It's an easy policy to fall into without ever formally deciding on it: someone checks work email on their personal phone, another team member drafts a document on their home laptop over a weekend, and before long, "bring your own device" has become how your business actually operates, without anyone writing a single rule about it. At Innovo Networks, this is one of the biggest, quietest security gaps we find in SME environments.
Quick answer: BYOD (Bring Your Own Device) is now the norm rather than the exception, most remote and hybrid employees regularly use personal phones or tablets for work tasks, and a meaningful share admits saving work files onto them. The problem isn't that employees are being careless on purpose, it’s that personal devices are simply not built or maintained to the same standard as company-managed equipment, and that gap is exactly what attackers look for.
Just how common is this, really?
More common than most business owners assume. Surveys of remote and hybrid workers consistently find the large majority use personal tablets or smartphones for work tasks, and a notable share have saved an actual work file to one of those devices. It's not a fringe behavior, it's close to standard practice across hybrid teams, whether or not it's officially sanctioned.
Why personal devices are genuinely riskier
This isn't a judgment on your team's habits; it's a structural difference in how these devices are managed:
Security updates lag. Company-issued devices are typically kept current through managed IT policies. Personal devices often aren't, research shows a meaningful share of people using personal devices for work admitting security updates, sometimes for months.
No consistent security software. A company laptop usually has endpoint protection installed and enforced. A personal phone might have nothing beyond whatever came pre-installed, if that.
Mixed use increases exposure. The same phone used for work email is also downloading random apps, clicking links in personal messages, and connecting to whatever Wi-Fi is available. Every one of those activities is a potential entry point that has nothing to do with work but can still compromise work data sitting on the same device.
Shadow IT creeps in. A meaningful share of remote and hybrid employees admits to using apps or software that IT never approved, and unauthorized cloud tools have been linked to real data loss incidents. When work happens on personal devices, it often happens through personal, unmanaged apps too.
Lost devices are a real, common event. Personal phones get lost, left in cars, or left behind at coffee shops far more often than anyone likes to admit, and when that device has work email, files, or saved credentials on it, that loss becomes a business problem, not just a personal inconvenience.
The result: research comparing device types has found personal, unmanaged devices are considerably more likely to become infected with malware than company-managed equipment. It's not that personal devices are used by careless people, it's that the devices themselves simply aren't held to the same standard.
The offboarding problem nobody talks about
Here's a scenario that comes up more than you'd expect: an employee leaves, and their personal phone still has access to company email, shared files, or business apps, because that access was never formally set up or tracked in the first place, it just sort of happened over time. A notable share of businesses reports that departing staff didn't return company-owned equipment; with personal devices, there's often no "return" step to even miss, the access just quietly persists.
What to do about it, without banning phones entirely
Banning personal devices outright rarely survives contact with reality, and it can push people toward even less visible workarounds. A better approach is a clear, enforced BYOD policy built around a few practical controls:
- Mobile Device Management (MDM), software that lets your business secure and, if necessary, remotely wipe just the work data on a personal device, without touching someone's personal photos or messages.
- Separate work profiles, keeping business apps and data in a contained, managed space on the device, distinct from personal use.
- Mandatory basics before access are granted: a passcode or biometric lock, current software updates, and encryption enabled.
- Clear rules on what's allowed, which apps can access company data, whether personal devices can connect to certain systems at all, and what happens when someone leaves the business.
- A written offboarding step for personal devices, specifically revoking access from personal phones and laptops, not just returning company-owned equipment.
How Innovo Networks approaches BYOD
We help businesses build a BYOD policy that reflects how their team already works, rather than a rulebook nobody follows, paired with the technical controls (MDM, endpoint protection extended to approved personal devices, and clear access policies) to back it up. The goal isn't to make life harder for your team, it's to make sure the flexibility of hybrid work doesn't quietly become your biggest unmonitored security gap.
Not sure what's connecting to your systems?
Most businesses have more personal devices touching company data than they realize. We'll help you get visibility into what's out there and build a BYOD approach that's realistic for your team.
Get a free BYOD security assessment from Innovo Networks: [innovonet.co.za] (https://innovonet.co.za) | 021 811 3333 | info@innovonet.co.za
---
Want this handled properly, not just understood? Innovo Networks builds and manages exactly this — talk to a specialist about your setup.
Get a Quote