Pakistani firms exposed by poor cyber hygiene: report

LAHORE: A recent survey by Kaspersky, a cybersecurity firm, has revealed that many professionals in Pakistan are exposing their companies to risk by using multiple devices without adequate protection.

According to the findings, 70 per cent of respondents in Pakistan use a mobile phone alongside a computer for work, while 30.8 per cent also use a tablet. However, only 70.8 per cent said they had cybersecurity solutions installed on all devices used to access business information. A further 7.0 per cent admitted they did not know whether their devices were protected.

The survey, titled ‘Cybersecurity in the Workplace: Employee Knowledge and Behaviour’ conducted in 2025 by research agency Toluna on behalf of Kaspersky, was based on 2,800 online interviews with employees and business owners in seven countries: Turkiye, South Africa, Kenya, Pakistan, Egypt, Saudi Arabia and the UAE.

In Pakistan, nearly half of respondents said they had used work devices for personal purposes over the past 12 months, including streaming, gaming, shopping and booking holidays. Some 49.5 per cent connected work devices to public WiFi networks, 22 per cent reported losing a device, and 23 per cent had devices stolen. Such practices, Kaspersky warned, expose businesses to heightened cyber risks.

Personal use of work devices can result in the installation of unauthorised apps or access to malicious websites, increasing the risk of malware infections or data leaks. Connecting to public WiFi, often unsecured, may allow cybercriminals to intercept sensitive data, underscoring the need for virtual private networks (VPNs). Lost or stolen devices without strong passwords, encryption or remote wipe capabilities also put critical business information at risk.

“With the increasing reliance on cloud services, remote work and mobile access, businesses must adopt comprehensive security measures,” said Brandon Muller, technical expert for the MEA region at Kaspersky. “Cyber hygiene — good IT habits, clear security policies and robust protection solutions — is essential. Every device that accesses business information should be secured with endpoint protection. Multi-factor authentication, regular software updates and backups are no longer optional; they are must-haves.”

Kaspersky recommends organisations strengthen defences by implementing strict security policies, including password rules and software installation controls, as well as network segmentation and data encryption. Regular employee education and cybersecurity training, along with robust endpoint and network protection, are also strongly advised.