# How do I secure remote workers who access the company network?

Start with the account and the device, then limit what the connection can reach. Require multi-factor authentication for the VPN, e-mail and every cloud application; give staff company laptops with full-disk encryption, endpoint protection and automatic updates; and keep personal devices off the VPN. Configure the VPN or remote-access gateway so that each group reaches only the systems it needs, not the whole office network, and log every session. Give staff a simple way to report a lost laptop or an odd sign-in prompt, and remove access on the day someone leaves. Then watch the point where remote work meets the company: with a sensor on a SPAN or TAP port behind the VPN gateway, NetSenX sees what remote devices do inside the network and flags scanning, lateral movement, beaconing and unusual outbound volume on every plan. It does not manage accounts, devices or the VPN; your identity provider, device management and gateway do.

FAQ: [Remote work and exposed services](https://netsenx.com/en/faq/remote) · https://netsenx.com/en/faq/how-to-secure-remote-workers-accessing-the-company-network

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/encrypted-traffic-analysis

## Related questions

- [Do we need a VPN for remote work?](https://netsenx.com/en/faq/do-we-need-a-vpn-for-remote-work)
- [Is a VPN protected only by a password enough?](https://netsenx.com/en/faq/is-a-vpn-without-multi-factor-authentication-enough)
- [Why are unpatched VPN gateways such a risk?](https://netsenx.com/en/faq/why-are-unpatched-vpn-gateways-a-risk)
- [What is split tunnelling on a VPN, and is it a risk?](https://netsenx.com/en/faq/what-is-split-tunnelling-and-is-it-a-risk)
- [Where should a sensor sit to see what VPN users do?](https://netsenx.com/en/faq/where-should-a-sensor-sit-to-see-vpn-users-traffic)