The Wild New Risks in Co-working Spaces
What’s wrong with this picture? Company J’s policy requires workers to be in the office four days each week. The problem is that the company gave up half its office space during the pandemic. It decides to book 30 places for its office workers in a co-working space like WeWork. Brilliant right?
Um, maybe. Imagine a Thursday morning meeting in the coworking space. On the other side of that glass wall is a busy communal floor. People walking by with coffee. Someone waiting outside for the next booking. A printer humming with sensitive documents waiting for their turn to come out. Someone puts the PowerPoint slides with financials on the big screen in the conference room. Whoops.
Why co-working is booming (and why compliance should care)
The business case is easy to understand. Companies shed real estate during Covid, employees don’t want punishing commutes, and leadership still wants collaboration. So instead of forcing everyone back to a giant centralized HQ, organizations are using shared workspaces closer to where employees live.
The data points prove this out. CBRE’s occupier sentiment survey indicates most employers now have explicit attendance expectations, with a large share expecting three or more days a week in the office. Coworking Café reports continued growth in U.S. coworking locations and footprint through late 2025.
Big-name employers are increasingly using coworking too—think Pfizer, Amazon, JPMorgan Chase, Lyft, and Anthropic.[i]
Oh the Risks!
A traditional corporate office has a whole ecosystem of invisible protections: controlled access, known networks, fewer unknown eyes and ears, established secure print processes, and a space that’s designed (at least somewhat) around confidentiality.
Co-working spaces flip that.
You’ve got shared or public Wi-Fi options, shared meeting rooms with rapid turnover, constant visitors, and lots of ambient “life” happening around sensitive work. That creates more opportunities for shoulder-surfing, overheard calls, accidental screen shares, and confidential documents appearing on the wrong printer at the wrong time.
And if companies are contracting with multiple local operators rather than one major provider, the vendor/third-party risks can expand fast. Vendor risk becomes decentralized. One global HQ lease is one thing. Ten satellite coworking providers with ten different security postures is another.
Confidentiality is a Big Problem
Confidentiality isn’t just about data. It’s about conversations, screens, whiteboards, and paper. A single overheard investigation call or a slide deck visible through a glass wall can be enough to trigger real damage.
Your classification and handling rules may not match the environment. Many companies have policies that assume “office = controlled space.” Co-working breaks that assumption.
Your employees will do what the environment encourages. If the space makes it easy to print, people will print. If it makes it easy to take calls anywhere, people will take calls anywhere. People are social animals who mimic each other’s actions.
How to Update Your Controls
Here’s where to start.
Risk Assessment
First things first. Update your risk assessment. Learn about the coworking spaces’ information security, privacy, physical security, and third-party controls to correctly ascertain risk levels.
Compliance risks that may increase include antitrust risk (for instance, if people can view pricing or projections), insider trading (e.g., financial information or M&A strategy), and conflicts of interest (getting too friendly with folks in the coworking space who could be suppliers).
Policies and Procedures
Update policies (or create new ones) to manage the new risks. This can include:
- Rules for the types of work that can be done at coworking spaces.
- When and what types of documents can be printed.
- Requirements for screen protectors/privacy screens.
- When to turn off video on calls.
- Whether there are greater security requirements, like mandatory multi-factor authentication or using a VPN to connect.
Training
Training is imperative for workers who are moving to coworking spaces. Many people simply aren’t aware of the risks that come from a coworking space. A simple video or infographic distributed to those who are joining a coworking space can create a healthier risk environment.
Guidance for investigations and sensitive conversations is important. Information is critical. When we tell people where sensitive calls can be taken, how to book private spaces, and when to reschedule rather than “make it work” on a communal floor, we empower the workforce to do the right thing.
The payoff: better culture without accidental chaos
Co-working and satellite offices can reduce commuting pain while preserving collaboration and mentoring, and compliance can support that outcome.
We must educate leaders that coworking spaces aren’t “just another office.” It’s a different environment. If the company treats it that way—thoughtfully, practically, and with controls that fit – we can support the business and protect what matters.