Could One Compromised Laptop Put Your Whole Business at Risk?

An employee opens a malicious attachment. Their laptop is compromised.

You have antivirus software, a firewall and an IT provider. You might reasonably expect the incident to remain confined to that device.

But what can the laptop access?

Could an attacker connect to other employees’ computers? Reach your business servers? Open a printer’s administration page? Access the systems that manage your backups?

The answers can help determine whether you face a contained incident or disruption across the business.

Preventing attackers from gaining access is essential. Limiting what they can do after gaining access deserves just as much attention.

The first compromised device may only be the starting point.

An attacker who gains control of a laptop may begin exploring its surroundings. They could look for accessible systems, useful accounts, shared folders and weaknesses that provide further access.

Moving from one system to another is known as lateral movement. It can allow an attacker to progress from an ordinary workstation towards sensitive information or systems with greater control over the business.

The UK’s National Cyber Security Centre recommends internal security controls that make this movement harder and improve the chances of detecting it.

For a business owner, the concern is straightforward. An employee’s laptop might be replaceable within a day. Losing access to your accounts system, customer records and shared documents could stop several departments working at once.

That makes the connections between systems a business continuity issue.

A firewall at the internet connection does not control every connection inside your business.

Picture a hypothetical office with 40 employees. Staff computers, servers, printers, wireless devices and backup equipment have been added over several years.

Everything works, but nobody has recently checked which devices can communicate with each other.

A laptop needs access to a file server, so that connection is allowed. During troubleshooting, wider access is enabled. A temporary exception is added for a supplier. An old server remains connected after its replacement arrives.

Individually, these decisions may seem reasonable. Together, they can create far more access than the business intended.

An internet firewall can restrict traffic entering and leaving the organisation. Connections between internal devices may follow different paths and encounter different controls.

Ask your IT team to explain both: what protects your network from the internet, and what restricts access within it?

Network segmentation creates boundaries around the systems you need to protect.

Network segmentation means dividing a network into smaller sections. Controls between those sections determine which connections are permitted.

You might separate staff devices, servers, guest Wi-Fi, connected equipment and administration systems. The right arrangement depends on how your business operates.

The NCSC describes segmentation as a way to control traffic flows and protect access to infrastructure management interfaces.

For example, a receptionist might need access to a booking application and a shared printer. Their computer probably does not need direct access to the administration interface of the server hosting that application.

A visitor needs internet access. Their phone should not gain access to your internal file shares.

A useful design begins with these everyday requirements. It identifies the connections the business needs, then restricts unnecessary access.

Separate virtual networks only help when the rules enforce meaningful restrictions.

Your IT provider may tell you that you already have VLANs, or virtual local area networks.

That is useful information, but it should lead to another question: what traffic is allowed between them?

Imagine having separate networks for staff computers and servers, with a rule allowing every staff computer to connect to every server on every available service. The networks have different labels, but the rule still permits extensive access.

Effective separation requires controls over which systems can communicate, which services they can use and, where appropriate, who can initiate those connections.

For example, staff may need access to an application on a server without needing access to its remote administration service. The rules should reflect that distinction.

Ask for a plain-English explanation of the restrictions. A network diagram is helpful, but it should be supported by evidence that the intended boundaries work.

Guest Wi-Fi, printers and connected equipment deserve a place in the discussion.

When reviewing security, it is easy to focus on laptops and servers. Your network may also contain printers, CCTV systems, access control equipment, meeting room devices and personal phones.

These devices have different functions and security requirements. Their access should reflect those differences.

A printer may need to receive print jobs and communicate with a specific service. That does not mean it needs unrestricted access to every workstation and server.

Likewise, a guest wireless network should provide the agreed visitor services without exposing unrelated business resources. A different wireless name alone does not demonstrate that isolation has been enforced.

Consider the questions you would ask about a new laptop before applying the same thinking to other equipment. Who manages it? What does it connect to? Does it still need every connection it currently has?

For your next review, ask for an inventory that includes equipment beyond conventional computers. Then ask what each category can access.

Backup protection involves more than checking that yesterday’s job completed.

A successful backup notification is reassuring. It tells you much less about whether those backups would survive an attacker gaining control of your environment.

Consider the consequences if someone could sign into the backup console, delete recovery copies or change retention settings.

The NCSC identifies backups and administrative accounts as attractive targets in disruptive attacks. Its advice includes securing and isolating backups and regularly testing recovery.

Useful questions include:

• Can an ordinary staff computer reach the backup administration interface?
• Who can delete backups or change their retention settings?
• Would compromising an everyday IT account also expose backup management?
• Are recovery copies protected against deletion or alteration?
• Has the business tested restoring the systems it depends on?

The answers should cover both the backup copies and the systems used to manage them. Ask your provider to explain which protections would remain effective if an attacker gained administrative access elsewhere in the business.

Then walk through a realistic recovery scenario, including what happens if the normal administration accounts are unavailable or compromised.

Administrative access can turn a limited incident into a much larger one.

Some systems control many others. Examples include virtualisation platforms, network management tools and central administration consoles.

They deserve particular protection because access to them can have consequences beyond a single device.

Consider asking your IT provider to demonstrate the approved process for administering a critical server. Which device is used? Which account is required? Could the same task be attempted from an ordinary staff laptop?

The answers should reveal whether administrative access follows a controlled route or is available more widely than intended.

Password management matters too. Ask whether local administrator passwords are unique to each computer, how they are managed and who can retrieve them.

Also ask whether administrators use separate accounts for routine work and privileged tasks. A single everyday account with extensive control deserves close scrutiny.

A useful review considers both reachability and permission. Can someone connect to the administration service, and what would they need to gain control?

Being able to connect to a system does not automatically mean being able to compromise it.

A business application must be reachable by the people who use it. A file server must accept legitimate connections. Blocking every connection would stop the business functioning.

The important question is whether access is appropriate and whether the receiving system is secure.

For example, staff may need to use an application while having no reason to access its server administration service. A supplier may need remote access to one supported system without needing access to every computer.

This distinction should shape your review. “The server is reachable” is a starting observation. A useful assessment explains which services are exposed, why access is needed and whether weaknesses make that access dangerous.

It should also distinguish a confirmed route to compromise from a possibility requiring further investigation.

An internal penetration test can examine the consequences of gaining a foothold.

An internal penetration test can start from an agreed position within your environment, such as access equivalent to a connected workstation.

The tester investigates what is reachable and whether weaknesses could be combined to gain further access.

For this scenario, the agreed work might examine:

• Connections available from a normal staff network.
• Access to sensitive servers and administration interfaces.
• Weaknesses in authentication, permissions or system configuration.
• Opportunities to move between devices.
• Whether intended network restrictions are effective.

A useful report explains the business implications of the findings. It should make clear what was demonstrated, what access was required and which improvements would interrupt the identified route.

Testing also has limits. One starting position does not represent every network, location or user role. If you want assurance about guest Wi-Fi, supplier access or a separate office, include those areas in the scope.

A firewall rules review answers a related question.

A firewall rules review examines whether configured access matches what the business currently requires.

An internal penetration test investigates what can be achieved from the agreed testing position.

Used together, they can help compare intended restrictions with observed behaviour.

For example, a review might identify an old rule allowing a broad range of connections. Testing could then establish whether that access exposes services with exploitable weaknesses.

The review should also give you something maintainable: a clear reason for necessary exceptions, ownership of important rules and a process for reconsidering them when systems change.

This is particularly useful when your network has grown through office moves, acquisitions, supplier changes or replacement systems.

You can start with a focused conversation.

You do not need to understand every firewall setting to ask useful questions.

Begin with your most important business services. Which systems support them? Who needs access? What would happen if they became unavailable?

Then ask your IT team or provider:

1. What could an attacker reach from an ordinary staff laptop?
2. Which controls protect backup and infrastructure administration?
3. How is guest and connected-device access restricted?
4. When were these restrictions last tested?
5. Which improvements would most reduce the consequences of a compromise?

Ask for evidence appropriate to the answer. That might include a current diagram, an explanation of access rules, test results or a record of a recovery exercise.

These questions give you a basis for deciding what to investigate and where to spend money.

Make improvements in a way the business can sustain.

Start by agreeing which systems matter most to the organisation. For a solicitors’ practice, that discussion might focus on case management and client documents. For a manufacturer, it might include production systems alongside the usual office services.

Ask your provider to propose a manageable sequence of improvements, with the expected business benefit of each change.

Avoid making broad access changes without understanding what relies on them. A restriction that unexpectedly breaks payroll, printing or a production application may quickly be reversed.

For each proposed change, identify an owner, confirm the required connections and agree how success will be checked. Review the result after implementation.

The same discipline should apply when new systems arrive. Security boundaries need to remain useful as the business changes.

At Plainsight Security, we help organisations investigate these questions through internal penetration testing and firewall rules reviews, with clear reporting and practical remediation advice.

If you are unsure what one compromised laptop could expose, get in touch. We can help establish where the risks lie and which changes would make the greatest difference.