The Coffee Shop Test: Could Your Business Operate Securely From Anywhere?

Imagine asking your team to leave the office tomorrow morning and work from wherever they choose.

One employee settles into a coffee shop. Another works from a hotel before a client meeting. Someone else logs in from home, while a colleague travelling abroad needs access to the same cloud applications and company data.

Could everyone work normally without creating security gaps?

That is the coffee shop test. It is a useful way to examine whether a company’s security depends too heavily on people being inside a controlled office environment or whether protection genuinely follows employees wherever work happens.

Start With the Network You Do Not Control

Office networks give IT teams considerable control over connectivity, firewalls and security policies. The moment an employee opens their laptop in a coffee shop, much of that certainty disappears.

Public and shared networks should therefore be treated as untrusted environments. Employees still need to reach email, SaaS platforms, internal applications and cloud resources, but the network they are using should not determine whether those connections are adequately protected.

A stronger model assumes that users will regularly connect from networks the business neither owns nor manages.

SASE security is designed around this distributed reality. By bringing networking and security capabilities into a cloud-delivered architecture, organizations can extend policies and protections beyond the traditional office perimeter.

The same principle applies to access. An employee should not automatically become trusted because they are sitting inside headquarters, while working from a café should not prevent a legitimate employee from reaching the resources required for their job.

Instead, businesses can consider factors such as identity, device, location and the resource being requested. Access can then be limited to the applications someone genuinely needs rather than providing broad visibility across the corporate environment.

Find Out Whether Security Travels With the Employee

The coffee shop test is ultimately about consistency.

Ask what happens when an employee leaves the building. Does web filtering still apply? Can malicious destinations still be blocked? Are access policies enforced? Can unusual activity still be identified?

If important protections disappear as soon as somebody leaves the office, hybrid working can create an uneven security environment.

The device itself also needs consideration. A laptop used in a coffee shop may contain locally stored information, saved credentials and authenticated sessions for numerous business platforms. Losing that device or allowing it to become compromised could expose far more than the files stored directly on it.

Businesses therefore need to consider the complete journey between the employee and the application. Device management, encryption, authentication, endpoint protection, network security and access controls all contribute to that journey.

Usability matters too. If secure remote access is painfully slow or complicated, employees may look for shortcuts. The strongest security model is one that can protect normal activity without continually interrupting it.

Ideally, the employee’s experience should be uneventful. They connect their managed device to the internet, authenticate when required and access authorized applications. Behind the scenes, the organization continues applying its security policies regardless of whether that employee is at headquarters or sitting beside a coffee machine several hundred miles away.

What Would the Coffee Shop Test Reveal About Your Business?

The purpose of the test is not to encourage everyone to abandon the office. It is to expose security assumptions that may no longer match how the organization actually operates.

Take one typical employee and imagine their entire working day happening away from the corporate network. Consider how they authenticate, which applications they can reach, how their connection is protected and what happens if their credentials or device are compromised.

Then repeat the exercise for different roles. A contractor should not necessarily have the same access as a permanent employee. An administrator may require stronger controls because of their privileges. A senior executive travelling regularly may create an entirely different set of access scenarios.

This exercise can reveal an important distinction between remote access and secure work from anywhere. The first simply allows somebody outside the office to connect. The second considers whether the organization can maintain appropriate protection, visibility and control throughout that connection.

A business that passes the coffee shop test is not one that blindly trusts employees to work from anywhere. It is one that no longer depends on a particular building, network or desk to provide its strongest layer of protection.

Wherever work happens, the fundamental principles should remain consistent: verify who is requesting access, consider the device and context, protect the connection and limit users to the resources they genuinely need.