Back to the office: how september widens the attack surface

For many organizations, September marks the return to business as usual. After weeks of reduced activity, offices pick their pace back up, projects restart, new employees join, and the volume of communications and requests increases. Devices that had been powered down reconnect to corporate networks, and IT departments face an extraordinary volume of incidents within just a few days.

The return to the office therefore involves more than simply resuming routine. The transition back concentrates a series of technical, human, and organizational changes that can temporarily widen an organization's attack surface: devices with a backlog of pending updates, outdated software, accumulated emails, forgotten credentials, new accounts and permissions still to be configured, and a spike in support demand.  

The risk does not arise from each element in isolation, but from the interaction between all of them during a transition period marked by simultaneous changes in technology, processes, and personnel: a device reconnecting without the latest patches installed, an employee quickly responding to fraudulent email among dozens of pending messages, or new account with excessive permissions can all become entry points for an attacker.

The security of the return to the office therefore depends on how this transition period is managed.

What are the points to watch?
 

During periods of lower activity, many devices remain switched off or are only used occasionally. When powered back on, they may have a backlog of operating system updates, unpatched applications, or security tools that need to refresh their signatures, configurations, or detection capabilities. INCIBE specifically points to the return to work as a good moment to review the updates that piled up over the summer, noting that they may fix critical vulnerabilities.

The problem is not simply that a device may run more slowly or temporarily reduce productivity. Every pending update keeps a known vulnerability open while the device reconnects to the corporate environment.

The situation can worsen when installed software has fallen out of date or devices are no longer supported. The organization may then face a combination of operational and security problems: slower machines, incompatible applications, and systems requiring technical intervention right when internal demand is spiking.

For this reason, the return to work should include an upfront review of devices coming back online. Updating systems, applications, and security tools helps reduce part of the exposure before devices are fully back in operation.

A computer that is switched back on does not necessarily return to the same security level it had at the end of its last working day.
 

LThe attack surface also shifts when users return. After several weeks away, an inbox can hold dozens of pending messages, along with new requests from clients, vendors, and colleagues.

This context introduces an additional element: urgency. The need to quickly get back up to speed can make a user more likely to open a file, click a link, or respond to a request without running the usual checks.

Tactics such as phishing or various forms of Business Email Compromise (BEC), like CEO fraud, exploit precisely this situation. Fraudulent messages relating to expired passwords, service renewals, outstanding invoices, shared documents, or access or payment requests can slip in among legitimate ones. The goal ranges from harvesting credentials to installing malware or getting the user to carry out a specific action. In this context, the pressure to quickly return to normal activity levels becomes a social engineering lever.

The return to the office therefore also requires reviving security habits: checking the sender, verifying links and attachments, treating unusual requests with suspicion, and confirming through an independent channel any operation involving money, credentials, or sensitive information.

September also brings a concentration of new hires, interns, vendors, and external collaborators. From a digital standpoint, each new person represents a new identity that must be created, configured, and protected.

The organization must provision accounts, devices, applications, and permissions during a period when the priority is usually getting the new employee working as soon as possible. The speed of onboarding can create tension between accessibility and security.

Likewise, granting a user more privileges than necessary, keeping accounts active after a contractual relationship ends, or failing to periodically review access rights unnecessarily widens the organization's exposure.

This issue becomes even more significant when combined with credential theft. A compromised password can grant access to a legitimate account and initially let an attacker operate without triggering the same alerts a completely unknown access attempt would raise.

Identity management must therefore go hand in hand with the return to work. Reviewing users and permissions, applying the principle of least privilege, and using mechanisms such as Single Sign-On (SSO) and multi-factor authentication (MFA) help reduce exposure. Implementing MFA is especially recommended for corporate email, VPN access, critical applications, and privileged accounts.

 

The return to the office also generates a concentration of seemingly minor incidents: forgotten passwords, locked accounts, application access issues... Each of these incidents requires resources, and when they occur simultaneously across many users, they can create a spike in demand on IT and support departments.

This phenomenon introduces a less visible security dimension. Technical resources are limited, and time spent resolving these issues is time not spent reviewing vulnerabilities, monitoring systems, or analyzing alerts.

The consequence need not be a deliberate reduction in security. It can simply result from the temporary shift of resources toward restoring normal operations. For this reason, tools that simplify identity management also serve an efficiency function, helping to reduce reliance on manual processes and lower the volume of incidents.

The return to on-site work does not mean remote access disappears either. Many employees keep hybrid arrangements or continue working from hotels, airports, cafés, or other public spaces during travel and the first days back.

These situations can introduce additional threats: connections to untrusted Wi-Fi networks, devices used outside the corporate environment, sessions left open in public spaces, or remote access carried out from machines that do not meet the same controls as managed devices.

Remote access deserves particular attention because it directly connects the external environment to internal systems. During September, the attack surface extends well beyond the office.

The return to work offers an opportunity to carry out a coordinated review of the main points of exposure.

• Review updates. Check operating systems, applications, firmware, and security tools, prioritizing critical and known-exploited vulnerabilities.
• Verify backups. Confirm that backups are running correctly and can be restored. Critical backups should stay protected against a potential system compromise. It is recommended to keep offline copies and regularly test their availability and integrity.
• Review users and permissions. Check active accounts, new hires, administrative privileges, and access for employees or vendors who no longer need certain permissions.
• Strengthen identity management. Extend SSO, password managers, and MFA to email, VPN, critical applications, and privileged accounts.
• Audit exposure. Review internet-facing services, outdated devices, configurations, and vulnerabilities before they can be exploited.
• Review remote access. Check VPNs, authorized devices, and access policies for employees who continue working from external locations.
• Reactivate awareness. Remind staff of the main warning signs of phishing, CEO fraud, and malware, and establish clear channels for reporting suspicious messages or behavior.

The return to the office does not begin when an employee switches on their computer. For security, it begins much earlier. September is an opportunity to carry out a coordinated review of people, devices, identities, access, and systems before activity is fully back up to speed. It is not just about checking that everything works. It is about checking that everything that reconnects, gains access, and starts operating again does so securely.