Every road warrior has a routine.
Laptop bag over one shoulder. Coffee in hand. Boarding pass pulled up on the phone. Gate area secured. Overhead bin claimed. It’s muscle memory after enough flights — the kind of choreography that happens on autopilot while the brain is already three time zones ahead, mentally rehearsing the pitch.
Which is exactly how Marcus — Meridian Group’s top-performing regional sales manager — arrived at his connection in Charlotte, settled into his seat, and made it all the way to his final destination before realizing his laptop bag was still sitting next to a charging station at Gate B14 in Detroit.
He called Xavier from the rental car line.
It was not, by any stretch, the best call Xavier had received that month. Although, to be fair, it wasn’t the worst either. That distinction still belonged to the password incident.
What Was on the Laptop
Marcus was a strong sales manager. Organized, driven, consistently over quota. He kept meticulous records — which, under normal circumstances, is exactly what you want from someone managing a regional book of business.
Under these particular circumstances, it meant the missing laptop contained:
- Active client contracts — including pricing terms, renewal dates, and negotiated discounts for fourteen accounts
- A prospect pipeline spreadsheet — names, contact information, deal stages, and the internal notes Marcus kept on each opportunity that he’d never gotten around to moving into the CRM
- A competitive pricing model — a working document Marcus had built over two years that outlined how Meridian priced against its three primary competitors
- Credentials saved in the browser — because Marcus, like many people who had never been told not to, had let Chrome remember his passwords
The laptop itself was not encrypted. There was no device management software installed. There was no remote wipe capability. There was no automatic screen lock configured beyond the Windows default.
If someone picked it up at that gate — and in a busy airport, something left unattended for more than twenty minutes rarely goes unnoticed — they had, essentially, everything they needed to do real damage.
Xavier hung up with Marcus and immediately called Xpert Technologies.
The Next Hour
The Xpert team’s response was immediate. The problem, unfortunately, was the reality they had to work with: because Meridian’s devices had not yet been enrolled in a mobile device management platform, there was no remote access, no location tracking, and no remote wipe capability available for Marcus’s laptop.
Xpert had flagged device management as a priority item in their initial assessment of Meridian’s environment. It was on the roadmap. It just hadn’t been implemented yet.
That distinction — on the roadmap versus in place — was doing a lot of heavy lifting in this particular moment.
While Xpert worked quickly to assess options, Xavier was simultaneously managing three simultaneous conversations: Marcus, who was now retracing every step of his morning in real time from a rental car in another state; Meridian’s legal counsel, who had been looped in the moment “client contracts” and “unsecured” appeared in the same sentence; and the airport’s lost and found, which operates on a timeline that can charitably be described as unhurried.
Legal had two immediate concerns: potential breach notification obligations depending on what data was on the device and whether it fell under any applicable privacy regulations, and the competitive exposure of the pricing documentation if it ended up in the wrong hands.
Neither concern had a quick answer.
What Saved Them (Partially)
Forty-five minutes after Xavier’s call to Xpert, the Detroit Metro Airport lost and found called back.
The laptop had been turned in by another traveler who found it at the gate. It was intact. Nobody had logged into it — a fact Xpert was able to subsequently verify once the device was recovered and examined.
The exhale in Xavier’s office was audible from the hallway.
But Xpert was careful in how they framed the outcome during the debrief. Yes, this one ended well. The right person found the laptop. Nobody opened it. The data was safe.
That was luck.
And luck, as Xavier had been learning in steady installments since joining Meridian, is not a security strategy.
The Root Cause: Devices as an Afterthought
When the Xpert team laid out their findings, the picture was uncomfortably familiar. Like the password situation, like the email infrastructure gap — this wasn’t the result of one person’s carelessness. It was the result of a company that had grown without ever establishing a formal approach to endpoint security.
Meridian had roughly 200 employees. A significant portion of them were mobile — salespeople, account managers, executives who traveled regularly and worked from airports, hotels, client sites, and home offices. Every one of them was carrying a device that contained some combination of client data, financial information, internal communications, and system credentials.
Not one of those devices was encrypted. Not one was enrolled in a management platform. Not one could be remotely located, locked, or wiped in the event of loss or theft.
The company had invested in a building full of talented people, a growing client base, and an increasingly sophisticated sales operation — and then handed everyone a laptop with effectively no security layer between the data on it and whoever happened to pick it up.
It wasn’t negligence. It was a gap that had simply never been prioritized, because nothing bad had happened yet.
Until something almost did.
How Xpert Fixed It — For Good This Time
Within two weeks of the airport incident, Xpert Technologies had deployed a mobile device management solution across all of Meridian’s company-owned devices. The rollout included:
Full disk encryption on every device. Every laptop and company-issued mobile device was encrypted, meaning that even if a device were lost or stolen, the data on it would be inaccessible without authentication. A laptop left at Gate B14 becomes a very expensive paperweight — not a liability.
Remote wipe and lock capability. Every enrolled device could now be remotely locked or completely wiped by the Xpert team within minutes of a report. No more waiting on airport lost and found timelines.
Mandatory screen lock policies. Devices were configured to lock automatically after a defined period of inactivity — a setting that sounds obvious and had somehow never been enforced across the organization.
Browser credential storage disabled on company devices. The convenient habit of letting browsers remember passwords was replaced with the company’s existing password manager — already deployed after the Doug incident — extended to cover browser-based credentials.
A device registration process — every new company device would be enrolled in the MDM platform before it left IT’s hands. No more out-of-the-box laptops handed to employees on their first day without configuration. Xavier smiled a little at that one.
Marcus, for his part, was a good sport about the whole thing. He completed the security training Xpert rolled out alongside the MDM deployment, migrated his prospect notes into the CRM, and has not left a single piece of equipment unattended at an airport since.
At least, not that anyone knows of.
The Conversation Every Executive Should Be Having
After the MDM rollout was complete, Xavier asked the Xpert team a question he’d been sitting with since the airport call: “How many of our employees are carrying data we couldn’t protect if their device went missing right now?”
Before the rollout: all of them.
It’s an uncomfortable number. It’s also, for a lot of companies reading this, a familiar one.
Device security doesn’t make the agenda at quarterly business reviews. It doesn’t come up in board meetings. It doesn’t feel urgent until a sales manager calls from a rental car line in another state, and suddenly the question of what’s on that laptop is the only thing anyone wants to talk about.
The good news is that it’s fixable. Quickly, thoroughly, and without drama — provided you have a partner who knows what to deploy and how to roll it out without disrupting 200 people’s workday.
Xpert handled it. Meridian moved on.
The next crisis was already on its way.
Coming up in the next installment of The Xavier Chronicles: Meridian’s biggest client presentation of the year is scheduled for 9 AM. At 8:45, the internet goes down — and there’s no backup plan.
Meridian Group is a fictional company. Lost and stolen laptops are one of the leading causes of data breaches for small and mid-sized businesses — and the majority involve devices that were never encrypted or enrolled in a device management platform. Xpert Technologies helps growing companies in Metro Detroit build technology environments that work for their business.
Sound familiar? If so, maybe it’s time to chat with an Xpert.
#CyberSecurity #EndpointSecurity #DataProtection #MobileDeviceManagement #BusinessContinuity #MetroDetroit #XpertTechnologies