The Human Factor

This is where the lesson gets real.

Human beings are the biggest cybersecurity threat.

Not hackers. Not malware. Not sophisticated attacks from foreign governments.

People.

People who hand their phones to their kids.

People who use the same password for everything.

People who think "it will not happen to me."

People who prioritize convenience over security.

And real estate agents who do not use two cell phones.

Real estate agents who do not purchase and implement a separate laptop and PC for real estate business.

Let me be blunt. You are the problem.

You are the weak link. You are the entry point. You are the one spinning the cylinder every single day and pretending it is fine.

The LastPass breach happened because one human being made one convenient choice.

The same choice you make every single day when you use your personal phone for work emails. The same choice you make when you store client documents on your family laptop. The same choice you make when you hand your device to someone else.

That is not a technology problem. That is a human problem.

And the solution is not better software. The solution is better behavior.

The Professional Standard: What You Must Implement

The National Association of REALTORS® has made cybersecurity a Core Standards requirement for 2025, requiring associations to have a cybersecurity policy. The Colorado Real Estate Commission explicitly states that brokers have "an on-going obligation to preserve the confidentiality of all sensitive data and information provided to them by Clients."

Here is what the professional standard requires you to implement:

1. Separate Work and Personal Devices

• Dedicated work cell phone with a separate plan
• Dedicated work laptop used exclusively for real estate business
• Never use personal devices for work
• Never hand work devices to family members

2. Password & Access Security

The Colorado Real Estate Commission recommends passwords of at least 12 characters, ideally 16 or more, using a phrase with numbers and special characters. Never use the same password on more than one system.

• Unique passwords for every work account
• No password reuse between work and personal accounts
• Passwords changed regularly
• Multi-factor authentication (MFA) enabled on everything

3. VPN: Non-Negotiable

Here is where many agents get themselves in trouble.

Public Wi-Fi networks are inherently insecure. They use no encryption, meaning anyone on the same network can intercept data transmitted between your device and the router. Cybercriminals can set up fake hotspots ("evil twins") and steal everything you send.

A VPN (Virtual Private Network) encrypts your internet traffic, creating a secure tunnel between your device and the internet. This makes your online activity unreadable to anyone else on the network.

This is non-negotiable.

If you access MLS, email, transaction management systems, or client data from public Wi-Fi without a VPN, you are exposing everything. Every password. Every document. Every client record.

"As a real estate professional, you're always on the move. You're at coffee shops, airports, and hotel lobbies, and that free public Wi-Fi feels like a lifesaver... But that convenience comes with a big risk. Public Wi-Fi networks are often unsecured, and they can be a playground for hackers."

NorthstarMLS specifically recommends using a trusted VPN when accessing MLS systems from unfamiliar or public networks. Popular options include NordVPN, ExpressVPN, ProtonVPN, and Surfshark, with plans ranging from $5–$12 per month.

That is the cost of not playing Russian roulette.

4. Secure Communication

• Use encrypted email or secure document-sharing platforms for sensitive information
• Never send sensitive client information through unsecured email
• Verify all wire transfer instructions by phone—never through email
• Use HTTPS websites and look for the padlock icon

5. Network Security

• Use a VPN whenever accessing work data outside the office
• Never access sensitive information over public Wi-Fi without VPN
• Keep devices updated with the latest security patches
• Disable automatic Wi-Fi connections
• Enable firewalls on all devices

The Blunt Professional Standard

Let me be even more direct.

If you refuse to take this seriously and implement this separation, you cannot call yourself a professional REALTOR®.

That is not me being harsh. That is me being honest.

The National Association of REALTORS® holds its members to a Code of Ethics. That code includes a fiduciary duty to protect your clients' best interests. You cannot protect their interests if you cannot protect their data.

REALTOR® is a registered collective membership mark owned by the National Association of REALTORS®. As a former licensed REALTOR®, I am permitted to use the term and the symbol. And I am telling you, straight up, that using one device for everything is a violation of the professional standard.

NAR's Data Security and Privacy Toolkit provides best practices and sample policies for associations and members. The Colorado Real Estate Commission explicitly states that brokers should "use a VPN on their devices for an extra layer of security when accessing sensitive information over public Wi-Fi networks."

You are not protecting your clients. You are exposing them.

And the professional REALTOR® who does implement this separation?

They will win the client. And you will lose.

Not because they are smarter than you. Not because they are better at real estate than you.

Because they took cybersecurity seriously. Because they could explain to a client exactly how their information is protected. Because they did not hand their phone to their kid for IPTV and call it a day.

That is the difference.

That is the professional standard.

And that is the difference between winning and losing.

Key Scripts

Script 1: What to say when a client asks about security

"I take the security of your personal information seriously. I use a dedicated work phone and a dedicated work laptop for all real estate business. I do not store client documents on personal devices. I do not share work devices with anyone. I use a VPN for all remote work and encrypted platforms for document sharing. I can explain my data protection practices to you, and I invite you to ask questions about how your information is handled."

Script 2: What to say when presenting your cybersecurity policy

"I have a cybersecurity policy I follow for every client. It outlines exactly how I protect your information. I can walk you through it right now, or you can take it home and review it. Your privacy and security are part of my professional standard."

Script 3: What to say when another agent asks why you have two phones

"Because I am not playing Russian roulette with my career. You should try it sometime."

The Cost of Not Separating

Let us do the math.

A dedicated work phone plan costs around $50–$80 per month. A dedicated work laptop costs a few hundred dollars once. A VPN costs $5–$12 per month. Total annual cost: maybe $1,500–$1,700.

That is the cost of not playing Russian roulette.

That is the cost of not having to explain to your clients why their data is compromised.

That is the cost of not destroying your career.

A data breach costs an average of $4.45 million globally in 2023 according to IBM. That is not a typo. Million. With an M.

But that is not the number that matters.

The number that matters is the client you lose. The referral that never happens. The reputation that takes years to rebuild.

That is the real cost of convenience.

And that is the bang you are playing Russian roulette to avoid.