Notifications
Clear all
Topic starter
11/07/2026 8:44 pm
TL;DR: Hybrid work expands access from home networks, shared spaces, and mobile channels, increasing phishing exposure, encrypted traffic demands, and data-handling complexity, according to GlobalSign. The security problem is less about location and more about weakening trust, identity verification, and communication controls across distributed work environments.
NHIMG editorial — based on content published by GlobalSign: hybrid work security risks in a post-pandemic workplace
By the numbers:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
Questions worth separating out
Q: How should security teams handle trust when employees work from home and the office?
A: Security teams should stop using workplace location as a primary trust signal and instead rely on multifactor authentication, device posture, and session-level verification.
Q: Why do hybrid work models increase phishing risk?
A: Hybrid work pushes more communication into email, chat, and messaging tools, where impersonation is easy and verification is often weak.
Q: What breaks when security policies still assume a fixed office perimeter?
A: Policies built around a fixed perimeter fail when users connect from home routers, shared networks, and mobile devices.
Practitioner guidance
- Strengthen remote identity verification Require multifactor authentication, device posture checks, and stronger user verification for access from unmanaged or home networks before sensitive systems are reachable.
- Harden phishing-resistant communications Use digitally signed email, enforce secure messaging policies, and train staff to validate high-risk requests through a second channel before acting.
- Review trust assumptions in hybrid access policies Reassess whether office location is still being treated as a security signal and replace it with assurance-based access decisions that follow the user and the session.
What's in the full article
GlobalSign's full article covers the practical detail this post intentionally leaves for the source:
- How the vendor frames multi-factor authentication, mobile authentication, and digital signatures for hybrid and remote workers.
- The specific security and communication controls it recommends for reducing phishing exposure in distributed teams.
- The article's workplace and employee-support angle, including how hybrid working changes office expectations and team structure.
- The vendor's own discussion of public key infrastructure as part of a remote-work security stack.
👉 Read GlobalSign's analysis of hybrid work security risks and remote access controls →
Hybrid work security gaps: what IAM teams should tighten first?
Explore further
11/07/2026 9:10 pm
Hybrid work has become an identity assurance problem, not just a network-security problem. The article correctly frames the risk as more than remote access. Once users, devices, and approvals move across multiple locations, trust must be re-established continuously instead of being inherited from a corporate perimeter. For IAM programmes, this means stronger authentication, device confidence, and session governance become core controls rather than add-ons.
A question worth separating out:
Q: Who is accountable when remote access authentication fails?
A: Accountability sits with the identity, access, and system owners jointly, because the failure spans authentication design, access path governance, and detection coverage. In regulated environments, leaders should be able to show who approved exceptions, who reviewed risk, and who owns the control outcome.
👉 Read our full editorial: Hybrid work security gaps are outpacing workplace flexibility
