The work laptop lives in your house now. It’s on the kitchen table, it’s the fastest machine you own, and at some point you checked your personal email on it during lunch. Nobody plans to blur the line. It just goes, one small convenience at a time, until the work computer is doing half your personal life.
Most of that is harmless. A few habits aren’t, and the reason isn’t that your boss is watching you. It’s that a work computer is a shared risk: yours, your employer’s, and every customer whose details sit in the systems that machine can reach.
Here are the five worth breaking, and what to do if you’ve already done them.
1. Saving your personal passwords in the browser
Letting the browser remember passwords is convenient right up until the machine isn’t yours any more.
Work computers get taken away. They get swapped at an upgrade, sent off for repair, handed back when you leave, and sometimes wiped and donated. If your browser profile still holds your bank, your personal email and your kid’s school portal, all of that leaves with it.
There’s a second reason that’s got worse. ASD lists information stealer malware as one of the most common types in circulation, describing it as malware designed to secretly collect information from a victim’s device, such as user login credentials. Browser password stores are exactly what it goes looking for. One infection on a work machine and every saved password, personal and work, is gone in a batch.
What to do instead: keep personal logins in a password manager that’s yours, not your employer’s, and not in the browser profile signed into your work account. ASD’s advice on passphrases is four or more random words, unique to every account, held in a password manager so you only have to remember one.
If you’ve already done it: open your browser’s saved passwords list, look at what’s actually in there, and clear the personal ones out. Then change any that you’ve used in more than one place.
2. Storing personal files on it
Photos, tax returns, a copy of your passport, the family videos that wouldn’t fit on the home laptop. This goes wrong in two directions at once.
You can lose them. If the machine is repaired, reimaged or handed back, nobody at your work is going to ring you first about the folder called “Holiday 2026”.
And they stop being private. Most businesses back up staff devices, which is a good thing right up to the point where your personal photos are inside a company backup that several people can restore from. Your employer now holds your private files and neither of you wanted that.
What to do instead: personal files go in personal cloud storage, on a personal account, on your own device.
If you’ve already done it: copy them off, then delete them from the work machine and empty the recycle bin. Ask your IT provider whether the backup retention means copies still exist and for how long.
3. Visiting sites you wouldn’t open with your boss behind you
This is the one people search for, so let’s be direct about it. Unsafe material to view on a work computer covers more than the obvious. Pirated streaming and download sites, “free” software and crack sites, adult sites, gambling sites, and anything that wants you to install a player or a browser extension before it will work.
Two separate problems. The first is monitoring: assume any activity on a work device is visible to your employer, because most businesses run web filtering, and filtering logs. It isn’t usually someone reading your browsing for fun. It’s that a blocked or flagged site generates an alert with your name on it.
The second is the actual risk. ASD notes that malware is commonly distributed by malicious websites that try to install it when you visit, and by software that poses as something trustworthy so you install it yourself. The categories of site above are where that concentrates.
The rule: if you wouldn’t be comfortable opening it with your manager standing behind you, don’t open it on their computer. Use your phone on your own data.
4. Letting friends or family use it
The work laptop is often the best machine in the house, and it may have software nobody would buy for themselves. When someone asks to borrow it for half an hour, saying no feels ridiculous.
Say no anyway. Anyone using that machine is inside your work session, with access to whatever your account can reach: customer records, staff details, the accounting system. Depending on what your business holds, that alone can be an unauthorised disclosure of personal information, and the organisation carries it.
Then there’s the practical version. Someone who hasn’t had your security training clicks something, and now the infection is on a device that’s signed into your company’s files.
What to do instead: set up a separate machine, a tablet, or a guest account on a personal computer for the household. If your employer is happy for family to use a work device, that needs to be a written decision, not an assumption.
5. Turning off the backup, the antivirus or the update
The backup starts at the worst moment and the machine slows to a crawl. The security software blocks something you were trying to install. Restarting for an update is always inconvenient. Switching them off is a completely understandable thing to do, and it’s the one on this list that causes the biggest incidents.
Those tools exist because the alternative is a drive failure or a ransomware infection with nothing to restore from. The Office of the Australian Information Commissioner recorded 1,205 data breach notifications in Australia in 2025, up 8% on the 1,112 the year before, with 716 attributed to malicious or criminal attack. The machines that come out of those events well are the ones that were still being backed up.
What to do instead: if something is slowing you down or getting in your way, ring your IT provider and tell them. Backup windows can be moved. Scan times can be changed. Blocks can be reviewed. None of that happens if you quietly disable it and nobody finds out until the restore fails.
What to do if you think something has already gone wrong
Warning signs that matter, in ASD’s list of account compromise symptoms: you can’t sign in with a password you know is right, you get password reset notices you didn’t ask for, there are logins from places or at times that make no sense, or emails in your inbox already marked as read.
If any of that is happening, ring your IT provider rather than working around it. And don’t delete anything first. Whoever investigates will want it.
Over the twelve months to 18 August 2026, our service desk handled 68 password requests and resets across 44 client businesses. One of them was a password change because monitoring had found that exact password sitting in a breach dump. Nobody at that business had done anything reckless. The password had simply been used somewhere else, years earlier.
The one step for today: open your work browser’s saved passwords, and take the personal ones out.
If you’re the business owner rather than the employee, the fix is a one page acceptable use policy that says what a work device is for, handed over on day one with the laptop. If you’d like a hand writing one, get in touch.