Companies can approve a €1,500 business trip and still leave the employee to figure out how to get online when they arrive.

The flight is booked. The hotel is approved. The laptop has been through IT. Yet the connection carrying company emails, client documents and access to internal systems is often left to a roaming-price calculation or whichever Wi-Fi network looks usable.

That leaves a hole in the travel policy. “Avoid public Wi-Fi” is reasonable advice, but employees need an approved alternative that works before the first urgent message arrives.

Holafly’s announcement puts that overlooked responsibility in focus. The bigger question for employers is simple: if connectivity is essential to working securely abroad, why is arranging it still the traveler’s problem?

The connection gap

Security advice often begins with what travelers should avoid. Unknown Wi-Fi. Suspicious login pages. Unnecessary Bluetooth connections.

That advice matters. The Canadian Centre for Cyber Security recommends using cellular data where possible and avoiding unknown, unsecured or public Wi-Fi when accessing sensitive information. Its business travel guidance also recommends software updates, multifactor authentication and removing unnecessary data before departure.

READ MORE: The Hidden Cost of Going Offline on Business Trips

The operational question is whether employees have a workable alternative.

Telling someone to avoid public Wi-Fi while leaving them without an approved data connection creates an obvious conflict. They still have a presentation to download. A customer still expects an answer.

A useful travel policy therefore needs to explain how to connect, who pays and what happens when the preferred option fails. Otherwise, the employee becomes the connectivity procurement department at precisely the wrong moment.

What Holafly’s data says

According to Holafly’s 2026 Summer Travel & eSIM Report, 53.4% of planned business travelers manage their own internet access when traveling for work. Security is the top connection priority for 41.7% overall, rising to 52% among those whose organization provides mobile data.

These are findings from a provider’s own research, measuring reported priorities. They do not establish that company-provided connections reduce breaches, or that providing an eSIM causes employees to become more security-conscious.

READ MORE: How eSIM providers differ on security

Still, they raise a useful question: how much responsibility are businesses quietly outsourcing to individual travelers?

“Getting employees online is often treated as a practical detail of business travel, but it is also part of the company’s wider security environment,” said Alex Bryszkowski, VP of B2B & Partnerships at Holafly. “When a company provides the connection, employees don’t have to make that decision themselves after landing. It gives them a clear, company-approved way to get online from the start while giving businesses greater control over the travel experience.”

The practical value is reducing last-minute decisions. The security value depends on the controls surrounding that connection.

An eSIM is not a security perimeter

A company-issued eSIM can provide an approved route online. It does not make every device, website or login trustworthy.

NIST’s zero trust guidance is explicit: trust should not be granted solely because of network location or device ownership. Authentication and authorization apply to both the user and device before access to an enterprise resource.

For a traveler, that means mobile data belongs alongside device management, access controls and protected applications. It cannot replace them.

A phishing message still reaches a phone using cellular data. A compromised laptop remains compromised when tethered to it. Reliable connectivity helps employees reach corporate systems; those systems still need to decide whether access should be allowed.

This also explains why “secure eSIM” deserves scrutiny as a marketing claim. Buyers should ask what is actually protected: the connection, the device, corporate traffic or the administration account? Centralized billing and centralized security enforcement are different capabilities.

Make the approved route usable

The strongest approach starts before departure, with IT and travel teams agreeing on a small set of practical requirements:

• Confirm device compatibility, destination coverage and installation timing.
• Test access to essential work applications and any required corporate VPN.
• Check hotspot allowances, speed restrictions and data limits against actual workloads.
• Provide an approved fallback and a support contact reachable abroad.

These are purchasing and deployment checks, not guarantees against attack. Their purpose is to make the approved route usable enough that employees stick with it.

READ MORE: Scaling eSIM in Enterprise: Rollout Playbook for IT, Finance, and Security

The Canadian Centre for Cyber Security also distinguishes high-risk travel, where the traveler’s identity, destination or event changes the threat assessment. It advises considering dedicated travel devices and warns that communications over public carriers may be intercepted.

That is why a standard travel data package alone is insufficient for executives carrying sensitive information or teams visiting higher-risk destinations. Their requirements start with a security assessment, not a coverage map.

Equally, a company with occasional travel and a suitable existing corporate roaming agreement may gain little from adding another platform. The right answer can be improving the setup already in place.

Final thoughts about business travel connectivity security

Holafly’s Business Center supports centralized management of corporate plans. Yesim’s OneBalance offers allocation of a company balance across employees, while 1GLOBAL advertises enterprise connectivity with mobile device management integration and automated eSIM provisioning. These approaches address different levels of operational complexity.

Our reading of this market is that business connectivity is moving beyond buying gigabytes toward managing how employees get online. But procurement needs sharper distinctions between cost control, deployment convenience and demonstrable security controls.

NIST and the Canadian Centre for Cyber Security provide the more useful benchmark: protect access and devices, prepare for the destination, and avoid granting trust simply because a connection is company-approved.

For providers, the opportunity is to make those requirements easier to meet. For employers, the decision is whether connectivity fits the security workflow employees actually use. A dashboard is useful; a connection that works within that workflow is what earns its place.