At the announcement of the national lockdown, many companies acted quickly to set up remote teams. Laptops went home, VPNs were stood up overnight, and everyone learned to live on video calls. But in all the haste, many businesses did not ensure the security basics were covered — and attackers noticed immediately.
What the attackers saw in 2020
Within weeks of lockdown we saw a measurable spike in phishing campaigns dressed up as COVID communications, brute-force attacks on exposed remote desktop services, and credential theft targeting home workers on unpatched personal devices. The corporate perimeter didn't shrink — it evaporated.
The basics that were missed
- Multi-factor authentication — the single cheapest control that would have stopped most credential attacks.
- Patch management on remote devices — machines that left the office stopped getting updates.
- Secure remote access — RDP exposed directly to the internet instead of behind a VPN or zero-trust gateway.
- Email filtering tuned for the moment — generic filters missed themed phishing entirely.
Six years on: remote never left
Hybrid work is now permanent, and the threat landscape has industrialised. What's changed on the defence side is the arrival of behavioural AI — security tooling that learns your environment's normal patterns and flags the abnormal before a human analyst would. That's the backbone of TechSecure: an AI baseline across endpoints, identity, and traffic, backed by a 24/7 SOC, with automated isolation when something moves laterally.
The 2020 lesson stands: security debt taken on in a hurry doesn't retire itself. If your remote-work security was assembled under pressure and never revisited, book a free cyber risk assessment — 60 minutes, no obligation, and we'll show you exactly where the gaps are.