While its scam rate is slightly higher than neighboring South Dakota (21.5 per 10,000), North Dakota has better internet infrastructure, with a median download speed of 210.37 Mbps (11% faster than South Dakota) and a median upload speed of 68.79 Mbps (93.2% faster than South Dakota). These speeds ensure smooth and reliable online connectivity, a crucial factor for remote workers. Combined with a strong income-to-expenses ratio of 1.29, North Dakota offers both financial stability and a secure, efficient environment for remote workers in 2025.
In joint second place are Mississippi and Nebraska, scoring 8.8/10. Mississippi stands out with a low scam rate of 20 per 10,000 residents and has one of the lowest scam costs nationwide at $25.8 million, highlighting its strong cybersecurity environment and affordability. Nebraska, however, has a better internet infrastructure, with a median download speed of 199.43 Mbps (12.4% faster than Mississippi’s 177.39 Mbps) and a median upload speed of 40.79 Mbps (20% higher than Mississippi’s 50.98 Mbps). Additionally, Nebraska boasts a stronger income-to-expenses ratio of 1.37, compared to Mississippi’s 1.18, offering greater financial stability for home workers.
South Dakota is the fourth most secure state, scoring 8.7/10. Mount Rushmore State has a lower scam rate of 21.5 per 10,000 residents (20.7% lower than Idaho’s 27.1 per 10,000) and 31.5% lower than Rhode Island (31.4 per 10,000), suggesting it has a strong cybersecurity infrastructure. It also leads the top-ranking states in financial stability, boasting the highest income-to-expenses ratio of 1.39. While its internet speeds, including a median download speed of 189.22 Mbps and upload speed of 35.59 Mbps, are 10% and 48.2% lower than North Dakota’s speeds (210.37 Mbps download and 68.79 Mbps upload), its low latency of 26 ms ensures a reliable online connection.
Kentucky and Idaho are in joint eighth place, scoring 8.1/10. Kentucky has a lower scam rate of 24.9 per 10,000 residents, 8.1% lower than Idaho’s 27.1 per 10,000, reflecting slightly lower exposure to cyber threats. However, Kentucky has better internet download speed, with a median of 210.34 Mbps, 49.5% faster than Idaho’s 140.68 Mbps, making it ideal for remote workers reliant on fast connections. However, Idaho outperforms Kentucky in upload speed, with 29.37 Mbps, 23.6% faster than Kentucky’s 23.75 Mbps. Idaho is also more financially stable, with an income-to-expenses ratio of 1.28, 6.8% higher than Kentucky’s 1.17.
Venky Sundar, founder and president of Indusface, comments on the findings and provides tips on how employees can stay secure when working remotely:
“Though the states above are prioritizing fraud prevention, wi-fi speed, and financial well-being to create optimal conditions for remote working, it has made employees more reliant on public Wi-Fi networks, which significantly increases the risk of malware infections. While the ideal approach is to avoid public Wi-Fi altogether, you can never be sure about how your remote employees will comply with these guidelines.
To minimise damage, I see two angles 1) endpoint security and 2) application security. In endpoint security, it is all about using effective antivirus software but pushing automatic updates to it. Keeping these measures up-to-date helps prevent malware from infiltrating employee devices.
“Application security is the second layer of defense. Let’s say that the endpoint or your employee’s computer does get compromised, the chance of malware infecting your company's infrastructure is high. This is where putting your applications behind a WAAP becomes critical. That way, even in case of a compromise, the WAAP blocks attacks and protects the infrastructure and applications.
At the organisation’s end, access to critical systems should only be given to a select few and have MFA enabled. Along with that, test all systems extensively by using login credentials to ensure that there are no privilege escalation vulnerabilities. Finally, deploying a perimeter security solution such as a WAAP will ensure that any known vulnerabilities are not exploited by stopping attacks from infiltrating the networks.”
Additional steps businesses and employees can take to help protect against cyber-attacks:
- It is vital not only for employees but for businesses to ensure that they are adequately protected when working remotely. There are numerous methods you can use to do so.
- Remind all employees to remain vigilant against phishing and vishing scams, as cybercriminals see remote work as an opportunity to exploit. Employees can do this by becoming aware of new attacks or seeing if their organization has cybersecurity awareness training.
- Ensure all employees know not to share personal information like login details, and be cautious of unsolicited requests to check or renew passwords. Verify such requests through trusted channels like their organization’s ICT helpdesk.
- Ensure all employees use tethering or secure home Wi-Fi rather than public networks; if they have to use a public network, ensure they use a Virtual Private Network (VPN) to mask their IP address.
- Ensure that all the business-critical applications are scanned for vulnerabilities regularly. It is critical to run graybox scans to understand the level of access that various roles have. Patching privilege escalation vulnerabilities is of utmost importance. That way, even when one email gets compromised, the damage is strictly limited to the areas that the email account can access.
- Remind all employees to update their router passwords, firmware, and device software regularly, and consider password-protecting shared documents with confidential and sensitive information.
- Remind all employees not to use their work email for non-work-related sites, back up important files frequently, be cautious of fake text messages, and verify information via trusted websites like https://www.state.gov/.
- A Web Application Firewall (WAF) enhances security by filtering incoming HTTP traffic to detect and block threats like SQL injections and other attacks. Customizable rules allow WAFs to identify specific attack patterns, providing an extra layer of protection for applications.
- Organizations with outdated code, limited testing resources, and frequent updates can benefit from a WAF. It enables virtual patching for temporary protection against vulnerabilities and alerts admins to suspicious activity for timely threat response.
- Perform gray box DAST scans on all your web and mobile applications so that you know the exact risk when the admin or user credentials get compromised. Once you understand the risks, mitigate them on code.
- If an employee receives a suspicious email, let them know that they can report suspicious emails using the ‘Report Phishing’ button on your organization’s email service and that they can forward phishing emails to reportphishing@apwg.org.
For further support, contact the National Cyber Security Agency at https://www.nsa.gov/ .
