What Happens to a Laptop After IT Hands It Over?

At handover, a business laptop starts from a known state. Antivirus is installed, updates are current, security settings are applied, and IT knows who the device belongs to.

What becomes harder is keeping that state consistent as the device is used.

A Few Months In: An Update Gets Skipped

The laptop prompts for a restart to install updates. The employee is in the middle of something and clicks "remind me later." This happens a few more times over the following weeks.

Nothing unusual has happened here. But the device is now behind — and it stays behind until something forces the issue, because postponing an update is easy and reviewing which devices are still outdated is a task someone has to actively do.

Antivirus is still running the whole time. It has nothing to say about this.

Later: Temporary Admin Rights Stay Behind

The employee needs to install a tool for a project. IT grants local administrator rights to make the install possible, intending it as a temporary fix.

The project ends, but the admin rights can remain unless the end of the project also triggers a permissions review.

Some time later, that account can still install software, change configurations, and modify settings a standard user account couldn't touch. Whether that access is still appropriate depends on the employee's current responsibilities — and whether anyone has reviewed it since the project ended.

As Work Patterns Change: The Device Stops Checking In

The employee moves to a hybrid schedule and starts working from home several days a week.

The issue is not where the employee works. It is whether the device is still checking in with the systems IT relies on to manage it. If management, updates or policy enforcement depend on the device connecting through a particular network, VPN or management service, missed check-ins can gradually reduce IT's visibility into its current state.

The laptop still works fine. The antivirus still shows green. But if you asked "is this device still fully managed right now," the honest answer would take some digging to confirm.

Then the Laptop Is Lost

A lost laptop is an obvious endpoint risk. But by this point, the loss may simply expose problems that had already been building.

Is the device still checking in, so it can be remotely locked? Is the local admin account still active, and does that change what someone could do with it? Is the software current enough that known vulnerabilities aren't sitting there unpatched? Are the employee's cloud sessions still tied to that device, and can they be cut off?

A laptop that had been kept current, reviewed for excess privileges, and consistently visible to IT is a very different kind of loss than one that had quietly drifted. It is the point where earlier weaknesses in patching, access and device management can suddenly matter much more.

The Pattern

None of these moments involved malware. None of them would have shown up as an antivirus alert. Each one, on its own, looked minor enough to leave alone.

The pattern is not necessarily one major failure. It can be an accumulation of small changes that are never revisited.

Antivirus can detect and block many forms of malicious activity. What it cannot tell you on its own is whether the device is fully patched, appropriately configured, still centrally managed, or carrying privileges it no longer needs.

Endpoint protection is not a one-time setup. The challenge is keeping the device patched, appropriately privileged, visible and manageable as its state changes over time.

For how endpoint protection fits alongside identity, network security and backup as part of a business's overall exposure, see our business cybersecurity guide.