Unmanaged laptops: the asset you forgot to count

Ask a fast-growing company how many laptops it has and you will usually get a confident number. Ask how many devices have signed in to company systems in the last month and the number is larger, sometimes much larger. The difference is made of personal machines, contractor laptops, old devices that were never collected, and the home desktop someone used once during a holiday.

Each of those devices holds session tokens, cached files and often saved credentials. If one of them is compromised, the attacker does not need to break into your cloud. They are already signed in.

Step 1: find out what actually exists

Do not start from the purchase spreadsheet. Start from the systems people sign in to.

• Identity provider sign-in logs show device names, operating systems and browsers for every authentication.
• Email and collaboration tools keep lists of devices with active sessions and synced data.
• Source control and cloud consoles show which machines hold tokens.

Merge these into one list and mark each device as company-owned, personal or unknown. The unknowns are the first conversation to have.

Step 2: decide the baseline

A sensible minimum for any device that touches company data:

1. Full-disk encryption enabled.
2. Automatic operating system updates, with a deadline of no more than two weeks.
3. A screen lock after a few minutes of inactivity.
4. Endpoint protection that reports to someone who reads the alerts.
5. The ability to sign out remotely and remove company data if the device is lost.

Step 3: enroll company devices properly

Use a device management platform for every company-owned laptop, ideally with automatic enrolment so new machines arrive configured. The goal is that a new hire opens the box, signs in, and the baseline applies itself.

Step 4: handle personal devices with access rules, not ownership

Most people will not accept full management of a personal phone or laptop, and they should not have to. Instead, use your identity provider's device conditions: personal devices can use webmail and chat in the browser, but cannot sync files, access source code or reach admin consoles unless they meet the baseline.

Step 5: close the loop when people leave

Offboarding is where device risk becomes real. Make device return and remote wipe part of the same checklist as removing accounts, and check the device list during offboarding rather than trusting memory.

What changes when you are done

The practical result is not just fewer risky laptops. It is the ability to answer a question that every incident eventually asks: which devices had access, and can we cut them off right now? Teams that can answer that in minutes contain incidents far faster than teams that need a day to build the list.