Topic starter
11/07/2026 8:33 pm
TL;DR: A Black Hat survey of more than 270 cybersecurity professionals found that 95% believe the COVID-19 crisis increases cyber threat to enterprise systems and data, while 80% expect cybersecurity operations to change significantly and only 15% expect a return to normal after the pandemic, according to SentinelOne. The operational lesson is that distributed access, weak endpoint visibility, and rushed remote control expansion turn identity and device trust into the core security boundary.
Editorial analysis by NHI Mgmt Group, based on content published by SentinelOne: “5 Cyber Security Challenges in the Age of COVID-19”.
By the numbers:
- A survey of more than 270 cybersecurity professionals found that 80% believe the pandemic will lead to significant changes in cybersecurity operations.
- Nearly 95% of security professionals believe that the COVID-19 crisis increases the cyber threat to enterprise systems and data.
Key questions
Q: What breaks when remote workers use unmanaged endpoints to access enterprise systems?
A: Security teams lose reliable visibility into activity, software and suspicious behaviour on the device itself.
A: Exposed remote desktop services create high risk because attackers can use them as low-friction initial access points, then move laterally, steal data, and deploy ransomware across the environment.
Q: What are the signs that remote access controls are not working as intended?
A: Warning signs include vulnerable endpoints, misconfigured remote access systems, users reaching sensitive data they do not need, and audit findings that show policies are not being followed.
Practitioner guidance
- Tighten remote access exposure Inventory every internet-reachable remote access path, then remove or isolate RDP and similar admin channels that are not essential for business operations.
- Enforce device-level visibility Require EDR coverage and telemetry on all endpoints that can process company data or reach corporate systems, including personally owned devices used for work.
- Reduce broad remote privileges Review VPN and remote desktop entitlements together, then shrink access scope for users whose roles do not need persistent administrative entry.
Bottom line: The article shows that remote work expands the practical attack surface when endpoint telemetry, access scope and remote administration are not tightened together.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:02 pm
Remote work did not create the underlying threat, but it turned visibility gaps into operational risk at scale. The article shows that attackers were already targeting endpoints, yet distributed work made those endpoints harder to observe and defend. When business continuity depends on home devices, home networks and remote sessions, the security model shifts from perimeter enforcement to continuous device and access governance. Practitioners should treat endpoint visibility as a prerequisite for remote access expansion, not a downstream control.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: How should teams decide whether to secure devices, remote access or the cloud first?
A: Start with the control layer that currently exposes the most trust and the least visibility. In this article’s scenario, that is usually the endpoint and the remote access path, because they are the first places attackers can authenticate, execute and persist. Cloud migration can follow, but only after those trust boundaries are tightened.
👉 Read our full editorial: Remote work is exposing endpoint and RDP control gaps