The Perimeter Moved and Nobody Told the Firewall
Here's the number that should bother every security leader: 61% of employees believe remote work is safe. Only 8% of IT pros agree with them. That's a 31-point perception gap, and it's not a cultural curiosity — it's an operational liability. Tasha's take has always been that you can't defend a network your people genuinely think is already fine.
The gap shows up downstream. 78% of organisations reported at least one remote-work-linked security incident in the past year, and 52% of security incidents in 2025 involved a remote worker's device or connection. The attack surface stopped being a building years ago. It's now whatever identity, browser session, and personal laptop happens to be in range of your SaaS stack at 11pm.
The Real Cost of a Remote-Involved Breach
Money is the language boards actually read. IBM's data puts the average additional cost of a breach with a remote component at roughly $1.07 million, with some aggregate framings landing closer to $173,774 for the specific remote delta — read it as a range, not a single invoice. The deeper wound is time. Breaches with a remote factor took about 46% longer to detect and contain, pushing dwell time toward the 228-day mark versus roughly 156 days for incidents without one. Detection lag is where small problems quietly become careers-ending ones.
Spending is climbing in response. The global remote work security market hit an estimated $68.94 billion in 2025 and is projected to reach $83.73 billion in 2026, compounding past $290 billion by 2030. The endpoint and IoT security slice alone holds around 34.4% of that market this year. That capital is not flowing to VPN concentrators any more. It's flowing to the device edge, which is exactly where it belongs.
Infostealers, Phishing, and the Human Layer
Phishing shows up in about a third of breaches overall, and remote workers face a meaningfully higher rate of voice phishing (vishing) than their office-bound colleagues. But the quieter killer is the infostealer. KELA logged 4.3 million devices infected by infostealers in a single recent year, and roughly 18% of remote worker infections involved credential harvesting — grabbing saved passwords, session tokens, and authentication cookies straight from the browser. One compromised laptop with a saved VPN password is a skeleton key to your cloud.
Layer in the human factor. 74% of breaches involve a human element, and a majority of employees knowingly take actions they've been trained to avoid. That last stat is the important one. This isn't mostly a training problem anymore; awareness without enforcement is theatre. The fix lives in controls that make the risky path the hard path, which is why AI driven endpoint security trends keep centering on behavioral detection rather than another click-through warning banner.
BYOD Is the Soft Underbelly
Three out of four employees use a personal phone for work tasks, yet only about 55% of those offsite personal devices meet corporate security standards. Roughly 70% of successful data breaches originate from endpoint devices — laptops and phones. The mismatch between how people actually use devices and how well those devices are controlled is precisely the seam attackers wedge into. Add the 49% of remote connections that bypass the corporate firewall entirely, and your "network" is a fiction you maintain for compliance paperwork.
The honest move here isn't to pretend you can fully manage someone's personal hardware. It's to assume you can't, and secure around it, posture checks, conditional access, and device-level detection. If you're wrestling specifically with the unmanaged-device mess, the deeper writeup on shadow IT and unmanaged asset gaps lays out a discovery-first approach worth stealing.
AI Driven Endpoint Security Trends Move Detection to the Edge
This is the part most "remote work is risky" articles skip. The reason endpoint security is swallowing the remote-work security budget isn't marketing, it's that the device is where the attack actually lands. GenAI traffic surged dramatically and shadow AI use is growing in the triple digits, which means attackers are speeding up payload generation and evasion at the same time defenders are trying to model normal endpoint behavior. Humans cannot outrun that in a sea of logs.
So the realistic response is AI-powered detection tuned to the distributed fleet: behavioral baselining, memory-resident malware triage, and the kind of "attacks that don't look like attacks" coverage the field keeps chasing. EDR adoption for remote endpoints climbed sharply as a direct reaction to the BYOD and infostealer pressure. The honest caveat I keep repeating: AI on the endpoint is only as good as the asset inventory feeding it, and that inventory is usually wrong. See the companion piece on defending against attacks that don't look like attacks before you wire autopilot into your response.
Leaving the VPN Behind for Identity-Centric Zero Trust
The uncomfortable truth is that the tool many companies used to "secure" remote access, the traditional VPN, has become a favorite entry point. It hands a foothold onto the internal network and trusts it implicitly. The market has noticed: a large majority of enterprises are moving away from VPN toward Zero Trust and ZTNA models, and around 91% of companies now enforce mandatory MFA for remote access endpoints. That MFA figure is reassuring right up until you remember MFA fatigue and session-hijacking pressure against remote users.
Which is why the pivot isn't really "VPN to ZTNA." It's a reframe from network trust to identity trust. A compromised remote user can expose email, customer data, source code, and internal tools without ever touching an office network. The perimeter that matters now is a single stolen credential, and the case for why one identity compromise snowballs into deep SaaS penetration is the spine of this whole shift.
What to Do First
Skip the grand transformation deck. Start with the three things the data actually points at. First, find the unmanaged devices and shadow AI you're already running, you can't protect an inventory you're guessing at. Second, put device-level, behavior-based detection on the remote fleet before you automate anything, because AI response over incomplete data just automates the blind spot. Third, kill blanket network trust: conditional access, phishing-resistant MFA, and least privilege on the identities that touch your crown jewels. Remote work isn't going away and neither is the attack surface it created. Your job is to make the endpoint, that messy, personal, always-on endpoint, the place the attack stops instead of the place it starts.
