Out of Office, In the Open

Inside the office, your people work behind layered defenses: filtered mail, managed networks, badge readers, colleagues who notice a stranger. Then they take a laptop to an airport, a hotel, and a conference hall — and most of those layers stay home. The person remains; the perimeter does not. With the human element involved in 62% of breaches per Verizon's 2026 DBIR, travel is not a side note to human risk management. It is the week your human layer operates with the least cover.

None of this argues for grounding the sales team. It argues for treating travel the way you treat any other high-exposure activity: know the handful of attacks that actually happen, train the behaviors that defeat them, and make reporting from the road effortless.

A fake network at 30,000 feet

In April 2024, airline staff on an Australian domestic flight reported something odd: a Wi-Fi network on board that looked like the airline's own, but wasn't. When Australian Federal Police searched a passenger's luggage at Perth Airport, they found a portable access point and a trove of harvested credentials. The man had been running evil twin networks — rogue access points broadcasting trusted names — on flights and at airports in Perth, Melbourne, and Adelaide, according to reporting on the charges. Passengers who connected saw a plausible login page asking for email or social media credentials to "activate" the session. In November 2025 he was sentenced to more than seven years for a course of offending the judge called systemic, with the Wi-Fi harvesting at its center.

Two details make this case instructive rather than exotic. The hardware was commodity — a device any hobbyist can buy. And the attack never touched the airline's systems: it targeted the passengers' trust in a familiar network name, which is exactly the trust your employees extend in every lounge and hotel lobby. Security researchers are right that evil twin attacks are rare compared with email phishing — but travel is the one context that concentrates their preconditions: strangers, open networks, captive portals, and people in a hurry.

The defense is unglamorous. Managed devices should reach the internet through an always-on VPN and keep auto-join disabled for open networks. Travel-heavy roles should default to phone hotspots. And one rule is worth drilling until it is reflex: a Wi-Fi login page that asks for your corporate password is an attack, every time.

The conversation is the collection

The cheaper attack at any conference does not need hardware at all. Elicitation — drawing out sensitive information through apparently casual conversation — is a technique the FBI considers serious enough to publish a dedicated guide on, cataloging methods like deliberate false statements that invite correction, flattery that invites expansive answers, and quid pro quo disclosures that make matching candor feel polite.

Conferences are elicitation's natural habitat. Attendees wear their name, employer, and role on a lanyard. Talking shop with strangers is the point of the event. Alcohol, long days, and the professional urge to sound knowledgeable do the rest. A competitor or intelligence collector does not need to breach your network to learn your roadmap, your vendor stack, or which team just lost its lead engineer — they need twenty minutes at a booth with someone who likes explaining things.

Nobody at the venue will phish your employees. They will befriend them — and the information will be volunteered, not stolen.

The countermeasure is a pre-briefed boundary, not paranoia. Before the event, teams agree on what is public, what is internal, and what is off-limits — so nobody improvises the line mid-conversation. Afterward, odd conversations get reported the same way phishing emails do; a logged "someone kept steering toward our deployment setup" is often the first visible trace of targeted reconnaissance. A social engineering tabletop exercise that includes a friendly stranger at a conference booth teaches the pattern faster than any policy PDF.

Proximity attacks: the physical layer

The rest of travel risk is physics: strangers, close together, with your screens and devices in view.

Honesty matters on this list, because travel advice is where security guidance most often slides into theater. Juice jacking is a good example: the FBI's Denver office and the FCC have both warned against public charging stations, and the underlying weakness is real — USB carries data as well as power. But confirmed in-the-wild cases are scarce, and modern devices prompt before accepting a data connection. Tell employees the truth: this one is unlikely, the defense costs nothing, carry an adapter. Credibility spent on inflated threats is credibility you will not have for the likely ones. CISA's travel guidance makes the same trade: boring, high-yield basics — updated devices, disabled auto-connect, locked screens — ahead of exotic scenarios.

The likely ones, meanwhile, increasingly arrive on the phone itself. In Verizon's 2025 Mobile Security Index, 85% of organizations said mobile attacks were increasing — and among those that run smishing simulations, 39% watched up to half their employees tap a malicious link. A traveler who books, boards, expenses, and authenticates by phone, while reading texts from airlines, hotels, and ride services they genuinely expect, is the easiest smishing target your org produces all year.

A travel playbook that fits on one page

Before the trip. Update devices and enable full-disk encryption. Disable auto-join for open networks. Confirm the VPN connects automatically. Agree on no-go conversation topics for the event. For elevated-risk destinations, issue loaner devices carrying only what the trip needs. Make sure every traveler knows the one phone number or channel that reaches security from anywhere.

On the road. Prefer the phone hotspot; treat venue Wi-Fi as hostile. Never enter corporate credentials on a captive portal. Use a privacy screen in transit, keep devices on your person, and charge from your own adapter. Wear the badge inside the venue only. Enjoy the conversations — and notice the ones that keep circling back to how things work internally.

After (and during) anything odd. Report suspicious networks, odd conversations, lost devices, and mistaken clicks immediately and blamelessly — from the road, not after the flight home. Speed is the whole game: a credential entered into a fake portal is a contained incident if it is reported within the hour and an account takeover if it is not.

The teams that travel most — sales, executives, field engineers — are the same teams attackers most like to impersonate and target, which is why travel exposure belongs in how you measure human risk, not in an annual slide. Simulation results, reporting speed, and role-based exposure can feed an employee-level Human Risk Score, so the person who boards a plane every week gets coaching, controls, and simulations — including smishing and vishing, the travel channels — proportionate to the risk they actually carry.

The office has a perimeter. Your people, mercifully, do not stop working when they leave it — so send the playbook, train the reflexes, and make the report button work from seat 23F.