Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dheapibus leo.
Securing the Summer: Protecting Your Business When Employees Work from Anywhere
Summer changes how a small business operates. People take longer vacations. Some employees work from rented cabins, beach houses, or visiting relatives. The kid is home from college and the parent decides to “just work from home today” two or three times a week. Travel increases. Office attendance drops.
All of this is fine — until you realize that your security setup was built for people working from your office, and most of it doesn’t really account for what summer actually looks like.
Here’s a practical guide to keeping your business safe through summer without becoming the boss who tells everyone they can’t work from anywhere.
The summer threat profile
Summer creates specific risks that the rest of the year doesn’t. Worth understanding before we get to the fixes.
Unfamiliar networks. Your team is connecting to Wi-Fi at airports, hotels, coffee shops, vacation rentals, and friends’ houses. None of these are as secure as your office network. Some are actively hostile — attackers run “evil twin” Wi-Fi networks at airports designed specifically to intercept traffic.
Mobile devices in unusual places. Phones get left in restaurants. Laptops get stolen out of cars. Conference room phones get propped up in unfamiliar settings during video calls. Physical security drops.
Distracted users. People on vacation, or even working from a rental porch, are more relaxed and less careful. Phishing emails are easier to fall for. Suspicious requests get less scrutiny.
Skeleton crews. Key people are on vacation. The bookkeeper who would normally catch an unusual wire transfer is at the lake for a week. Attackers specifically target periods when fewer eyes are on the financials.
Family members on the same network. Working from a vacation rental often means sharing Wi-Fi with kids, in-laws, and other vacationers — none of whom are part of your business and any of whom could be running compromised devices.
None of this means people shouldn’t work flexibly. It just means the security setup needs to account for it.
The non-negotiables before summer hits
If you do nothing else, make sure these are in place across your business by the time the summer travel season ramps up.
-
MFA on everything. We can’t say this enough. If a laptop gets stolen and the password is saved in the browser, MFA is what stops the thief (or the buyer of the stolen laptop) from logging into your email and accounting systems. Every business account that supports MFA should have it on.
- Full disk encryption on every device. Every laptop and phone should have its drive encrypted. On Windows business laptops, this means BitLocker (which requires Windows Pro). On Macs, FileVault. On phones, the default encryption on modern iOS and Android. With encryption on, a lost or stolen device is just a hardware loss — not a data breach.
- EDR or modern endpoint protection on every laptop. Workers connecting from coffee shops need real protection on their devices. A good EDR product (we deploy SentinelOne) operates regardless of where the user is connecting from. (We covered EDR in depth in a recent post.)
- A real VPN — or zero-trust access — for connecting to office resources. Anyone working remotely should connect to internal company resources through an encrypted VPN, not over open internet. Modern alternatives like zero-trust network access do this even better, but at minimum you need an encrypted tunnel.
- Cloud-based work, where possible. Microsoft 365, SharePoint, properly configured cloud applications — these work the same whether someone’s in the office or on a beach. The less your team depends on “being in the office to do the work,” the easier remote work is to secure.
A summer-specific employee briefing
Once a year, before the summer ramp-up, send a short note to your team covering the basics of working safely from anywhere. Doesn’t need to be long. Just a refresher.
The points worth covering:
Don’t use public Wi-Fi without protection. Airports, hotels, coffee shops — these networks can’t be trusted. Either use a VPN, tether to your phone’s mobile hotspot, or wait until you’re on a known-safe network.
Never use a public computer for work. Hotel business centers, internet cafes, library computers — never log in to anything work-related from these. Period.
Be skeptical of “urgent” emails from leadership during your time off. Attackers know who’s on vacation (from out-of-office replies, from social media, from LinkedIn). They specifically target colleagues with fake requests “from the boss” while the boss is unreachable. If you get an unusual request — especially involving money or sensitive data — verify by phone using a known number.
Watch where you do video calls. People in restaurants, hotel lobbies, and conference centers can hear your calls. Be mindful of what’s visible behind you and what’s audible around you, especially if you’re discussing anything sensitive.
Don’t leave laptops or phones unattended in cars, restaurants, or rental properties. Easy to forget. Common cause of incidents.
Report lost devices immediately. Don’t wait until you “find it later” to mention that your laptop is missing. Fast reporting lets IT remotely wipe it before someone else gets in.
If something feels off, ask. Trust your gut. An unusual email, a strange phone call, an account that’s behaving oddly — better to flag it and be wrong than the alternative.
That’s the entire briefing. Five minutes to read, and it materially improves how your team handles summer.
Special attention to the financial team
If your business handles wire transfers, vendor payments, payroll changes, or anything that involves money moving — summer is high season for the fraud that targets these workflows. Attackers love it when the controller is on vacation and a less-experienced backup is covering.
The protocol that works:
Any unusual financial request requires verbal confirmation. Not “reply to this email,” not “text me back” — an actual phone call to a known number. This rule applies to requests from owners, executives, vendors, and customers. No exceptions, even when “the CEO is unreachable because they’re on a boat.”
Vendor banking changes always trigger a callback to the vendor. If a vendor emails you new wire instructions, call them at the number on their original contract — not the number in the email — before changing anything. This is the single most effective defense against business email compromise.
Designate clear delegation. If the person who normally approves payments is on vacation, who has that authority? Make it explicit and document it. Attackers exploit ambiguity.
What to think about for hybrid workers
For employees who split between office and home (or vacation rentals, or wherever), a few things to set up once and benefit from all summer:
Their home or remote workspace is set up properly. That means a real laptop (not a personal one), proper security software, encrypted disk, MFA configured. Mixing personal and work devices is one of the biggest sources of summer security incidents.
Their cloud access is set up cleanly. OneDrive or SharePoint syncing what they need, accessible from anywhere. No “I had to drive to the office to grab a file” moments.
Their home Wi-Fi password isn’t shared with the whole family. Sounds funny. Real issue. If the work laptop is sitting on a network where a teenager is gaming and downloading whatever, that’s a risk worth managing.
They know how to spot a phishing attempt. This applies all year, but is especially worth refreshing before summer. We covered the seven red flags in a recent post.
The "coming back from vacation" risk
One more thing nobody talks about: returning from vacation.
When someone has been out for a week or two and returns to a flooded inbox with 400 emails, they’re going to skim. They’re tired, they want to catch up, they’re moving fast. This is exactly when attackers slip phishing emails into the mix — knowing that careful judgment is at its lowest.
A simple practice: when returning from a long absence, the first hour back is for triage, not action. Sort what’s important from what isn’t. Flag anything unusual. Don’t make any major decisions from a state of inbox overwhelm.
Same goes for the team covering for the person on vacation. The covering employee should be cautious about anything that doesn’t follow normal patterns — and that includes following normal verification protocols even when the person who would normally handle it is out.
What we do for clients
Our managed clients get a security posture that works the same whether their team is in the office or working from anywhere. MFA enforced. Disk encryption on every endpoint. EDR running and reporting. VPN or zero-trust access for office resources. Patching that doesn’t stop just because someone is on vacation. Email security that catches the targeted summer phishing campaigns. Monitoring that runs around the clock, even when your team isn’t watching.
If your current setup isn’t built for the way summer actually works in your business — flexible schedules, travel, hybrid presence — that’s a conversation worth having before the season hits full swing. A short review identifies the gaps and what would need to change. The cost of being ready is small. The cost of not being ready — when an incident hits while half the team is at the lake — is something you don’t want to learn the hard way.
