Staff Using Personal Laptops for Work: The Security and Support Cost of Inadequate Devices

The laptop that is too slow to use

A sales coordinator at a Cape Town building-supplies company opens her company laptop on Monday morning. It takes eleven minutes to start, the quoting software freezes whenever a spreadsheet is open and the battery lasts forty minutes. On Tuesday she brings her own laptop from home. It is faster, it is already set up the way she likes, and nobody has asked her to stop.

By the end of the month, supplier price lists, customer contact details and signed quotes sit on a machine the company does not own, did not configure and cannot see. When she resigns six months later, they leave with her.

This is not a story about disobedience. It is the predictable result of giving people devices that cannot do the job. This article looks at the security, support and legal cost created when staff quietly fill the gap with personal computers.

Why employees do it

People want to get their work done. When the issued laptop is slow, out of date, locked down so tightly that it blocks ordinary tasks or simply not available because the order is still waiting for approval, a personal machine is the quickest fix. Remote and hybrid work, and the unpredictability of load-shedding, make it more likely: a personal laptop with a good battery is a practical advantage on a Stage 6 afternoon.

Employees rarely tell management, because they expect to be told off, or to be told there is no budget. The arrangement therefore runs informally, with no policy, no rules and no record.

• Inadequate hardware. Machines bought on price alone struggle with the software the business now depends on.
• Slow replacement. Devices are replaced only when they fail, which leaves staff improvising in the meantime. See buying devices only when they break.
• No sanctioned alternative. There is no approved way to use a personal device safely, so the unsafe way becomes the default.

What the business loses control of

The UK National Cyber Security Centre's guidance on bring your own device sets out the trade-off plainly: personal devices can offer flexibility, but the organisation has less control over how they are configured, updated and protected. Microsoft's overview of Intune describes the tools businesses use to manage devices and apps, including on personal devices, so that company data can be protected without owning the hardware. The difficulty in the situation described here is not personal devices as such. It is personal devices used with no management at all.

• no assurance that the operating system is patched or that antivirus is running;
• no disk encryption, so a stolen or lost laptop is a data breach;
• family members sharing the same machine and login;
• company files copied to personal cloud storage or sent through personal email;
• no way to remove company data when the employee leaves;
• software licences that do not cover business use on a personal machine.

The POPIA dimension

South Africa's Protection of Personal Information Act places responsibility for personal information on the business that holds it, not on the device. The Information Regulator's POPIA page describes the Act and the Regulator's role. If customer, employee or supplier personal information is stored on an unmanaged personal laptop and that laptop is lost or compromised, the business must still be able to show it took reasonable steps to secure the information, and may have to notify affected people. A business that did not know the data was there will struggle to do either.

How the pain becomes money

• Breach and notification cost: investigation, legal advice, notification and customer goodwill after an incident on a device the business could not see.
• Support cost: IT is asked to fix software on machines it did not set up, with no standard configuration to rely on. The pattern is similar to the one described in mixed laptop models and accessories, only less visible.
• Lost knowledge and records: when an employee leaves, quotes, files and customer history stored locally go with them.
• Productivity lost to inadequate hardware: the original problem remains for everyone who has no personal laptop to fall back on.
• Licence and compliance exposure: software installed outside the business's agreements can breach licence terms, a concern also raised in unused software licences.

An illustrative cost model

The figures below are illustrative assumptions for a hypothetical 40-person business in the Western Cape. They are not drawn from any real company.

• Extra IT support: 12 × 6 × R450 = R32,400
• Expected incident cost: 0.1 × R280,000 = R28,000
• Leaver recovery effort: 3 × 20 × R250 = R15,000
• Illustrative annual cost of the hidden arrangement: about R75,400

Replacing the twelve laptops would cost R192,000 once. Over a typical three-to-four-year life, that is roughly R48,000 to R64,000 a year, and it removes much of the recurring cost above while also restoring the productivity that started the workaround. The numbers are illustrative, but the shape is typical: the visible spend is smaller than the invisible exposure it avoids.

Why the pain is tolerated

The arrangement saves the budget holder money in the short term and keeps the employee productive, so both sides are quietly satisfied. The risk is a low-probability, high-impact event that has not happened yet. Nobody is accountable for devices that are not on the asset register, so nobody counts them. Raising the matter feels like admitting that the original purchase was a mistake.

When it becomes commercially urgent

• a personal laptop is stolen, or an employee's home computer is infected;
• a key employee resigns and the files they need are on their own machine;
• a large customer's security questionnaire asks how devices are controlled;
• an insurer asks about endpoint protection;
• the business plans to grow and cannot support an unknown mix of machines.

What better looks like

1. Find out the real position. Ask, without blame, who uses a personal computer for work and why. The answers show where the issued devices are failing.
2. Fix the cause. Replace the machines that cannot run the work, and set a simple replacement cycle so the problem does not return.
3. Standardise. Fewer models and a common setup make support quicker and cheaper.
4. Set a clear rule. Decide whether personal devices are allowed at all. If so, define what they may access, what protection they need and how company data is removed on exit.
5. Manage what holds company data. Use device management, encryption and conditional access so that work data is protected wherever it goes.
6. Move work onto shared systems. Files and customer records belong in company storage, not on any individual machine. The risk resembles that in salespeople's personal spreadsheets.

Practical next actions

1. Run a short, no-blame survey asking which staff use a personal computer for work and what is wrong with the device they were issued.
2. List the oldest ten business devices and check whether they meet the minimum needs of the software they run.
3. Check what company data is stored locally on personal machines and move it to company storage.
4. Write a one-page device rule: what is allowed, what is protected and what happens when someone leaves.
5. Budget a rolling replacement fund so that devices are renewed before staff give up on them.

Bottom line

When business devices are inadequate, employees solve the problem themselves and the business inherits the risk without noticing. The fix is rarely a stricter ban. It is a laptop that works, a clear rule for the exceptions and company data that stays in company systems. The cost of doing so is visible and finite. The cost of not doing so is hidden and arrives all at once.

Sources and further reading

• Bring your own device (BYOD)
• What is Microsoft Intune? - Microsoft Intune (last verified 10 October 2026)
• https://inforegulator.org.za/popia/ (last verified 10 October 2026)

Related Mellorca reading

• Four Tools, One Job: The Real Cost of Departments Buying Their Own Software
• Recreating Documents Nobody Can Find: The Cost of Duplicated Work
• Every Team Picks Its Own Software: The Cost of Having No Integration Standards