Your corporate network used to end at the office door, with a firewall, a receptionist, and a locked entrance standing between the outside world and your systems. Now it ends at whatever router your finance director’s teenager configured three years ago and never thought about again, in a house you have never visited and never will visit. Nobody drew a new diagram when the perimeter quietly shifted into a hundred separate living rooms.
The Perimeter Moved and Nobody Rebuilt It
Hybrid and remote work genuinely improved productivity and staff satisfaction for a great many businesses over the last few years, and there is no realistic path back to everyone working exclusively from a single controlled office again. But every home network connecting into corporate systems brings its own router firmware, its own collection of other connected devices, and its own security posture that your IT team has never assessed and, in most cases, never actually will. Asking permission to inspect someone’s home network raises understandable concerns that a corporate office simply never had to deal with.
Proper internal network pen testing needs to account for this shift, examining not just the office network but how remote connections authenticate, what access they are granted once connected, and whether a compromise on a home network could realistically cascade into corporate systems through that single trusted connection alone.
A Hundred Networks You Cannot See
A home Wi-Fi network is only as secure as its weakest connected device, and that device might be a five-year-old smart TV running firmware that was abandoned by its manufacturer long ago, a smart speaker with a known unpatched vulnerability, or a teenager’s gaming console sitting on the exact same network as the laptop your employee uses to access customer records every single working day. Nobody bought any of those devices with a corporate breach in mind.
William Fieldhouse raises this scenario constantly when businesses ask why remote work security still needs serious attention years after the initial shift happened for everyone.
“During one assessment, we traced a path from a compromised smart doorbell on an employee’s home network straight through to their corporate VPN session, entirely because both were sitting on the same flat home network with no separation whatsoever between them at any point.”
— William Fieldhouse, Director of Aardwolf Security Ltd
A smart doorbell was never designed with corporate network security in mind, and it should never have been sitting on the same network as a VPN connection into sensitive systems in the first place at all. That gap exists in a great many homes right now, and most employees have genuinely never considered it, because nobody ever explained the risk in a way that felt relevant to their own kitchen router. A guest network toggle, switched on properly, would have separated the two in minutes.
Secure the Connection, Not Just the Office
Your network perimeter now includes every home a remote employee connects from, whether you have accounted for that reality or not yet. Combine internal testing with clear guidance on securing home Wi-Fi setups, and make sure remote access is genuinely segmented from whatever else happens to be sharing that same domestic connection, including proper Wifi pen Testing on the office side too. A short guidance document costs almost nothing and closes a gap most businesses have never even considered.