Security that works in the real world
A practical starting point for protecting people, accounts, devices and sensitive material without making the job harder.
Last reviewed: October 2026
Good security is not about eliminating every possible risk. That is impossible. It is about understanding what matters, what could realistically go wrong, and putting sensible safeguards around the things that need protecting.
For journalists and production teams, those things may include unpublished material, contributor identities, contact lists, travel plans, research, rushes, passwords and access to corporate systems. The consequences of losing them are not all the same. A leaked restaurant booking is inconvenient; exposing a confidential source could be disastrous.
Start with what matters
Before using software or writing rules, ask three questions:
- What are we protecting? Identify the information, accounts and devices that would cause real harm if they were lost, exposed or unavailable.
- Who might realistically want it? Most attacks are opportunistic crime, but some assignments attract targeted attention from hostile states, organised groups, litigants or people who want to identify sources.
- What would make the biggest difference? Concentrate first on measures that prevent common attacks and limit the damage when something does go wrong.
The basics do most of the work
Keep devices and apps updated. Protect important accounts with passkeys where available, or strong unique passwords and two-step verification. Use a screen lock. Back up material you cannot afford to lose. Be cautious when a message asks you to do anything like log in, open a file, approve a request or change payment details.
These measures are not glamorous, but they stop a large proportion of everyday attacks.
Match security to the assignment
The right precautions depend on the work. A routine domestic shoot does not require the same measures as an investigation involving a vulnerable source or travel to a country where devices may be searched or monitored.
For higher-risk work, decide in advance what information needs to travel, how the team will communicate, where material will be stored, and what to do if a device or account is compromised. Carrying less sensitive information is often safer than trying to protect everything you normally carry.
Make the secure option the easy option
Security fails when it ignores how people actually work. Controls that are confusing or obstructive encourage workarounds: files move to personal accounts, passwords get shared, and approved systems are bypassed.
The aim should be to make the safe route the simplest practical route. Where a control causes repeated friction, find out why before adding another rule.
If something goes wrong
Speed matters. Report suspicious logins, lost devices, accidental disclosures and phishing mistakes promptly. A clicked link or mistyped password is often recoverable if someone acts quickly. Hiding an incident because it feels embarrassing can turn a small problem into a large one.
Security is a process, not a state. Keep the basics strong, increase protection when the work demands it, and review arrangements when the people, technology or threat changes.