Security for the remote-first company with no office to defend

A 20-person company with no office has 20 networks. One runs on an ISP router with the default admin password. One shares Wi-Fi with a roommate’s gaming PC. One is a coffee shop on Tuesdays. None of them will ever be inspected, patched or monitored by anyone the company employs, and that is fine. The mistake is not the home networks. The mistake is running a security model that assumes a network you control still exists.

Most security advice quietly assumes an office: a firewall at the edge, a server room, badge access, a guest network. Remote-first companies keep buying pieces of that model (usually a VPN) without asking what it is actually protecting. The honest answer for a cloud-native business is often nothing. There is no data center behind the VPN. Everything lives in Microsoft 365, a line-of-business SaaS platform and a file store that is reachable from any browser on earth.

That is not a weakness. It is a different perimeter. You just have to defend the one you actually have.

Identity is the perimeter now

When every application is reachable from anywhere, the login is the front door. Attackers know this, which is why credential attacks dwarf everything else against small remote companies. The controls that matter most:

• MFA on every account, no exceptions. Not just email. The accounting platform, the CRM, the file store and the admin consoles. If your team has not been through a structured rollout, our MFA rollout playbook covers how to do it in about 3 weeks without a mutiny.
• Conditional Access policies. Block legacy authentication, require compliant or known devices for sensitive apps and challenge logins from unexpected countries. Microsoft 365 Business Premium includes this. Most remote-first companies already pay for it and have never turned it on.
• A single identity provider. Every SaaS tool should authenticate through Microsoft Entra (or Google Workspace) rather than its own local password. One directory to secure, one switch to flip when someone leaves. If you are still running a domain controller for a company with no office, that server’s retirement is overdue.

This is Zero Trust thinking scaled to a small company, and it is more achievable at 20 users than at 2,000. We walk through the broader model in Zero Trust for the small and mid-market.

Devices: managed, or at least enrolled

The second pillar is the laptop itself. A remote company cannot see who is on the machine, what is installed or whether the disk is encrypted unless management tooling reports it.

The workable standard for a 10-50 person remote company:

• Company-owned laptops enrolled in Intune (or equivalent), with disk encryption, EDR and automatic updates enforced
• A documented baseline: screen lock, local admin removed, browser and OS patching verified rather than assumed
• Personal devices allowed only through app protection policies that wall off work data, not through blind trust. The tradeoffs are covered in our BYOD guide for small business

Enforcement matters more in remote companies because there is no hallway glance. Nobody notices the laptop that has skipped updates for 6 months. The tooling has to notice.

The VPN question

A VPN made sense when it connected remote workers to an office network holding servers. If your company has no servers, a traditional VPN connects people to nothing. Worse, it can create a false sense of protection: traffic tunnels to an exit point and then goes to the same public SaaS applications it would have reached anyway.

Where VPN-class tooling still earns a place:

• Access to a legacy application that cannot sit safely on the public internet
• Fixed-IP allowlisting required by a partner or platform
• Privacy on untrusted networks, though modern TLS already covers most of this

If none of those apply, spend the money on Conditional Access and device management instead. That is not a downgrade. It is redirecting budget from a wall around an empty field to locks on the doors people actually use.

Home routers: assume hostile, do not manage them

Companies periodically ask whether they should ship every employee a firewall or standardize home routers. In our experience the honest math rarely works. You would take on the support burden of 20 consumer-grade networks, the privacy problems of managing gear on personal home internet and the fiction that the network is now “trusted.”

The cleaner posture: treat every network as hostile, including home networks. If the laptop is encrypted, patched, running EDR and authenticating with MFA behind Conditional Access, the coffee shop and the home office are equally survivable. That assumption is the entire point of the identity-and-device model.

Collaboration sprawl is your shadow IT

Remote teams adopt tools fast because tools are how they see each other. A free Slack workspace here, a Notion here, a Loom account there, each created with a personal email and a reused password. Within 2 years a 20-person company can easily accumulate 40 to 60 SaaS tools, most invisible to whoever owns security.

Run the discovery exercise (we outline the method in our shadow IT walkthrough), then consolidate:

• One chat platform, one meeting platform, one file store, one project tool
• Everything behind single sign-on where the pricing tier allows it
• A lightweight request path for new tools, so people ask instead of swipe a card

The same discipline applies to AI tools, which remote teams adopt faster than anyone. Set the ground rules before habits harden. Our guidance on employees pasting company data into AI tools covers the sane middle path.

The logistics nobody plans: onboarding and offboarding by mail

In an office, day 1 means handing someone a laptop. Remote-first, it means shipping hardware a week early, imaging it before it ships and getting MFA enrolled on a video call. Miss the logistics and the new hire spends week 1 on a personal laptop with company data on it, which is exactly the habit you never claw back.

Offboarding is harder. The departed employee has a company laptop on their kitchen table 900 miles away. The process has to be written down before you need it:

• Disable the identity first, the moment employment ends. With single sign-on, one action cuts off every application
• Remote-wipe or lock the device the same day through your management tooling
• Prepaid return label sent before the exit conversation, with a deadline and a named owner tracking the return
• Recover licenses and transfer mailbox and file ownership on a schedule, not “eventually”

A remote company that cannot execute this within 24 hours does not have an offboarding process. It has a hope.

What it costs, roughly

The full identity-and-device model for a 20-person remote company (Business Premium licensing, EDR, device management, backup and someone actually watching it) typically lands between $150 and $250 per user per month through a managed provider, hardware excluded. The breakdown of what drives that range is in our managed IT pricing guide. The alternative, assembling and monitoring the stack yourself, is workable if someone on the team genuinely owns it. In most 20-person companies, nobody does, and it shows up in the first incident.

The remote-first security checklist

• MFA enforced everywhere, with Conditional Access blocking legacy authentication
• Every SaaS application behind one identity provider
• Company laptops enrolled, encrypted and running EDR
• Personal devices constrained by app protection policies
• No VPN theater. Budget goes to identity and endpoints
• SaaS inventory reviewed twice a year
• Shipping-based onboarding and 24-hour offboarding, documented and tested

Atticus Rowan builds and runs this model for companies that never plan to lease an office. If your company went remote first and security is still assuming a building, talk to us and we will map the gap.