The hidden security risk sitting in your boardroom
AV systems have quietly become one of enterprise security’s most overlooked blind spots. Here’s what’s really at risk — and what organizations need to do about it.
The visibility problem
In most organizations, the security team and the AV team operate in separate worlds. Enterprise IT professionals have sophisticated tools for monitoring network traffic, flagging anomalies, and enforcing access controls — but AV devices frequently sit outside all of that.
These devices typically run on breakout networks that aren’t monitored or controlled by internal security teams. There’s a lack of governance in place. And it’s still common to find AV equipment running on default credentials, or no credentials at all — a practice that persisted for years because of a belief that connecting AV devices to the main corporate network would interfere with functionality.
The result is a growing category of unmonitored endpoints, often located in the most sensitive spaces in a building: boardrooms, executive suites, and confidential meeting rooms.
What’s actually at risk?
The threat has two distinct dimensions. The first is operational disruption: insecure AV devices can be found and manipulated by malicious actors or automated scans. That might mean devices being switched off unexpectedly, or routing and display settings being quietly changed.
The second risk is more serious. When camera feeds, presentation previews, or room audio are accessible over an unsecured connection, the potential for sensitive information to be exposed is significant. In regulated industries or organizations handling commercially sensitive data, this isn’t just inconvenient — it’s potentially a compliance or reputational issue.
The cloud management challenge
Remote management and hybrid working patterns have accelerated the adoption of cloud-based AV management platforms, and in many respects that’s a positive development. But it’s also created pressure to open up AV networks in ways that introduce new risk.
Most AV devices were never designed to be directly exposed to the internet. They lack the safeguards needed to operate securely in that environment. When cloud management solutions aren’t developed with security as a primary consideration, the convenience they offer can come at a real cost.
Before selecting a cloud management provider, organizations should conduct proper due diligence on security practices — not just functionality.
Security by design
The right approach isn’t to bolt security on after the fact. It’s to build it into the architecture from the start.
One effective model is to add a dedicated physical layer to the communication path — a gateway or probe on the network that translates unsecured device traffic into an IT-standard encrypted signal before it reaches any cloud platform. This can work bidirectionally, and critically, it allows sensitive data to be filtered out at the point of collection rather than transmitted and secured elsewhere. If information isn’t collected in the first place, it can’t be exposed — even if a device’s API inadvertently surfaces it.
This approach addresses security from both a technical and an administrative standpoint, and it’s far more robust than relying on network-level controls alone.
It’s not just a network problem
There’s a temptation — understandable, but mistaken — to treat AV security as the network team’s responsibility. In practice, it requires collaboration across disciplines.
AV teams understand the devices, the workflows they support, and the practical impact of tighter security measures. IT and network teams bring a deeper understanding of protocols, threat models, and risk management. Neither group has the full picture without the other.
A more IT-centric approach to AV is needed across the industry — not to override AV expertise, but to integrate it with security thinking that has historically been absent from AV deployments.
Awareness is the first step
In many organisations, AV security risks simply aren’t on the radar. Issues rarely surface in dramatic ways, which makes it easy to assume everything is fine. The first step is honestly acknowledging the exposure that exists. The second is addressing as many vulnerabilities as possible without compromising the operability that AV systems exist to deliver.
That balance — between security and usability — is the core challenge. Like most things in engineering, it’s about getting the calibration right, not choosing one at the expense of the other.
What’s next: AI and predictive security
Looking ahead, AI is beginning to play a meaningful role in AV security. Predictive and agentic AI, when properly configured, can identify unusual behaviour patterns that might indicate a threat — things that would be impossible to catch manually across a large estate of devices. For organisations willing to invest in the right tooling and implementation, this represents a significant step forward in proactive security management.