Your Landlord Owns the Router. Your Business Still Owns the Risk.

Serviced offices, co-working spaces and shared buildings are a practical choice for plenty of UK small businesses. You get a desk, meeting rooms, a post address and broadband without waiting weeks for an engineer. The catch is that the broadband is not really yours. The landlord or building operator controls the router, the firewall and the Wi-Fi password. You just plug in and hope for the best.

That arrangement can work perfectly well. It can also leave your business sharing a network with tenants you have never met, guests using the meeting room, and a smart printer in reception that nobody has updated since it was installed. You do not need to be paranoid, but you do need to understand where your responsibility starts and ends.

What shared broadband actually means

When you use the building's internet, you are a guest on someone else's network. The building manager decides how the Wi-Fi is configured, whether tenants can see each other's devices, how often the router firmware is updated, and what happens when the connection drops. You may not know whether client isolation is switched on, whether the guest network is separate, or who else has the admin password.

That does not automatically make the network unsafe. Many serviced offices are well run. The problem is the assumption. If you are handling client data, payroll, legal documents or commercial plans, 'the landlord looks after it' is not a security policy.

The risks that matter to a small business

Local network exposure

If client isolation is off, devices on the same Wi-Fi may be able to see each other. That matters if you have file sharing switched on, a NAS drive, an unencrypted laptop or a printer that accepts jobs from anyone. You do not need a malicious hacker for trouble. A curious tenant with the right tool, or a compromised device on the network, can create a headache.

Weak access control

Shared Wi-Fi passwords get passed around. Ex-employees, contractors, guests and people from other tenants may all know it. If the building never changes the password, the network effectively has a long memory.

No visibility or patching

You cannot see the router logs, check the firewall rules or confirm that firmware is up to date. If something goes wrong, you are dependent on the building manager's process. That may be fine, but you should know what it is.

Reliability and productivity

Shared broadband can get congested. Video calls stutter, cloud files sync slowly and uploads crawl when everyone else is busy. If your business depends on real-time calls or large file transfers, a shared connection with no service level can become a productivity tax.

Compliance expectations

Under UK GDPR, you need appropriate technical and organisational measures to protect personal data. You do not have to control the router to take security seriously, but you do need to think about the network you use and be able to explain your choices if asked. A written note about your setup is worth having.

Questions to ask the building manager

You do not need to turn into an auditor. A short, friendly email is enough. Ask:

• Is client isolation enabled on the tenant Wi-Fi?
• Is there a separate network or VLAN for tenants, guests and building systems?
• Who has admin access to the router and firewall?
• How often is the router firmware updated?
• Can we use our own router or firewall, or connect through a VPN?
• Is a wired connection available for our desk or office?
• What is the process when the internet goes down, and is there any uptime commitment?
• Are there restrictions on VPNs, video calls or large uploads?
• How do you handle security incidents or suspicious devices?
• Can you provide a short written summary of the setup for our records?

If the answers are vague, that does not mean you have to move office. It does mean you should add your own layers of protection.

Practical steps when you cannot touch the router

Use a VPN for work traffic

A business VPN encrypts traffic between your device and the VPN server, which helps on shared or public networks. It is not a magic cloak, but it is a sensible default for laptops and remote workers. Choose a reputable business service, turn it on automatically where possible, and make sure staff know when to use it.

Keep work devices separate

Do not mix personal phones, guest devices and business laptops on the same assumptions. If the building offers a separate tenant SSID, use it. If not, ask for one. On your own devices, keep the host firewall on, switch off file and printer sharing when you do not need it, and avoid plugging in unknown cables or USB drives.

Go cloud-first where it makes sense

Microsoft 365, Google Workspace and decent cloud file storage are generally safer than a local shared drive in a building you do not control. Turn on multi-factor authentication, use conditional access if you have it, and avoid exposing a local NAS to the internet. If you must share files internally, use the cloud service's sharing controls rather than an open network folder.

Treat printers and meeting-room kit with suspicion

Shared printers can be useful and still risky. Use PIN or secure print for confidential documents where available. Do not leave sensitive paperwork on the glass. If a meeting-room PC is shared, sign out of everything before you leave and avoid saving passwords in the browser.

Patch and protect your own kit

You cannot fix the landlord's router, but you can keep your laptops, phones and browsers updated. Use endpoint protection, screen locks and a password manager. Back up cloud data according to your provider's retention settings, and keep an offline or separate copy of anything you could not afford to lose.

Document your setup

Write down what network you use, what protections you have added, and who you would contact in an incident. It takes twenty minutes and makes you look far more organised than the business next door.

Do not wait for the landlord

The building may well be doing a good job. The point is that you cannot assume it. Your business owns the risk even when it does not own the router. A few practical steps, a short conversation with the building manager and a cloud-first mindset will keep you productive without crossing your fingers every time you open a laptop.