For U.S. federal agencies, hybrid work reshapes the security landscape in two main ways:

• Device proliferation: More people are working on more devices, using a wider range of applications. Every laptop, tablet, or endpoint becomes a potential entry point for cybercriminals. As endpoint numbers grow, many IT leaders expect cyberattacks to accelerate because the attack surface is expanding.
• Off-network access: Staff are no longer always on a closed, agency-controlled network. They routinely connect via home internet or even public Wi‑Fi to reach agency systems. This increases the risk of lost or stolen devices and makes it harder to maintain consistent protection and monitoring.

Survey data from HP’s 2022 study of 984 IT leaders in hybrid organizations shows that:

• Nearly two-thirds agree that compromised hybrid workers pose the greatest cybersecurity threat.
• Many find it challenging to keep threat detection aligned with changing hybrid employee behavior.

In short, hybrid work requires agencies to rethink how they secure endpoints, data, and user access beyond the traditional perimeter.

Agencies can build a more resilient hybrid workplace by combining several complementary security tools and approaches:

• Endpoint Detection and Response (EDR): Monitors activity on user devices, raises alerts on suspicious behavior, and can automatically contain threats before they spread.
• Cloud Access Security Broker (CASB): Manages and controls access to cloud resources, simplifying access for legitimate users while blocking unauthorized or malicious activity.
• Application isolation: Runs high‑risk activities (like opening unknown attachments or browsing untrusted sites) in temporary virtual containers, so threats are contained away from the core system.
• Next‑generation antivirus: Uses AI and machine learning to spot anomalous endpoint behavior and stop threats that traditional signature-based tools might miss.
• File Integrity Monitoring (FIM): Continuously scans critical files, systems, databases, and applications to detect unexpected changes that may indicate compromise.
• Security Information and Event Management (SIEM): Collects and analyzes security data from across the environment, helping teams detect threats, manage incidents, and demonstrate compliance.

These tools help agencies reimagine endpoint and data protection so that security can keep pace with how hybrid employees actually work—across multiple devices, locations, and networks.

Zero trust and federal cybersecurity programs give agencies a framework to secure hybrid work more effectively:

• Zero trust architectures: As HP’s Alex Thatcher notes, agencies are moving away from simply limiting network access and toward architectures that enable both security and flexibility for hybrid workers. Zero trust assumes no user, device, or application is trusted by default—access is continuously verified based on identity, device health, and context.
• National Cybersecurity Protection System (NCPS): The U.S. Cybersecurity and Infrastructure Security Agency (CISA) operates NCPS to help combat and mitigate cyberthreats to the Federal Civilian Executive Branch. This provides shared capabilities and threat intelligence that agencies can align with their own endpoint and data protection strategies.

By combining zero trust principles with federal guidance like NCPS, agencies can rethink how they protect users and data across office, home, and public networks, while still meeting compliance and mission requirements.