Out of Office, Not Out of Risk

Cybersecurity for the Summer Travel Season

Summer is here, and for many professionals that means vacations, hybrid work from hotel rooms, and conference travel. While your team is enjoying the season, cybercriminals are working overtime — and they know that distracted, travel-weary employees make easier targets. July is one of the highest-risk months of the year for corporate data breaches tied to human error, and the threat landscape has grown significantly more complex with the rise of AI-assisted attacks.

The Summer Threat Spike Is Real

Security researchers consistently document a spike in phishing campaigns and credential theft during June through August. The reasons are straightforward: employees are multitasking on vacation, working from unfamiliar networks, using personal devices to “just check email,” and generally operating with less vigilance than they would at their desks. Attackers plan around this. Seasonal phishing lures — fake travel confirmations, airline refund scams, hotel loyalty fraud — surge every summer and have become frighteningly convincing thanks to generative AI tools that can craft personalized, grammatically flawless messages at scale.

In 2026, the threat has evolved further. Deepfake voice and video technology, now accessible to mid-tier threat actors, enables real-time impersonation of executives and colleagues. A “video call” from your CFO asking you to approve a wire transfer while they’re “at a conference” is no longer a far-fetched scenario — it is an active attack vector.

The Five Biggest Summer Risks

1. Public Wi-Fi and Rogue Hotspots. Airport lounges, hotel lobbies, coffee shops, and convention centers are hunting grounds. Attackers deploy rogue access points with legitimate-sounding names to intercept traffic. Even legitimate public networks offer no encryption between devices on the same subnet. Any session conducted over public Wi-Fi without a verified VPN is a risk.

2. Unmanaged and Personal Devices. When employees travel, they often blur the line between personal and corporate use. A personal laptop used to access corporate email, or a work phone connected to a family member’s hotspot, introduces endpoint risks that your IT team cannot monitor or patch. Lost or stolen devices are also far more common during travel.

3. Reduced Response Capacity. IT and security teams are also on vacation in July. Skeleton crews mean longer detection and response times if an incident occurs. Attackers know that a Friday afternoon in late July is a terrible time to have a ransomware incident — which is exactly why they pick it.

4. AI-Enhanced Phishing and Smishing. Generative AI has erased the “spelling error test” that employees once used to spot phishing emails. Today’s malicious messages are tailored, contextually aware, and often reference real events pulled from public social media. Text message phishing targeting travelers with fake delivery alerts, toll violations, and flight change notices is at an all-time high.

5. Shadow IT and Unapproved Apps. Traveling employees often download convenience apps — file transfer tools, VPNs, translation apps — without IT approval. Many of these apps request excessive permissions or are outright malicious. Once installed, they can exfiltrate corporate data silently in the background.

What Your Organization Should Do Now

The goal is not to eliminate travel — it is to make sure security travels with your team. Here are the controls that matter most this summer.

• Enforce VPN use on all corporate devices before employees leave. Make it non-negotiable: no corporate resource is accessible without an active, verified VPN connection. Confirm your client is up to date and split tunneling routes all traffic through the tunnel.
• Enable multi-factor authentication everywhere — and upgrade beyond SMS. SMS-based MFA is vulnerable to SIM-swapping attacks. Push employees and clients toward authenticator apps or hardware keys.
• Brief your team before peak travel weeks. A five-minute pre-travel security reminder — covering phishing red flags, device handling, and who to call if something feels wrong — meaningfully reduces incidents.
• Have an incident response plan that accounts for reduced staffing. Define minimum coverage requirements and ensure escalation paths are documented and tested. An incident at 40% staff is not the time to discover your playbook lives in one person’s head.
• Implement conditional access policies. Modern identity platforms can flag logins from new geographies, unusual hours, or unmanaged devices and require step-up authentication. These controls catch compromised credentials in real time, even when your security team is at the beach.

The Bottom Line

Summer doesn’t pause for cybersecurity, and your adversaries certainly won’t. The organizations that fare best through the travel season are those that treat security as a continuous discipline rather than an office-bound policy. A little preparation now — updated policies, a pre-travel briefing, verified VPN enforcement — can mean the difference between a relaxing summer and a data breach response that ruins everyone’s August.

Stay safe out there, and enjoy the season.

AMCF Consulting  specializes in information security strategy, risk management, and compliance.

Questions about your summer security posture? Reach us at taylorallaire@amcfconsulting.com