Public Wi-Fi and Business Travel: What Is Actually Risky and How a VPN Helps

How worried should you be?

A decade ago, logging in on an open cafe network could expose passwords to anyone nearby using simple tools. Today the picture is better. Most websites and apps use HTTPS, so the content of your traffic is encrypted even if the network is hostile. That has removed the worst scenarios from everyday browsing.

But it has not eliminated risk. Business travellers face fake hotspots, unexpected redirections, apps that still use weak protection, settings that expose a laptop to others on the network and, often more significantly, simple loss or theft of devices. A sensible routine addresses all of these without making travel miserable.

The real risks

These are the issues worth planning for.

• Fake or evil twin hotspots with names that look like the airport or hotel network
• Captive portals that ask you to install software or enter credentials, some of which are malicious
• Devices with file sharing, remote desktop or old software exposed to the local network
• Apps or older services that do not encrypt properly or that ignore certificate warnings
• Shoulder surfing, camera-equipped onlookers and unattended devices in public places
• Charging at public USB ports, which could expose data on poorly configured devices

What a VPN does and does not do

A VPN creates an encrypted tunnel between your device and a VPN server. On an untrusted network, that hides your traffic from the local network operator and from other users, and it can protect apps that do not use encryption themselves. It also lets company systems recognise your connection if you use a business VPN.

It does not protect you from phishing, malware or a weak password, and it moves trust from the local network to the VPN provider. Choose a provider with a clear no-logging policy and independent audits where possible, and prefer a business service managed by your IT team over a consumer app that each person picks.

A practical travel routine

Before the trip, update operating systems and apps, enable full-disk encryption and make sure remote wipe or device location features are on. Back up important files, log out of accounts you do not need and carry only the data required. Consider a privacy screen filter for planes and trains.

On the road, prefer your phone's hotspot or mobile data for sensitive work. If you must use public Wi-Fi, confirm the network name with staff, connect through the VPN first, turn off file sharing and AirDrop-style features for everyone, and keep the firewall on. Do not ignore certificate warnings. Use multi-factor authentication so a stolen password alone does not give access.

After returning, reboot and update devices, review recent account activity and change any passwords you entered on unfamiliar systems.

Hotels, borders and shared devices

Never use hotel business centre computers or shared kiosks for anything that needs a login. Do not leave devices unattended in hotel rooms where possible, and use the in-room safe or a lock. When crossing borders, travel with the minimum data you need and consider a loaner laptop for higher-risk destinations, with sign-ins that can be revoked remotely.

Check your company policy and local laws regarding device searches and encryption. For high-risk travel, speak to your IT or security adviser before you go, rather than improvising at the airport.

Mobile hotspots and eSIMs

For frequent travellers, a personal hotspot from your phone, or a travel eSIM for data abroad, often beats public Wi-Fi in both speed and safety. The connection is between you and the mobile network, with no other guests on it, and no fake network to join by mistake.

Protect the hotspot with a strong password, and turn it off when not in use. Check roaming costs and your company's policy on paying for data before you leave, so that staff are not tempted to rely on free but risky networks to avoid a bill. Keeping a spare battery pack also reduces the temptation to charge at unknown public USB ports.

Policy for the team

Write a short travel security note that tells staff what is expected: use the company VPN on untrusted networks, avoid sensitive work on public computers, report lost devices immediately and never connect unknown USB devices. Pair it with technical controls, such as automatic updates, enforced MFA and remote wipe. Simple rules that fit on a phone screen are more likely to be followed than a long document.