# A work Mac is missing. What should you do first? > Report a missing work Mac, review existing recovery controls and account access, and separate known device facts from assumptions about data exposure. Page: https://cybee.ai/blog/lost-work-mac/ (Lost or stolen work Mac: first steps for your team) - [Blog](https://cybee.ai/blog/) - Lost work Mac Mac security The laptop bag is not where you left it. A calm first response: tell the right person, use the controls you set up, review account access and keep the facts apart from guesses. By [cybee](https://cybee.ai/about/#founders) Published 21.09.2026 Updated 24.09.2026 7 minute read In one minute - Tell the owner, or whoever looks after security in your team, straight away, even while you are still looking. If that is you, go on to the next step. - Share the facts: which Mac, where and when you last had it, and whether it was locked. - Use Apple’s Find My and your company’s process, if they were set up before the loss. Check that a remote action really finished. - From a trusted device, review the accounts and keys the Mac could reach. One new password does not end every session. - A recent security record shows what was switched on. It cannot prove that nobody saw or copied anything. ## What should I do if a work Mac is lost or stolen? Tell the person responsible for security at once, and write down when and where the Mac was last seen. Follow your approved process for lost devices, including Apple’s Find My options if they were turned on. Review account access from a trusted device. Then keep the facts you will need to work out which company or client information could be affected. **Q:** What does Find My do for a Mac? ### What Find My does for a Mac. Find My is Apple’s service for finding a missing device. For a Mac it can show where it is, and lock or erase it from another device. It only works if it was turned on before the Mac went missing. A lock or an erase you send runs when the Mac next goes online, so check that it actually happened. ## Make the first message useful. You get to the office and the laptop bag is not with you. The first useful step is to tell the right person, even while you keep looking. Do not wait until the end of the day to avoid an awkward conversation. Early news gives the business more time to protect access and to help you get the Mac back. Say which Mac it is, where and roughly when you last had it, and whether it was locked, asleep or in use. Name the client projects and important accounts you were working in. Stick to facts. “The Mac was locked when I left the train” is more useful than “I think everything is fine”. And write down what you do not know yet. Figure: A few plain facts and one open question. Enough for Ana to start, less than half an hour after the train. ## Use the controls you already set up. Apple’s Find My can locate or protect a missing Mac, if it was set up beforehand. Follow Apple’s current instructions and your company’s approved process. If your company manages its Macs with extra controls, let the authorised person use them. Do not assume the missing Mac is online, or that a remote action has finished. A command that was sent and a command that was confirmed are two different states. Before an erase that cannot be undone, talk through recovery, evidence and company policy with the person responsible. If you think the Mac was stolen, report it to the police. Do not try to get it back from someone yourself. Keep the serial number and the police report reference to hand. Provider guidance: [Apple: if your Mac has been lost or stolen](https://support.apple.com/en-us/102481) 1 2 3 Figure: Each step leaves a line in the record, with the time it happened. ## Review the access the Mac carried. From a trusted device, list the accounts, open sessions and stored credentials that may need attention. Start with business email, admin access and sensitive client services. Use each provider’s process to end sessions or change access. Do not assume one new password signs the missing Mac out of every service, or cancels every separate API key. Teams that build software or work with AI tools should include what is connected to code repositories, to deployments and to outside services. Work out which credentials were stored on the Mac or could be used from it, without copying their values into the incident notes. Follow the incident owner’s decisions about cancelling and replacing them, and check whether a change affects scheduled work or colleagues who share that access. **Q:** Why is one new password not enough? ### Why one new password is not enough. Many services keep you signed in on each device for days or weeks. That open session can outlive a password change. And an API key works without any password at all. So look for each service’s own control that signs a person out everywhere, and cancel keys at the service that issued them. [Who still has your client’s API keys?](https://cybee.ai/blog/client-api-key-handover/) ## Keep the facts apart from conclusions. A recent record of disk encryption and screen lock settings can show what was switched on for an assessed Mac. It cannot prove that nobody saw the screen before it locked, used an open session or copied information before the loss. Keep the last observed state of the Mac together with the time it was observed, especially if the Mac has been offline since. Figure: The same question, answered two ways, on the evening Luca’s MacBook Pro went missing. Work out which information may be involved and which clients or other parties you need to tell, under your agreements and the rules that apply to you. Get incident or legal advice where you need it. Do not announce that data was taken, or that there is no risk, before the facts support it. Keep a timeline of reports, decisions, actions and confirmations. **Q:** What does disk encryption protect? ### What disk encryption protects. Disk encryption scrambles everything stored on a Mac, so a lost or stolen laptop cannot be read without the password. On a Mac it is called FileVault. It protects the files on a Mac that is switched off or locked. It does not protect a session someone left open, or copies that already left the Mac. ## Use the incident to improve the everyday routine. Once the urgent part is handled, restore work from a trusted backup or onto a replacement Mac through your normal process. Look at what made the response easier and what was missing: current device records, recovery information, a contact route or a tested backup. Give each improvement an owner, so it becomes part of how the business works and not a lesson everyone forgets. cybee’s records show the last assessed security state of each Mac. Its training prepares people to report a lost Mac. cybee does not replace Apple’s location service or your backup system, so keep those jobs apart. The best time to agree who does what is before the next bag goes missing. Proof plan Security training with completion recorded is part of the Proof plan: CHF 9 per Mac per month, or 90 a year, excluding tax, with a 14 day trial. Protection and the 118 checks stay free on every Mac. [Deal with a security alert](https://cybee.ai/use-cases/security-alerts/)[See the plans](https://cybee.ai/pricing/) ## What to remember. - Report early, and record the facts, including what is still uncertain. - Check that remote actions finished, and review the accounts separately. - An earlier security record informs the assessment. It does not prove that no data was accessed. ## Sources and further reading. Written by cybee for small teams. Product scope and provider guidance can change, so check the linked source for your own setup. - [Apple: if your Mac has been lost or stolen](https://support.apple.com/en-us/102481) - [NCSC (United Kingdom): small business response and recovery](https://www.ncsc.gov.uk/collection/small-business-guidance--response-and-recovery) ## Prepare your team before the next bag goes missing. See how cybee assigns short trainings from your AI assistant and records who completed them. [Training for your team](https://cybee.ai/product/training/) On this page - The short answer - Make the first message useful - Use the controls you set up - Review the access it carried - Facts apart from conclusions - Improve the routine - What to remember - Sources [Look up a term](https://cybee.ai/glossary/) cybee Keeps a dated record of the security settings on each Mac. Free for every Mac. [See how it works](https://cybee.ai/product/) ## Ready before anything goes missing. Three more guides. [Mac security Are Macs secure enough for a small business? What your Mac already protects, what your business still needs to check and how to keep a useful record. Read the guide](https://cybee.ai/blog/mac-security-small-business/) [your team What security training does a small team need? A plan for agencies and startups: client files, suspicious requests, AI tools and knowing when to ask. Read the guide](https://cybee.ai/blog/security-training-small-team/) [Mac security What happens after a security check? The step between finding a weak setting and changing it safely, worked through on one screen lock. Read the guide](https://cybee.ai/blog/checking-and-hardening/) ## Your next client will ask. Be ready. `curl -sSf https://get.cybee.dev | sh` Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. Free for every Mac with an Apple chip · Asks before it changes your Mac [What it installs](https://cybee.ai/docs/install/#see) [Read the install script](https://get.cybee.dev)