# Remote Work Security Testing and Supply Chain Awareness

Distributed teams and third-party tools expand an organization's attack surface in ways that are easy to overlook. Here's how testing and vendor awareness help close that gap.

Remote and hybrid work has pushed most organizations' **attack surface[↗](/attack-surface)** (all the places an attacker could try to get in) far beyond the office network. Home networks, personal devices, and a growing list of outside collaboration tools all now sit somewhere in the security picture.

## Why remote work changes what gets tested

Penetration testing[↗](/penetration-testing), where a specialist tries to break in to find weaknesses, used to focus on a defined office network. Remote work spreads that boundary across many home networks and personal setups that the organization cannot directly control. Testing therefore has to look at how people actually connect and work, not only at how the office network is configured.

[Securing Remote Work, Video Calls, and Social MediaWorking from anywhere means your security perimeter now includes home Wi-Fi, video meetings, and the social profiles that reveal more about you than you might think.](/securing-remote-work-video-calls-and-social-media)

## Office and remote work compared

|  | In the office | Working remotely |
| --- | --- | --- |
| Network | Managed by the organization | Home Wi-Fi and shared networks the organization does not control |
| Devices | Company-issued and managed | Sometimes personal devices with unknown settings |
| Tools | Mostly approved internal systems | Many online tools, some adopted without approval |
| Security focus | The perimeter of the office network | Each person, device, and connection |

## Questions a remote-work-aware assessment should ask

| Question | Why it matters |
| --- | --- |
| Could a compromised home network expose company data or systems? | Employees connect from networks the organization does not manage |
| Are company resources reachable only through secured channels (VPN or zero-trust access), or from any internet connection? | Direct exposure gives attackers an easier target |
| How is data protected on personal devices used for work, if that is allowed? | Those devices may lack the protections of company equipment |

A **VPN** is a protected connection back to the organization's network. **Zero-trust access** means every request is checked, instead of trusting anyone who happens to be on the network.

## Remote tools are part of your supply chain

Remote work relies heavily on outside online tools: video calls, file sharing, project management, chat. Each one is effectively a supplier relationship. A flaw or breach at any of them can affect your organization, however well your own systems are secured.

[Supply Chain Security: Protecting Your Vendors and PartnersA growing share of major breaches start with a trusted vendor, not the target organization itself. Here's how to think about supply chain risk practically.](/supply-chain-security-protecting-your-vendors-and-partners)

## Practical steps

- Include remote access routes and commonly used outside tools in the scope of any security assessment or penetration test.

- Keep a current list of outside tools in use. **Shadow IT[↗](/shadow-it)** (tools adopted without formal approval) is a common and often invisible supply chain risk.

- Review the security practices of any tool that handles sensitive company data, just as you would for a traditional supplier.

- Give staff simple home-working basics: update devices, use a strong Wi-Fi password, and do not share work accounts.

> Remote work did not just change where people sit. It moved where your attack surface begins, and testing and supplier awareness need to move with it.