Eighty seven percent of companies now rely on employees checking work email, files, and business apps from their own phones. That’s not a policy decision most businesses made on purpose, it’s just what happened once everyone got comfortable answering a Teams message from the couch. The question worth asking is simpler than it sounds: does your business actually know what’s on those devices?
The gap between what’s normal and what’s managed
According to ConnectWise, nearly 70 percent of businesses have some form of bring your own device policy in place today, which means roughly three in ten don’t have one at all despite the same personal phones and laptops already touching company data. More than two thirds of IT professionals see BYOD as a net positive for productivity and flexibility, and that’s fair; it usually is. But Cisco reports that one in five organizations have already experienced a security incident tied to unsanctioned or unmanaged IT resources, personal devices very much included.
The disconnect is that a personal phone feels like it belongs entirely to the employee, and mostly it does. But the moment it’s checking a work inbox or opening a file from the company’s shared drive, it’s also a device your business depends on for security, and one that IT typically has zero visibility into.
Where this actually goes wrong
The scenarios are ordinary, not exotic. A phone gets left in a rideshare with company email still logged in and no way to remotely wipe it. An employee leaves the company and nobody ever asks about the laptop they used at home that still syncs to a shared drive. A teenager downloads a sketchy app onto the family iPad that happens to be the same device a parent uses to approve MFA prompts for work. None of these require a sophisticated attacker. They just require a device nobody was watching.
This connects directly to identity security too: if a personal device is the one approving login requests or holding session tokens, then securing the login itself only goes so far if the device underneath it is unmanaged.
What actually closes the gap
- Mobile device management (MDM) that can enforce a PIN or biometric lock and remotely wipe company data specifically, not the whole personal device, when a phone is lost or an employee departs.
- A written BYOD policy that sets expectations before day one: what data can live on a personal device, what happens at offboarding, and what minimum security settings are required to connect at all.
- Conditional access rules that block company data from reaching a device until it meets baseline security requirements, rather than trusting every device that presents the right password.
None of this means banning personal devices, that ship sailed years ago and the productivity upside is real. It means treating them like what they are: an extension of your network that deserves the same attention as the laptop sitting on a desk in the office.
Cost is usually the objection that comes up first, and it’s a fair one to raise. But the fix here tends to be cheaper than businesses expect: MDM enrollment and a short policy document are a modest, predictable expense compared to what a single unrecovered device or a former employee’s still-active access can turn into. The businesses that get burned by this are rarely the ones that overspent on device management. They’re the ones who never quite got around to it.
Cloud9 Tech Solutions’ help desk and endpoint support team handles exactly this kind of device onboarding and offboarding for clients, and our ongoing monitoring work extends to flagging unmanaged devices before they become the way something goes wrong.
BYOD Security Questions
What is a BYOD policy?
A bring your own device policy spells out how employees can use personal phones, tablets and laptops for work. It covers which data can live on those devices, the minimum security settings required to connect, and what happens when someone leaves the company.
Can MDM wipe an employee’s personal phone?
Modern mobile device management can remove only the company data and apps while leaving personal photos, messages and apps untouched. That separation is usually what makes employees comfortable enrolling in the first place.
What is conditional access?
Conditional access checks a device before letting it reach company data. If a phone has no screen lock or is running outdated software, it gets blocked until it meets the baseline, even when the password is correct.
Should we just ban personal devices?
For most businesses that isn’t realistic, and it throws away real productivity gains. Managing personal devices properly is far more practical than pretending they aren’t already connected.
Schedule a free security assessment with Cloud9 and we’ll help you find out exactly what’s connecting to your business right now.