Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In the UK, workplace monitoring rules are changing quickly as the Information Commissioner’s Office (ICO) releases new guidance following the passage of the Data (Use and Access) Act 2025. Since the Act came into effect, UK companies have had to comply with strict legal limitations on employee privacy because of the ICO’s guidance concerning work-related monitoring. What should be done to ensure that employee monitoring laws are valid?

In 2026, enterprise computing will be largely consolidated and centralized, and organizations will be shifting away from the one-user-per-PC model towards shared, multi-user virtualization technologies like AVD, Citrix Virtual Apps and Desktops, and Microsoft Remote Desktop Services (RDS).

For years, employers assumed that owning the laptop and the network meant unlimited monitoring rights. In 2026, that assumption no longer holds. Federal wiretap law, state biometric statutes, all-party consent requirements and the EU Artificial Intelligence Act each limit what an employer can collect and how. Most workplace surveillance software must weigh the competing goals of safeguarding corporate resources and respecting employees’ right to privacy.

Today, laptops are rarely connected to the corporate network – more often they’re connected to wifi at home, mobile wifi on the road, and a coffee shop hotspot the IT team never set up. Office perimeter firewalls have nothing to analyze when the device leaves the building, and cloud DNS filtering doesn’t work unless the DNS traffic actually reaches the cloud. That’s why more IT teams are moving web filtering to the device itself.

Hybrid and remote work have forever changed the way organizations structure their approach to people, technology, and performance. In Gallup’s 2026 Workplace Indicators, 52% of U.S. employees who can work remotely are in a hybrid model, and 26% are fully remote. As distributed work is here to stay, organisations need a trusted way to understand how employees use business applications, access resources, and do their work, without turning the workplace into a surveillance operation.

The corporate security perimeter has changed. An employee’s company laptop could easily arrive at work on a Monday morning connected to a home Wi-Fi network, then land in a hotel or workspace at noon on a Tuesday and work away from a hotspot on Wednesday. That leaves corporate data outside the reach of traditional IT and security controls.