Overview
Lost and stolen devices are one of the most common — and underestimated — security risks facing modern organizations.
When a company laptop goes missing, the real question isn’t just Where is it? It’s:
What can that device still access?
In a distributed workforce, device loss isn’t a rare failure — it’s an operational certainty. Laptops are left in airports, stolen from cars, kept by departing employees, or simply never returned. The difference between a minor inconvenience and a reportable security incident comes down to how quickly and effectively risk is contained.
Effective device security controls ensure that hardware loss does not become organizational risk by combining visibility, verified encryption, and immediate containment.
Why Device Loss Is Inevitable at Scale
Modern work is mobile by default. Devices leave offices, networks, and countries every day. They’re used in homes, airports, coffee shops, hotels, and shared workspaces. They’re handed to new hires, shipped to contractors, reclaimed late—or not at all.
Even with the best policies:
- People make mistakes
- Travel increases exposure
- Employees and contractors churn
- Devices are forgotten, misplaced, or stolen
- Bad actors will take advantage
At small scale, these events feel rare. At fleet scale, they’re inevitable.
If you manage devices, you will lose devices. Security depends on how well devices were prepared before loss — and how decisively you act after.
Visibility Helps. It Doesn’t Control Outcome
Device tracking is often the first control teams think of—and for good reason. Tracking provides essential visibility, including:
- Device location (or last known location)
- Online/offline status
- Ownership and inventory context
- Audit trails for investigations or insurance
Tracking answers where a device is and when it was last seen. That information is useful for recovery efforts, compliance, and reporting.
But tracking alone does not:
- Protect locally stored data at rest
- Revoke access to data or systems
- Prevent offline access to sensitive files
- Stop misuse of a logged-in session
- Reduce risk once physical control is lost
Device tracking is an effective operational and investigative tool, but actual loss mitigation requires additional capabilities and preparation by IT teams.
The Three Core Controls for Lost & Stolen Device Security
To prevent a lost device from becoming a breach, three capabilities must work together.
Device visibility (Device Tracking)
Visibility provides awareness. It helps teams confirm loss, understand exposure, and coordinate next steps. Without visibility, response is blind and reactive.
But visibility alone doesn’t enforce outcomes. It may tell you what happened, but can't help you prepare for breaches or respond to incidents.
Tracking is necessary—but insufficient.
Data protection (Full Disk Encryption)
Full disk encryption (FDE) is non-negotiable. A lost device without encryption is not an incident—it’s a breach.
That said, encryption only protects you if:
- It was enabled before the device was lost
- Its status is known and verifiable
- Recovery keys are properly backed up and accessible
“Encryption enabled” is not the same as “encryption assured.” Unknown or stale encryption state creates risk, especially when devices are offline or unmanaged for long periods. Attempts to encrypt storage after a device goes missing are too late and usually unverifiable.
Encryption is the first line of defense for data at rest. It must be reliable, continuous, and provable.
Incident response (Device Containment)
This is where most environments are tested.
When a device is lost, response assumptions must shift immediately. Teams should assume:
- The device may never reconnect
- Physical access may already be compromised
- Active sessions or cached credentials may exist
Effective device loss mitigation requires clear incident response capabilities that reduce exposure quickly and predictably — even when connectivity is uncertain.
Device Containment means immediately limiting what the device can access and reducing organizational risk after trust is broken. The specific mechanisms for achieving that level of control are explored in detail in our Device Containment guide.
Why MDM Isn’t Built for Device Loss Response
Mobile Device Management (MDM) platforms are a popular tool available to modern IT teams. They excel at:
- Configuration enforcement
- Policy compliance
- Provisioning and updates
But MDM wasn't designed for incident response.
In loss scenarios:
- Commands depend on device connectivity
- Enforcement timing is unpredictable
- Offline devices remain trusted by default
- Authority revocation is limited
MDM manages devices.
Device Containment manages risk after control is lost.
The two are complementary—but not interchangeable.
How Tether Secures Lost and Stolen Devices
Tether is built around a simple assumption: device loss is inevitable.
Instead of optimizing for ideal conditions, Tether focuses on what matters when things go wrong:
- Continuous visibility into device and encryption status
- Real-time control over device authority
- Immediate containment without destroying data
Rather than relying on delayed commands or destructive actions, Tether is designed to reduce risk the moment a device is no longer trusted.
Mitigation isn’t about destruction. It’s about containment.
Tether vs Tracking Solutions
Traditional tracking-first tools focus on device recovery and treat the hardware as the primary asset, when in reality the data carries the greatest value, risk, and liability.
Other solutions tend to offer remote wipe features that delay effective action and offer a false sense of security. They also disregard important realities about security incidents:
- Device recovery rates are generally low, even with location information
- Hardware is easily replaced
- Insider theft represents a significant proportion of device theft
- Remote wipe may never reach the device
- Without encryption, data is immediately exposed
Device Containment operationalizes device loss response by containing data immediately, preventing exposure, and allowing hardware to be written off if needed. It’s proactive, safe, and aligned with business risk priorities.
How Device Security Needs Change as Organizations Scale
While the risks of device loss are universal, how they surface depends on scale.
Small teams (≈20–100 devices)
Informal processes break quickly. Manual tracking and ad hoc response don’t scale, and a single lost device can have outsized impact.
Mid-market organizations
Travel, growth, and employee churn increase exposure. Inconsistent response across teams creates gaps that are hard to audit or defend.
Enterprise environments
Loss mitigation becomes a governance issue. Consistency, auditability, and insurance expectations require predictable, enforceable controls across regions and business units.
At every size, the principle is the same: assume loss, design for containment.
Lost Devices Happen. Exposure Is Optional
You can’t prevent every device from being lost.
But you can decide whether loss turns into risk.
Effective response isn’t about chasing down missing laptops. It’s about controlling what that laptop can—and cannot—do once it’s gone.
-p-800.jpg)
