The office is wherever the laptop opens
A consulting firm's most valuable asset spends most of its life outside the office. Client financials, draft contracts, board decks and personal data all live on one laptop that gets opened in a hotel business centre, an airport lounge, a client's own meeting room and a train seat, often all in the same week. None of those networks belong to you, and most of them were not built with your client's confidentiality obligations in mind.
This is not a theoretical risk. Across the EU, 92.76% of enterprises now use at least one ICT security measure, but the gap sits in exactly the controls that matter for a travelling laptop [1]. Strong password authentication is widespread. Virtual private networks and multi-factor authentication are not.
What actually goes wrong on the road
The failures we see with consulting clients are rarely dramatic hacking. They are small, ordinary mistakes that a network you do not control turns into a real incident.
- 1Joining the wrong network on purpose. A hotel's guest Wi-Fi and a look-alike network named almost identically both show up in the list. On a captive-portal network there is no way for a laptop to tell which one is genuine, and an attacker on the same segment can see unencrypted traffic and inject fake login pages.
- 2A locked laptop that never actually locks. Screen lock timeouts get pushed out over the years because they are mildly annoying, so a laptop left on a lounge table for two minutes while its owner queues for coffee sits there fully signed in.
- 3One password used everywhere logging in from everywhere. A password reused across the practice management tool, email and a client portal turns one leaked credential from an unrelated breach into access to all three, and it is far easier to attempt from any network when there is no second factor to stop it.
- 4A laptop that goes missing, not stolen. Left in a taxi or under an airport seat, most lost devices are never hacked in any technical sense. Whoever finds it just opens the lid, and if the disk is not encrypted and the account has no lock screen, every client file is available to read.
- 5Client-site Wi-Fi treated as trusted because the client trusts it. A consultant on a client's own network is still on a network the consultant does not manage, and confidential material for a different client sitting in the same inbox is exposed to whatever that client's network can see.
NIST's guidance for enterprise telework and remote access treats every network outside the organisation's own perimeter, including a client's network, as untrusted by default and recommends that devices authenticate and encrypt regardless of which network they join [2].
Why this is a client-confidentiality problem, not just an IT one
A consultant who loses a laptop with a client's financial model on it has not just lost a device. If that laptop holds personal data on employees, customers or patients, the obligations that follow depend on where the client sits, but under the GDPR, a controller must notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach [3]. A firm operating across Israel, Greece and Spain, with clients on both sides of that rule, does not get to decide which incidents count as minor.
Fraud tied to stolen credentials and account access remains one of the largest categories of loss reported to the FBI's Internet Crime Complaint Center, which recorded $16.6 billion in total losses in 2024, a 33% increase on the prior year, with cyber-enabled fraud responsible for about 83% of that figure [4]. None of that requires a sophisticated attacker. It mostly requires one weak login, reached from a network nobody was watching.
The lean setup that closes the gap
None of this needs a dedicated IT department or a six-figure security budget. A small consulting firm on Microsoft 365 Business Premium already owns the tools; the work is turning them on and pointing them at the right risk.
1. Conditional Access instead of trust-by-network
Microsoft Entra Conditional Access evaluates signals like device compliance, location and sign-in risk at every login and blocks or challenges access accordingly, rather than assuming a login is safe just because the password was correct [5]. For a firm with travelling consultants, the practical policy set is short:
- Require multi-factor authentication for every sign-in, from every network, with no exceptions for "trusted" locations that are really just the office Wi-Fi.
- Block sign-in from unmanaged or non-compliant devices, so a client's shared kiosk PC cannot pull mail or files even with a valid password.
- Flag and challenge sign-ins that Microsoft's risk detection scores as unusual, such as an impossible travel pattern between two logins minutes apart.
2. Intune-managed devices, not just company-owned ones
Every laptop that touches client data should be enrolled so it reports back its encryption status, patch level and lock screen policy, and can be wiped remotely if lost [5]. In practice that means:
- Full-disk encryption (BitLocker on Windows, FileVault on Mac) turned on and verified, not just assumed.
- A one-minute or shorter screen lock, enforced by policy rather than left to habit.
- Automatic security updates, since an unpatched laptop on a public network is exposed to attacks that a patched one is not.
3. Treat every non-office network as public
Rather than trying to vet every hotel and lounge network, the lean setup assumes all of them are hostile. A always-on VPN or Microsoft's built-in Cloud App Security tunnelling covers this without asking the consultant to remember to turn anything on before opening the laptop in a lobby.
4. Separate the client data, not just the device
SharePoint and OneDrive with per-client permission groups mean a lost or compromised laptop only exposes what that laptop's account could see in the first place, rather than every client file the firm holds.
What it costs and how long it takes
For a firm of five to twenty consultants already on Microsoft 365 Business Premium, turning on Conditional Access, enrolling existing laptops in Intune and setting compliance policies is a one to two week project, not a re-platform. There is no new licence to buy if Business Premium is already in place, since Entra Conditional Access and Intune are included; the cost is the setup time, either in-house or through a managed provider.
The habit that matters more than any setting
Even the best Conditional Access policy assumes the consultant reports a lost laptop the same day. A remote wipe only works before the device is powered off and disconnected for good, so the fastest fix here is cultural, not technical: a one-line policy that says report it immediately, no exceptions, no embarrassment. Firms that build that habit lose files. Firms that do not sometimes lose a client.
