> IMHO any large company whose security strategy relies on nobody doing work on a personal device or personal stuff on a work device is destined for failure Ev

> IMHO any large company whose security strategy relies on nobody doing work on a personal device or personal stuff on a work device is destined for failure Every place I've worked for ~25 years has restricted the installation of software on work devices. If the CTO wants to watch netflix, they'd need to take their own laptop or use their phone. Same with Spotify at work. There has been more allowance for accessing work resources from personal devices in some orgs, though in many places that has also been strictly banned. At my current place, Slack sits in a grey zone where we use it for work but have to maintain discipline around what we discuss. IMO we shouldn't be using it at all. MFA is almost a separate category - while technically "work stuff" it is reducing attack vectors rather than increasing them.