Lost laptops: are your controls protecting data, not just devices?

TL;DR: A lost or stolen laptop becomes a breach problem when data protection, encryption, and remote wipe are missing, not when the hardware itself disappears, according to Absolute Security. The practical shift is to treat device loss as an endpoint governance problem with recovery and containment controls already in place.

Editorial analysis by NHI Mgmt Group, based on content published by Absolute Security: “Laptop Tracking Software: How to Track and Recover a Lost Laptop”.

By the numbers:

• 76% of 1,000 IT decision-makers in the U.S. and Europe said they had been impacted by device theft in the past two years.
• 46% of those device theft incidents resulted directly in a data breach.
• 60% of small and mid-sized businesses fail within six months of a cyberattack or data breach.

Key questions

Q: What breaks when a lost laptop is treated as an inventory problem instead of a security event?

A: The organisation usually misses the moment when data, sessions, and cached access should be contained.

Q: Why do unencrypted laptops create compliance and breach risk after theft?

A: Because the stolen device may still contain readable files, local authentication state, and access to regulated data.

Q: How can security teams know whether endpoint policy enforcement is actually working?

A: They should test whether policy holds without custom scripts, local workarounds, or manual exceptions.

Practitioner guidance

• Implement loss-response authority for endpoints Define who can lock, locate, and wipe laptops as soon as a device is reported missing, and test that authority against real escalation paths and after-hours coverage.
• Require full-disk encryption on every managed laptop Make encryption non-optional for mobile endpoints so a stolen device does not automatically expose local data or cached access artifacts.
• Validate recovery controls after factory reset Check that device management and security controls survive OS reinstall or reimage, then confirm the endpoint can be restored to compliance automatically.

Bottom line: A missing laptop becomes a security incident when the organisation cannot contain the data, sessions, and credentials that travel with it.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →