TL;DR:

  • The biggest risks on public Wi-Fi are not the dramatic “man in the middle” attacks — they’re unencrypted connections to internal systems and the physical risk of shoulder surfing
  • Modern HTTPS and business tools with proper TLS largely address the eavesdropping risk; the remaining attack surface is legacy internal apps and poorly configured systems that still use HTTP
  • Practical protections: a mobile data plan or personal hotspot as default, MFA on everything, and Cloudflare WARP or a business VPN as a belt-and-braces layer

What the Real Risks Actually Are

Public Wi-Fi security advice often focuses on “man in the middle” attacks — where someone intercepts your traffic on the same network. This used to be a significant threat. In 2026, it’s much reduced in practice because most web traffic uses HTTPS with TLS 1.3. An attacker sharing a coffee shop Wi-Fi network can see that you’re connecting to yourapp.com, but they can’t read the content.

The actual risks for business users on public Wi-Fi today:

Unencrypted internal systems: Many businesses still have internal tools — legacy CRM, accounting software accessed over VPN, internal wiki — that use HTTP or have self-signed certificates. If a staff member connects to these on public Wi-Fi without a VPN, the content is potentially readable by someone on the same network.

Evil twin attacks: An attacker sets up a Wi-Fi hotspot with a convincing name — “Costa Coffee” next to the real “Costa Free WiFi” — and gets users to connect. Once connected, they can serve fake login pages or intercept traffic that hits plaintext endpoints. This attack has low operational complexity and doesn’t require defeating TLS.

Unattended devices: Physical theft of a laptop or phone is far more common than network-level attacks. A bag left momentarily unattended in a coffee shop, or a laptop in a hotel room, represents a high-probability risk.

Shoulder surfing: Client data, financial information, or login credentials visible on screen in a public space. Particularly relevant in open-plan areas like airport lounges or train carriages.

Captive portal credential phishing: Hotel and airport Wi-Fi often requires login through a captive portal. Fake portals can harvest email addresses and passwords, which attackers then test against corporate systems.

Protections That Actually Help

Mobile Data as Default

For staff regularly working on the move, a business mobile data plan or a mobile device that can act as a personal hotspot is the simplest and most effective protection. Your phone’s 4G/5G connection isn’t shared with strangers. This removes the public Wi-Fi threat model entirely for most use cases.

Cost: typically £10-30/month per user on a business plan with adequate data. For staff who travel regularly, this is often the cheapest security control available.

MFA on Everything That Matters

If an attacker does capture credentials — through a fake portal, a phished login page, or credential stuffing against a business email — MFA (multi-factor authentication) stops them using those credentials alone to access systems. This applies to:

  • Microsoft 365 / Google Workspace
  • VPN or remote access systems
  • Password manager
  • Banking and financial platforms
  • Any system with customer data

TOTP apps (Authy, Microsoft Authenticator, Google Authenticator) are adequate. Hardware keys (YubiKey) are better for high-value accounts. SMS-based MFA is better than nothing but phishable.

VPN or WARP for Remaining Risk

A VPN encrypts all traffic between your device and the VPN exit point, regardless of what the underlying network does. This addresses the unencrypted-internal-systems problem and the evil twin problem simultaneously.

Options for small businesses:

  • Cloudflare WARP (free for individuals, Teams plan for businesses): Routes DNS and web traffic through Cloudflare’s network. Not a full VPN for all traffic but covers most use cases and is very low friction.
  • Cloudflare Zero Trust free tier (up to 50 users): Full VPN replacement for accessing internal business applications, with MFA enforcement at the application level.
  • Commercial VPN services (NordLayer, Perimeter81, similar): Business-oriented VPN services with central management. £5-15/user/month.

Note: Consumer VPNs (NordVPN, ExpressVPN) are not designed for business use and don’t offer the central management, audit logs, or access policies that matter for business security.

Screen Privacy Filters

Physical privacy screens for laptops (£15-40 from Amazon or 3M) narrow the viewing angle so that only the person directly in front of the screen can see the content clearly. Effective against shoulder surfing on trains and in coffee shops. Cheap and always-on protection that doesn’t require any configuration.

Automatic Screen Lock

Devices should lock automatically after 2-3 minutes of inactivity. This limits the window for physical access if a device is left unattended. Set this as a default device policy rather than relying on staff to remember.

Hotel and Business Travel Specifics

Hotel Wi-Fi: Assume hotel networks are monitored or poorly secured. The risk of another guest or the hotel’s own systems capturing unencrypted traffic is real. Use mobile data or a VPN for anything sensitive.

Captive portals: When you must use a captive portal (hotel, airport, conference), use a throwaway email address or a business alias rather than your primary business email. Don’t reuse passwords for captive portal logins.

Hotel room physical security: Laptop theft from hotel rooms is a genuine risk in many locations. Lock laptops in the in-room safe or take them with you. Enable full-disk encryption (BitLocker on Windows, FileVault on Mac) so a stolen device doesn’t expose data.

International travel: Some countries actively monitor internet traffic and specifically target business travellers. For travel to higher-risk locations, consider a travel-specific device with no local copies of sensitive data, cleaned before and after the trip. NCSC publishes travel security guidance for specifically this scenario.

Client site networks: Connecting to a client’s office Wi-Fi has different risks to a coffee shop but still isn’t your network. Use VPN as standard when connecting to your internal systems from a client site. Don’t connect your business devices to client networks that require you to install a certificate — this allows traffic inspection.

Building a Simple Policy

A sensible mobile working policy for a small business doesn’t need to be lengthy. Core elements:

  1. Default to mobile data for sensitive work when away from the office
  2. Use VPN when connecting to internal systems from external networks
  3. Lock screens when stepping away from a device, even briefly
  4. No sensitive documents on shared or public displays (meeting rooms with glass walls, coffee shop screens)
  5. Report lost or stolen devices immediately so credentials can be revoked
  6. MFA enabled on all business accounts — enforced, not optional

The NCSC’s home working and travel guidance (available at ncsc.gov.uk) provides additional detail for scenarios beyond the basics, including guidance for higher-risk travel destinations.

Most small businesses that have staff incidents involving data accessed from public locations trace them to one of two causes: a stolen device without full-disk encryption, or credentials captured through a fake portal or phishing page used against an account without MFA. Both are addressed by the controls above without requiring significant technical complexity.