employees connect from their own laptops without VPN — police account?

I agree.

You're right, I've been down that road too. Forgotten test environments are more often the entry point than live systems.

Proven by experience.

Same here. If permission and scope aren't in writing, don't start that test.

When you try to change everything at once, nothing settles. Proven by experience.

Let me share my experience. If you get three different answers on a topic, the question was asked wrong.

If permission and scope aren't in writing, don't start that test. That's all, sorry if I went on too long.

I didnt know that.

I felt relieved reading this answer, so it's not just me. People defend habits, not processes. Resistance comes from there.

Good luck with that.

My questions are cleared up, thanks.

I completely agree. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

That's all sorry if I went on too long.

I'll argue the opposite, don't get mad... Most incidents start with a leaked password, not a vulnerability.

Mistakes made on the employee device security side are usually reversible but expensive. Proven by experience.

Do you think this works at any scale? Security isn't absolute; it's about making attacks not worth the effort.

Hope this helps.

I was thinking the same thing... If you scold false alarms, nobody will report again.

following.

There's a part I don't understand. The answer varies greatly by industry; there is no one-size-fits-all rule.

The biggest time-waster for us was not knowing who had the final say. Correct me if I'm wrong.

I didn't know that. If you don't write this down from the start, it leads to arguments later.

If you don't write this down from the start, it leads to arguments later.

saved.

I'd appreciate it if you shared the outcome.

It's rare to find an explanation this clear. Hasty decisions become decisions you have to fix six months later.

Proven by experience.

Don't miss this: Payment information changes are never verified through the channel they came from.

This is my opinion I'm not claiming it's absolute truth.