Who is responsible for securing a home router used for work?

Who should secure the router in a work-from-home setup?

The practical answer is that the employee usually owns the day-to-day security of the home router, even if the ISP supplied the device. That means changing default credentials, turning on the right protections, and keeping firmware current. For the organisation, the router becomes part of the remote-work attack surface, so responsibility is shared even when ownership is not.

The key point is that “who pays for the device” is not the same as “who controls the risk.” A home router sits outside most corporate-managed infrastructure, so the person using it must handle basic hardening and monitoring. The employer still has a role in setting expectations, providing guidance, and deciding whether work access is allowed over an unmanaged home network.

That split matters because the router is both a household device and a gateway into work systems. If the router is weak, every remote login, video call, cloud session, and work application behind it inherits that exposure. The right question is not whether the router is personal or corporate, but whether it is secure enough to support work access.

Why router responsibility becomes a work security issue

Home routers fail in predictable ways: default admin passwords, exposed remote management, stale firmware, weak Wi-Fi settings, and forgotten guest or IoT devices. These are not abstract problems. They can create an entry point for credential theft, traffic interception, or redirection to malicious infrastructure, which then affects both personal and work activity on the same network.

That is why home router hygiene is better treated as part of remote-work readiness, not a standalone household preference. The organisation cannot reasonably manage every home network directly, but it can define minimum expectations for access, support safer configurations, and distinguish between approved and unapproved connection paths. The employee still performs the work, but the risk sits inside the employer’s security boundary.

In practice, the router is often the first control point before endpoint security even matters. If the router is compromised or left with weak defaults, the attacker may never need to attack the work laptop directly. The network path itself becomes the weakness, especially where the same connection is used for both work and personal devices.

What good home router security looks like for remote work

Good practice is straightforward: change the admin password, use the strongest Wi-Fi encryption the router supports, disable unnecessary features, and apply firmware updates promptly. If the router is old or unsupported, replacement is usually the better answer than trying to compensate with settings alone.

Worker guidance should also separate work traffic from household noise where possible. A guest network for family or smart devices, no remote administration from the internet unless there is a clear business need, and minimal sharing of the router admin account all reduce unnecessary exposure. If the router cannot support those basics, it should not be treated as a reliable work platform.

For organisations, the useful control is not full ownership of the home router, but a clear requirement that the employee maintain a secure home access environment. Home Office and Remote Worker Security Guide covers the wider remote-work model, including home network settings, device separation, and access expectations. Securing Your Home Router Guide covers the practical hardening steps that make that expectation real.

Risk and Threat Considerations

Home routers used for work create a shared trust problem: the same gateway often supports personal browsing, work access, and unmanaged IoT devices. If the router is weak or compromised, attackers may gain a foothold that affects both household traffic and work sessions, while the organisation has limited visibility into the failure until something else breaks.

Failure mechanism: Weak router administration, outdated firmware, or exposed management interfaces can let an attacker change DNS settings, intercept traffic, or pivot into devices connected behind the router. That can undermine work authentication, session integrity, and the reliability of the home network used for remote access.

Impact: The result can be credential exposure, malicious redirection, disruption of work access, or compromise of multiple devices on the same home network. Where the router also supports business-critical remote work, the blast radius is larger than a normal household outage.

Practitioner Guidance

What to prioritise: Treat the router as a prerequisite control for remote work, not a nice-to-have. If the router still has default credentials, unsupported firmware, or unknown administrative settings, those are the first issues to fix before relying on it for work access.

What to verify: Confirm that the router is under the employee’s control, the admin password has been changed, firmware updates are still available, and unnecessary remote-management features are disabled. If any of those cannot be verified, the network should be considered higher risk for work use.

Common mistake: Assuming that ISP ownership equals security responsibility. In reality, the provider may maintain connectivity, but the employee usually has to harden the device and keep the home environment safe enough for work use.

Practitioner takeaway: The safest operating model is shared responsibility: the employee secures and maintains the home router, while the organisation defines the minimum standard and decides when a home network is too weak to trust for work.

Related resources from NHI Mgmt Group

• What happens when home and work networks are not separated on the same router?
• How should security teams reduce remote-work identity risk for employees using home offices?
• Who should own policy enforcement when AI is used in daily work?
• Who is responsible for securing cloud workloads in a shared responsibility model?