distributed work requires an integrated approach. Security must follow the user regardless of their location, network or device.
This means combining endpoint and mobile device protection; identity management and multi-factor authentication; privilege and access control; information encryption; secure remote connections and access; protection for email, browsing and applications; vulnerability management and patching; and continuous activity monitoring.
It also requires different policies to be applied depending on the context. A connection from a known, properly updated corporate device does not present the same level of risk as access from an unmanaged device or from an unexpected location. The ability to identify these differences makes it possible to restrict access, request additional verification or block an activity when necessary.
These preventive measures must be complemented by detection and response capabilities. Monitoring from a SOC, supported by SIEM and SOAR technologies, makes it possible to correlate information from identities, endpoints, networks and applications in order to identify anomalous behaviour and respond quickly to a potential threat.
“The office can no longer be the security perimeter. The goal should be to build a model in which identity, device, access and information remain protected regardless of where a person is working. Mobility should not force organisations to choose between productivity and security,” concludes Secure&IT’s Managing Director.