A remote support agent's office is usually a browser. Live chat, the help desk, the CRM, order lookups and internal docs all run in tabs, often from a kitchen table, a coworking space or a café between shifts.
That setup makes support teams flexible and easy to scale. It also means customer conversations, order details and sometimes payment information pass through networks and devices the company doesn't manage. For small businesses without a dedicated IT team, a few clear habits go a long way.
This guide covers three areas: the networks agents connect through, the browser they work in, and the accounts that hold everything together. It pairs well with broader cybersecurity essentials for remote customer support teams.
Remote support worker at a private home desk
The Networks Your Agents Don't Control
Most support tools encrypt the connection between the browser and their servers, so nobody else on the Wi-Fi can read chat transcripts in transit. That's a strong baseline.
The gaps are elsewhere. Shared network operators may still see which services a device connects to, and coworking "guest" networks are shared with every visitor who walks through the door. Home networks have their own weak spots, such as routers still using default passwords or outdated firmware.
For agents who work from public or shared Wi-Fi, a VPN adds protection by encrypting the connection between the agent's laptop and the VPN server. If the company is considering a free VPN, a manager or IT adviser should assess its privacy policy, coverage and suitability for customer data before approving it. Agents should not choose their own service for work. A commercial VPN adds connection privacy; it does not provide access to private company systems or replace account controls. For a wider comparison of options, see our guide to the best free VPNs.
A few network basics for remote agents:
- Change the default router password at home and keep the router's firmware updated.
- Avoid public Wi-Fi for shifts where possible, and use a phone hotspot as a backup.
- Ask how coworking networks are secured. A member-only network is not automatically safer; ask whether devices are isolated from one another and use the connection your company approves.
Reviewing browser settings at a support workstation
Treat Browser Extensions as Part of Your Security
Browser extensions deserve the same review as other work software. Support agents often install extensions for grammar checking, screen capture, translation or productivity. Depending on its permissions, an extension may be able to read or change pages containing customer conversations.
The risk isn't only obviously shady extensions. In July 2025, Malwarebytes reported on a campaign involving 18 extensions in the Chrome and Edge stores that had more than two million estimated installs. Many had worked normally, with good reviews and verification badges, before updates added malicious behavior that redirected users to harmful sites.
A few practical rules help:
- Keep an approved list of extensions agents can install, and review it every few months.
- Check permissions before installing. An extension that wants to "read and change all your data on all websites" deserves a close look.
- Watch for new permission requests after updates, which can signal a change in behavior.
- Remove extensions nobody uses. Every unused extension is risk without benefit.
- Use a separate browser profile for work, to separate personal extensions and logins. A profile is an organisational boundary, not protection against malware elsewhere on the device.
Browser-Only or Whole-Device Protection?
Because support work happens almost entirely in the browser, some teams ask whether they need a full VPN app at all. The answer depends on what agents use.
A VPN app installed on the computer can route traffic from the browser and installed tools through the VPN. Coverage depends on settings such as split tunnelling, which can exclude selected apps. Check desktop chat and calling tools during setup rather than assuming every connection is covered. If you need a refresher on how tunneling works, start with what a VPN is and how it works.
A browser extension generally routes supported browser traffic through a proxy connection; it does not cover the whole device. For agents whose entire workflow lives in Chrome, a Chrome VPN extension may be an option if the company approves its coverage. Check its handling of browser-based calls and other features used during a shift. The trade-off is coverage: anything outside the browser, such as a desktop app or system updates, isn't routed through the VPN.
A VPN extension should go through the same checks as any other: follow the provider's official link to its Chrome Web Store listing, verify the publisher, review permissions, and seek approval before installation. Store availability alone is not a safety guarantee. Whichever option you choose, write it down in your remote work policy so agents know what's expected, and so new hires set it up on day one.
Protect the Accounts Behind Every Conversation
A support agent's login can open the door to customer histories, order details and sometimes refunds. That makes these accounts attractive to attackers.
- Turn on two-factor authentication for the chat platform, help desk, CRM and email.
- Give every agent their own login. Shared accounts make it harder to establish who did what, and hard to cut off access when someone leaves.
- Limit permissions by role. Agents who don't issue refunds or export data shouldn't have those permissions.
- Remove access promptly when agents leave or change roles.
- Review active sessions from time to time. Many platforms show where and when each agent is signed in, which makes unusual logins easier to spot.
Handle Sensitive Details Carefully in Chat
Even with secure tools, the safest sensitive data is the data you never collect. Train agents never to ask customers to type full card numbers, passwords or one-time codes into chat. For payments, send customers through the approved payment flow. For identity checks, follow the company's verification procedure; never ask customers to disclose passwords or sign-in codes.
It also helps to agree on how agents should respond to requests that seem urgent or unusual, such as a "customer" asking to change the email address on an account. A short verification script protects both the customer and the agent. Pair that policy with a reliable live channel—see how teams structure online customer service without cutting corners on privacy.
A Remote Support Security Checklist
- Decide whether agents use a VPN app or a browser extension, and document it.
- Secure home routers and avoid public Wi-Fi for shifts where possible.
- Maintain an approved extension list and review permissions regularly.
- Turn on two-factor authentication for every support tool.
- Give every agent an individual login with role-based permissions.
- Never collect card numbers, passwords or codes in chat.
Start by checking individual logins, two-factor authentication and who can export customer data or issue refunds. Then review extensions and connection settings. Assign an owner to each check so the routine continues as the team changes.
