My current and previous company were both hardware companies (though we had firmware and software teams to go with it). So we have to have lab environments to

My current and previous company were both hardware companies (though we had firmware and software teams to go with it). So we have to have lab environments to simulate various types of data for the hardware. For that, remote employees have to VPN into the network. Interestingly enough, my company's wifi in their office is just a normal public internet connection (does not go onto the corporate network), so if you are on Wifi, you still have to VPN in. Its their way of allowing visitors to get proper wifi access anywhere in the building (plus they trust VPN encryption more than Wifi security). As far as leaking data: anyone with a laptop can leak data. You should have good IT practices to prevent this type of thing. All laptops should have their harddisks encrypted and password protected. Now if the employee is being malicious, a local employee could steal data just as easily (see NSA and Snowden). Good IT practices when you have a lot of computers on your network: (1) don't trust any device on your network, so you should have an IDS/IPS for tracking activity. (2) for VPN people, you want all traffic going through your network, so you can monitor the users network traffic with your IDS/IPS. (3) try to log as much activity as you can in-case you need to do post-mortem analysis once you've been hacked. (there is a lot more, but that's what you hire a good IT person/team for). If you are working for a startup of < 50 people, you probably won't be the target of hackers. But if you are a large company or have sensitive data, you are a target. Having sound IT practices are important for your company's data.