Most security stacks still treat remote work as a temporary exception. In mid-2026 that mindset creates the friction teams feel first: full-tunnel VPNs that add 80–200 ms of latency on SaaS calls, EDR and secure web gateway agents that push CPU above 15 % on older laptops, and conditional access rules that fire MFA prompts during every context switch. The single most underestimated drag is the combination of heavy endpoint agents a