There is something I have been noticing for a while now, and it has become so normal in most workplaces that people barely pause to question it anymore. You start a new job, or you land a contract, and very quickly, the expectation is simple: just use your own laptop. Log in, get set up, and carry on. It sounds efficient, even harmless on the surface, and in many environments it is treated as the obvious default.

But every time I come across it, I find myself sitting with the same discomfort, because from a cybersecurity point of view, it is never really just “a laptop”, it is an entire personal environment that has nothing to do with the organisation you are now working for, and yet it is being pulled directly into that space without much conversation around what that actually means.

I have never really been comfortable with it, and I say that not from a place of paranoia or overthinking everything, but from a very practical mindset. In most of the corporate environments I have worked in, I have made it a personal rule that I will use a system provided by the organisation. A company laptop, a company email address, company-managed access, and even company-provided Wi-Fi, where that is part of the setup. If I am working through an agency for a client, then I keep that work on a separate device entirely. There is a clear boundary between environments, and that boundary is not just about security policy on paper; it is about how I choose to structure risk in my own working life.

And I think what bothers me most is not that people sometimes use personal devices for work, but that it has become so normalised that we barely ask whether it should be normal in the first place. It is often framed as flexibility or speed. Sometimes it is cost-saving. Sometimes it is just “how things are done here”. You join a team, and before anything else is even properly set up, you are already in your inbox or dashboards from a personal machine. Nobody really stops to break down what is being introduced in that moment, because it feels small and convenient and temporary, except it rarely stays temporary.

From a cybersecurity perspective, that convenience hides a lot. A personal laptop is not a controlled environment. It carries everything: personal downloads, browser history, extensions installed over time, software added casually, old files, and sometimes even shared usage in households. It is an environment shaped by habits that have nothing to do with organisational risk appetite. When that same device is used to access corporate systems, you are effectively collapsing two very different risk domains into one space, and pretending that nothing meaningful has changed.

People often assume endpoint security tools or browser policies are enough to bridge that gap, and in some cases, they do help, but they do not change the underlying reality that the organisation no longer fully owns or controls the environment in which its data is being accessed. And that matters, especially in industries like cybersecurity where we spend so much time talking about least privilege, attack surfaces, insider threat, and access control. It feels slightly ironic that the same principles are sometimes softened the moment convenience enters the picture.

I don’t think this is always done out of negligence. In fact, most of the time it is not. It usually comes from very ordinary constraints. Smaller teams want to move quickly. Startups don’t always have procurement processes ready on day one. Some organisations assume employees already have “good enough” devices. Others simply don’t prioritise the friction of issuing hardware because it slows onboarding. All of that is understandable on a surface level, especially when the focus is on getting work done and not getting stuck in setup processes.

But what tends to happen is that temporary decisions quietly become permanent culture. What starts as “just for now” becomes the default. And once it becomes the default, people stop questioning it altogether. That is usually where risk settles in, not in dramatic incidents, but in habits that were never properly examined.

There is also another layer that people don’t often talk about, which is ownership and accountability. When something goes wrong on a personal device that is being used for work, the lines become blurry very quickly. Was it a personal application? A work-related action? A shared network issue? A compromised browser extension? Incident response becomes more complicated not because the technology suddenly became advanced, but because the boundaries were never clearly defined in the first place. And in security, ambiguity is rarely helpful.

I also think about the individual in this setup. It is easy to focus on organisational risk, but there is also personal exposure. When your personal machine is tied into corporate access, your own digital life becomes part of a wider attack surface. That is not a comfortable thought, but it is worth saying plainly. The separation between “my device” and “work device” is not just a policy preference; it is a way of containing impact when things go wrong. And things do go wrong, even in well-run systems.

If I am being completely honest, my position on this has become quite simple over time. I don’t see it as something that needs to be debated endlessly in abstract terms. I see it as a boundary issue. If an organisation is serious about its systems, its growth, its data, and its risk posture, then part of that seriousness should include owning the environment in which that data lives during work hours. Not outsourcing it to convenience.

And I know what the counter-argument is. People will say it slows things down, or it is expensive, or it is unnecessary overhead for certain roles. And yes, in some contexts, there are exceptions. Not every task carries the same sensitivity, not every environment has the same maturity, not every organisation has the same resources. But when something becomes the default across the board, without even a conversation about trade-offs, that is usually where I start to question it.

While we are very quick to talk about threats that are external, sophisticated, and evolving, sometimes the more interesting risks are the ones we quietly accept because they are convenient.

Maybe that is what I find myself circling back to. The normalisation of blurred boundaries. The way we have quietly accepted that “good enough” setup is fine, even when we know better. And how rarely we pause to ask whether the systems we are building, or working within, reflect the level of care we claim to have for security in the first place.

If I were to put it in very simple terms, and maybe this is just how I see it now after spending enough time around both people and systems, I don’t think security begins with tools or frameworks. I think it begins with what we are willing to separate, and what we are willing to keep clean. And for me, a personal laptop used for corporate work is one of those lines I don’t blur, not because I want to be difficult, but because I have seen how quickly “small conveniences” turn into long-term assumptions.

That is really all this is. A quiet preference, yes, but also a quiet refusal to pretend that convenience and control are the same thing.

That is it for today’s newsletter. Thank you for being a subscriber and a reader of the Seeker Effect. I genuinely appreciate it. If you have any questions or recommendations on the topic, please share them!

It would be helpful if you could forward or share this email with your friends, too.

See you next time, and stay alive!

Share The Seeker Effect

Connect with me 👇🏾
LinkedIn | X (Twitter) | GitHub

There is a lot of noise in the industry (whoops), and most of it isn’t actually useful. It is not surprising that I suffered from information overload when I was actively trying to get into the industry.

What is missing is clarity. Clarity about what is genuinely worth your attention, and clarity about the messier, more human side of things, how people actually build careers in this industry, how they stay relevant without burning out, and how they keep their heads when everything around them keeps shifting.

That is the gap this publication (well, Not So Linear and What Happened in Cybersecurity Last Week) is trying to close.

On one side, there are cybersecurity professionals and people orbiting the industry, who are expected to constantly adapt, specialise, and reskill, usually without anyone telling them what actually matters in the long run. Most career advice out there is rigid, linear, and far too confident for an industry that rarely works that way.

On the other side, organisations are building and selling security products into an environment where trust is hard-won, and attention is short. Important things get buried under headlines and marketing noise.

Somewhere in the middle are people who just want to think clearly.

That is who this is for.

The Seeker Effect isn’t trying to predict where cybersecurity is headed, and it is not going to chase every trend to stay relevant. What it does is slow things down, just enough to ask better questions. What is actually changing? What is just noise portrayed as urgency? How do people build something sustainable inside all of this?

That is why there are two series here, distinct but connected.

Not So Linear is for people who have moved sideways, started over, or never quite fitted neatly into a job title. People who are still figuring it out and don’t want to be made to feel like that’s a failure.

What Happened in Cybersecurity Last Week does something different from breaking news. It curates. Filters. Focuses on what actually happened and why it matters, without the drama or the pressure to react too quickly.

Together, they respond to the same problem: an industry that does not stop often enough to reflect.

I am of the belief that this industry needs better thinking. More context. More honesty about the fact that careers, products, and people are all tangled up in ways that don’t fit neatly into a framework.

If you are still here, then this is the space for you.

Welcome.

After writing Not So Linear and What Happened in Cybersecurity Last Week separately, it became clear they belong in one place. One publication. One wasp. More clarity.

The Seeker Effect will be the home for:

• Not So Linear: writing about non-linear career paths in and around cybersecurity

• What Happened in Cybersecurity Last Week: a curated summary of key security news and events

This change is about focus, sustainability, and thinking long-term, especially as I become more intentional about how I spend my time and attention.

If you are here for thoughtful career insight and clear-eyed cybersecurity updates, you are in the right place.

More soon.

Subscribe now