VPN Everywhere
It seems almost too obvious to state, but best practices are like that: If a device doesn't have a VPN client installed, it won't be protected by a VPN. If you want to protect all of your network communications, install VPNs on all your devices.
Most IT teams understand that laptop computers that leave the office should have a VPN installed, but does that understanding extend to desktop computers? If they're using Wi-Fi for their network connections, then they should definitely have a VPN in place. And so should the devices that connect via cellular network.
It's true that it's illegal to eavesdrop on a cellular connection. It's also true that cellular networks are encrypted. But neither mean it's impossible to hack a cellular connection. VPN clients are available for every smartphone platform, so use them. Make it a policy to have a VPN on every network interface, and it will simplify the decision-making process for where it should be installed.
(Image: Evgeny — Adobe Stock )