What happens when employees rely on a co-working provider instead of managing their own controls?

Why the control burden shifts in a co-working environment

A co-working provider can supply the space, connectivity, and basic facilities, but it cannot own every part of your security posture. The moment employees treat the provider as the control plane, the organisation inherits shared-environment exposure, weaker segregation assumptions, and less direct visibility into who can observe, intercept, or access corporate activity.

That shift matters because the control objective changes from “use a managed workplace” to “protect corporate assets in a semi-shared environment.” In practice, the business still has to decide how data is handled, how sessions are protected, and what minimum controls are required before sensitive work is allowed in that space.

What actually becomes exposed when teams defer to the provider

The most common failure is assuming the venue’s convenience equals security. Shared WiFi can expose traffic paths, open work areas can enable shoulder surfing and physical eavesdropping, and unattended devices can create simple access opportunities. If users also reuse broadly privileged accounts or leave services signed in, the blast radius expands beyond the room itself.

These are not abstract concerns. They are the usual consequence of leaving endpoint, access, and monitoring decisions implicit instead of deliberate. The organisation may still have secure systems on paper, but the practical control boundary becomes the desk, the network, and the user’s judgment rather than the corporate environment.

How to decide what the business must still control

The right test is not whether the provider has policies, but whether your own data, device, and access assumptions remain valid in a shared setting. If sensitive work depends on confidentiality, attribution, or privileged access, then the organisation needs its own rules for network use, screen exposure, device locking, and session timeout. A provider can reduce friction, but it cannot remove the need for those decisions.

That is why the safest pattern is to classify activities by sensitivity. Low-risk collaboration may be acceptable in a co-working location, while regulated data, administrative consoles, or privileged operations usually require stricter controls or a different environment. The control requirement is driven by the asset, not by the professionalism of the building.

Risk and Threat Considerations

Relying on a co-working provider without compensating controls creates shared-environment risk, where confidentiality and access assumptions are weaker than in an owned office. The main issue is not just the venue, but the combination of physical proximity, shared connectivity, and reduced administrative control over who can observe or interfere.

Failure mechanism: Traffic, screens, devices, and sessions become exposed through shared WiFi, open seating, unattended workstations, or overly permissive access practices, allowing leakage or unauthorized use without a direct breach of the provider’s systems.

Impact: Sensitive business data can be observed, captured, or accessed even when the organisation believes the work is taking place in a professional and controlled space. That can lead to privacy incidents, credential compromise, and broader internal exposure if privileged sessions or sensitive applications are reachable from the same environment.

Practitioner Guidance

What to verify: Confirm that employees know which tasks are prohibited or restricted in shared workplaces, especially anything involving regulated data, admin access, or privileged sessions. If the answer is “anything goes,” the organisation is outsourcing risk decisions it still owns.

Common mistake: Treating venue selection as a security control. A better test is whether devices auto-lock, sessions expire quickly, sensitive content is obscured from bystanders, and users avoid open WiFi for sensitive work unless the required safeguards are in place.

Decision rule: If the activity would be unacceptable on a café table, it is usually also too risky in a co-working space unless the same exposure is explicitly mitigated. Convenience should lower friction, not lower the standard for data handling.

Practitioner takeaway: Co-working can be operationally useful, but it should be treated as an environment with shared exposure, not as a substitute for your own access and data protection controls.

Related resources from NHI Mgmt Group

• What happens when organisations rely on the cloud provider instead of owning their own cloud security controls?
• What happens when organisations rely on training alone instead of adaptive controls for high-risk users?
• What happens when organisations rely on compliance and cyber insurance instead of enforcing SaaS identity controls?
• What happens when a managed service provider relies on user memory instead of a password manager and authentication controls?