How Businesses Secure Lost and Stolen Devices
A practical framework for reducing risk when company laptops are lost, stolen, or never returned.
A practical framework for reducing risk when company laptops are lost, stolen, or never returned.
Lost and stolen devices are one of the most common — and underestimated — security risks facing modern organizations.
When a company laptop goes missing, the real question isn’t just Where is it? It’s:
What can that device still access?
In a distributed workforce, device loss isn’t a rare failure — it’s an operational certainty. Laptops are left in airports, stolen from cars, kept by departing employees, or simply never returned. The difference between a minor inconvenience and a reportable security incident comes down to how quickly and effectively risk is contained.
Effective device security controls ensure that hardware loss does not become organizational risk by combining visibility, verified encryption, and immediate containment.
Modern work is mobile by default. Devices leave offices, networks, and countries every day. They’re used in homes, airports, coffee shops, hotels, and shared workspaces. They’re handed to new hires, shipped to contractors, reclaimed late—or not at all.
Even with the best policies:
At small scale, these events feel rare. At fleet scale, they’re inevitable.
If you manage devices, you will lose devices. Security depends on how well devices were prepared before loss — and how decisively you act after.
Device tracking is often the first control teams think of—and for good reason. Tracking provides essential visibility, including:
Tracking answers where a device is and when it was last seen. That information is useful for recovery efforts, compliance, and reporting.
But tracking alone does not:
Device tracking is an effective operational and investigative tool, but actual loss mitigation requires additional capabilities and preparation by IT teams.
To prevent a lost device from becoming a breach, three capabilities must work together.
Visibility provides awareness. It helps teams confirm loss, understand exposure, and coordinate next steps. Without visibility, response is blind and reactive.
But visibility alone doesn’t enforce outcomes. It may tell you what happened, but can't help you prepare for breaches or respond to incidents.
Tracking is necessary—but insufficient.
Full disk encryption (FDE) is non-negotiable. A lost device without encryption is not an incident—it’s a breach.
That said, encryption only protects you if:
“Encryption enabled” is not the same as “encryption assured.” Unknown or stale encryption state creates risk, especially when devices are offline or unmanaged for long periods. Attempts to encrypt storage after a device goes missing are too late and usually unverifiable.
Encryption is the first line of defense for data at rest. It must be reliable, continuous, and provable.
This is where most environments are tested.
When a device is lost, response assumptions must shift immediately. Teams should assume:
Effective device loss mitigation requires clear incident response capabilities that reduce exposure quickly and predictably — even when connectivity is uncertain.
Secure Containment means immediately limiting what the device can access and reducing organizational risk after trust is broken. The specific mechanisms for achieving that level of control are explored in detail in our Secure Containment guide.
Mobile Device Management (MDM) platforms are a popular tool available to modern IT teams. They excel at:
But MDM wasn't designed for incident response.
In loss scenarios:
MDM manages devices.
Secure Containment manages risk after control is lost.
The two are complementary—but not interchangeable.
Tether is built around a simple assumption: device loss is inevitable.
Instead of optimizing for ideal conditions, Tether focuses on what matters when things go wrong:
Rather than relying on delayed commands or destructive actions, Tether is designed to reduce risk the moment a device is no longer trusted.
Mitigation isn’t about destruction. It’s about containment.
Traditional tracking-first tools focus on device recovery and treat the hardware as the primary asset, when in reality the data carries the greatest value, risk, and liability.
Other solutions tend to offer remote wipe features that delay effective action and offer a false sense of security. They also disregard important realities about security incidents:
RemoteKill® Secure Containment operationalizes device loss response by containing data immediately, preventing exposure, and allowing hardware to be written off if needed. It’s proactive, safe, and aligned with business risk priorities.
While the risks of device loss are universal, how they surface depends on scale.
Informal processes break quickly. Manual tracking and ad hoc response don’t scale, and a single lost device can have outsized impact.
Travel, growth, and employee churn increase exposure. Inconsistent response across teams creates gaps that are hard to audit or defend.
Loss mitigation becomes a governance issue. Consistency, auditability, and insurance expectations require predictable, enforceable controls across regions and business units.
At every size, the principle is the same: assume loss, design for containment.
You can’t prevent every device from being lost.
But you can decide whether loss turns into risk.
Effective response isn’t about chasing down missing laptops. It’s about controlling what that laptop can—and cannot—do once it’s gone.
Schedule a conversation to assess your current controls and determine whether your organization can confidently mitigate lost or stolen device risk.
Request a Security AssessmentStand up a proof-of-concept within minutes, or book a demo with one of our IT experts.
.jpg){kind=spacer}
.png){kind=tracking}