Why Device Security Can’t Be Treated as “Set and Forget”

• Share on
• 
• 
• 

A recent Cybernews report revealed a Windows exploit capable of bypassing BitLocker encryption on certain devices. And while that’s not a reason to ditch BitLocker, it’s certainly worth asking, then, whether your device security goes far enough. 

Many SMEs assume that once BitLocker is switched on, the job is done. In reality, a locked-down drive still leaves your business exposed if:

• Passwords are weak or reused
• Security updates are being missed
• Admin rights are more generous than they need to be
• Recovery keys are stored carelessly (or not stored at all)
• There’s no process for a lost or stolen laptop

This article covers what BitLocker actually protects, where the real gaps tend to be, and what good device security looks like in practice for a small business. 

What BitLocker actually does

BitLocker is Microsoft’s drive encryption tool. It scrambles the data on a device so it can’t be read if the laptop is stolen, removed from service, or physically accessed without authorisation.

A lost laptop might contain client documents, financial files, HR records, cached cloud files, or email access. Without encryption, that’s a data breach waiting to happen.

BitLocker helps reduce that risk, but only when it’s properly set up and managed. A single laptop with BitLocker toggled on is different from BitLocker policies managed centrally through Microsoft Intune, with recovery keys stored securely and device compliance actually monitored.

Pro Tip: Don’t just assume BitLocker is on. Go to Settings > Privacy & Security > Device Encryption to confirm. Better still, if you’re using Microsoft 365 Business Premium, Intune lets you verify encryption status across every enrolled device from one place.

What BitLocker doesn’t do

BitLocker protects the drive. It doesn’t protect every route into your business.

An encrypted laptop can still have:

• Weak passwords and no multi-factor authentication
• Missed security updates
• Outdated antivirus
• Unnecessary admin rights
• Active access to company systems from a compromised account

If a phishing email tricks someone into giving away their password, or if that password is stolen and the device is still signed in, encryption won’t solve the problem.

This is why device security needs to cover the device, the user account, the software, the data, and what happens when something goes wrong.

Picture courtesy of Pexels

Common gaps in SME device security

Most device security problems come from small gaps that build up over time. Here are the ones that actually cause damage.

Unmanaged devices

You should know which laptops exist, who uses them, whether they’re encrypted, and what company data they can access. Without that visibility, you’re guessing when something goes wrong.

No patching routine

Security updates fix known weaknesses in Windows, browsers, apps, and drivers. If those aren’t applied consistently, the device is exposed while it’s being used, not just if it’s lost.

Staff using admin accounts

If that account is compromised or accidentally infected, the attacker may get more control than they should. Everyday work should happen on standard user accounts.

Recovery keys stored badly

BitLocker recovery keys should be stored centrally and securely, not scattered across emails or spreadsheets. If they’re lost or insecure, the protection weakens.

No remote lock or wipe

If a laptop goes missing, you need to be able to lock it, wipe company data, revoke access, and reset passwords quickly. If that’s not set up beforehand, your options are limited once the device is gone.

Offboarding that misses details

When someone leaves, the business needs to remove account access, check what data is stored locally, and properly wipe or recover the device. Old devices left active or tied to former staff accounts create unnecessary risk.

Pro Tip: Run a quick audit. List every company laptop, confirm who uses it, check whether it’s encrypted, and verify it’s still receiving Windows updates. If that list doesn’t exist, building it is the first step.

What good device security actually looks like

Good device security brings several controls together. For most small businesses, that means a standard setup for every company device rather than making decisions laptop by laptop.

• Drive encryption. Every business laptop should have BitLocker enabled, checked (not assumed), with recovery keys confirmed and stored securely.
• Multi-factor authentication. MFA adds an extra verification step at sign-in. If a password is stolen, MFA stops the attacker getting in. For Microsoft 365 accounts, it should be on by default.
• Endpoint protection. Detects and blocks threats on laptops while they’re in use: malware, suspicious behaviour, unsafe files. Needs active monitoring and regular updates.
• Automatic updates. Windows, browser, and app updates should happen routinely, not left to individual users. Set a policy, automate what you can, and check which devices are falling behind.
• Restricted admin rights. Most staff don’t need admin access. Keeping users on standard accounts reduces damage if an account is compromised or a malicious file is opened.
• Device inventory. Accurate records of which laptops belong to the business, who uses them, whether they’re encrypted, and whether they’re still receiving updates.
• Tested backups. A backup that hasn’t been successfully restored is still partly a guess. Know what’s being backed up, how often, and confirm recovery actually works before you need it under pressure.

Pro Tip: Security Defaults are a quick way to improve MFA across Microsoft 365. Go to Entra ID > Overview > Properties > Manage security defaults and set them to Enabled. If you’re on Business Premium, Conditional Access gives you more control over when and how MFA is applied. 

If a laptop goes missing

Speed matters. Work through this checklist as soon as the device is reported missing.

• Report it immediately. The staff member should say when they last had it, where it may have been lost, whether it was unlocked, and what sensitive data it contained.
• Lock or wipe the device. If the laptop is enrolled in a device management system, your IT provider may be able to lock it, wipe company data, or remove access remotely. This is why enrollment needs to happen before the device goes missing.
• Reset passwords and revoke access. Change the user’s passwords for Microsoft 365, email, and any business-critical systems. Revoke active sessions where possible.
• Check account activity. Look for unusual sign-ins, failed login attempts, new forwarding rules, or suspicious file downloads. This tells you whether the incident is just a missing device or whether someone accessed company systems.
• Identify what data was involved. Customer details, contracts, payroll files, saved browser data, or synced cloud files all matter for legal and reputational reasons.
• Record what happened. Keep a written record of the date, device details, actions taken, and follow-up required. This helps with insurance, clients, and internal review.
• Review what needs to change. Was the device encrypted? Could it be locked or wiped remotely? Were updates active? Did the business respond quickly? If anything felt slow or uncertain, the setup needs work.

How Operum.Tech can help?

If you’re not sure whether your current device security setup is working properly, we can help.

Operum Tech works with small businesses to review device encryption and recovery key storage, tighten Microsoft 365 security, set up endpoint management, check that backups actually restore, and build clear processes for onboarding and offboarding staff.

Call us on 0800 389 6798 or send us a message to get started.