A laptop was left open in a conference room after hours.

It was logged in.

Email, VPN, and client files were all accessible.

The cleaning crew came through.

“WHAT DO YOU DO?”

Secure the Device Immediately

Lock it or shut it down as soon as it's discovered.

If you suspect it was accessed, disconnect it from the network.

Check for Signs of Access

Review system logs, recent files, browser history, and VPN usage.

Look for unusual activity (file transfers, messages sent, login times).

Notify IT/Security Team

Treat it as a potential incident.

Document who found it, when, and where.

Change Credentials

Change passwords for any accounts logged into that session (email, VPN, file shares, etc.).

Invalidate tokens or sessions if supported by your systems.

Notify Affected Stakeholders

If sensitive client data was open or exposed, escalate per your internal or contractual requirements.

Document the Incident

Record what happened, when it was discovered, what was accessed, and what actions were taken.

Coach — Don’t Shame

Talk privately with the person who left it open.

Frame it as a learning moment, not punishment.

Practical Protections That Would’ve Helped Prevent This Scenario:

  • Auto-lock timeout:
    Automatically lock the screen after a few minutes of inactivity.
    (Most systems can force this through group policy.)

  • Screen saver with password:
    Require credentials to log back in, even from a screensaver.

  • Session timeouts for apps:
    Critical systems (email, VPN, file shares) should auto-timeout after a period of inactivity — even if the device doesn’t.

  • Zero trust policies:
    Sensitive systems should ask for reauthentication or deny access from inactive/unattended devices — especially in shared spaces.

  • Limited access:
    The device shouldn't allow full access to client files without a secondary authentication step.

  • Security awareness training:
    The best tech can't save a laptop if someone forgets to close it. Training and reminders matter.

 

Every security incident is a chance to protect, to learn, and to do better next time.