Companies are most vulnerable when employees work from home or use a combination of company and personal devices.