A Practical Guide to Cybersecurity for Networked AV Systems

Key Takeaways

• Every networked AV device is an IP endpoint and a potential attack surface. Conference rooms are no longer outside the IT security perimeter.

• Attacks on workplace collaboration and contact center platforms surged more than 300% between 2021 and 2025, according to Metrigy research cited by VIcom.

• The primary vulnerability is organizational: AV is managed by facilities, not IT, and falls outside normal patch cycles and access control reviews.

• A compromised meeting room camera can function as a remote listening device; a DSP with open management ports can serve as a lateral movement point into broader infrastructure.

• Core controls are straightforward: dedicated AV VLAN, changed default credentials, regular firmware updates, and encrypted management traffic.

• ISE 2026 launched its first dedicated CyberSecurity Summit in February 2026, marking AV security as an industry-wide priority rather than a niche concern.

Why AV Systems Are Now an IT Security Problem

For most of AV's history, the security conversation was simple: lock the equipment room, keep an eye on the displays, make sure nobody walked off with a camera. The systems were largely analog, isolated, and not connected to anything a hacker would care about.

That world ended when AV moved to IP.

A modern conference room system connects to your corporate network through managed switches, authenticates against your directory services, integrates with cloud platforms like Microsoft Teams or Zoom, and transmits audio and video across the same infrastructure that carries your business data. The camera in your boardroom has an embedded operating system, a web management interface, and very likely an open port that was enabled at the factory and never turned off.

Security researchers documented in 2024 and 2025 that networked meeting room devices are actively exploited in enterprise environments. A camera with default credentials can be accessed remotely and used as a listening device inside a secured facility. A DSP or room controller with an open management port can become a lateral movement point that an attacker uses to reach systems that have nothing to do with the meeting room. These are not theoretical scenarios. They are documented attack patterns.

ISE 2026 responded to this reality by launching its first dedicated CyberSecurity Summit in February 2026, with the event's managing director noting that cybersecurity has become a business-critical factor for AV manufacturers, integrators, and technology users. The industry has acknowledged the problem. Most enterprise deployments haven't caught up.

Where the Gap Lives

The core issue is not technical. It's organizational.

AV systems are typically procured by facilities or operations teams, installed by an AV integrator, and then handed off to whoever manages the physical space. IT is involved in network connectivity, but often only at the point of provisioning a port or a VLAN. Nobody formally owns the ongoing security posture of the AV equipment.

This creates a specific set of failure modes:

• Default administrator credentials are never changed, because nobody in facilities knows they should be and the integrator considered it out of scope

• Firmware updates are never applied, because the devices don't appear in any patch management system IT controls

• No VLAN separates AV traffic from corporate data traffic, because the initial network design treated AV as an afterthought

• No inventory documents which AV devices are on the network, what firmware version they're running, or who is responsible for them

The organizations with the most mature AV security postures are the ones where IT owns AV as infrastructure, not as facilities equipment. That shift in ownership is the biggest single change most enterprises can make.

The Controls That Actually Matter

Securing networked AV doesn't require a separate security program or specialized expertise. The foundational controls parallel what good IT hygiene looks like everywhere else. Applied consistently, they close the most significant gaps.

Change default credentials first. Every AV device ships with a factory administrator username and password. In many cases, those credentials are publicly documented in the manufacturer's support materials. Changing them at installation is the single highest-impact action available, and it takes minutes per device.

Implement a dedicated AV VLAN. AV devices should operate on a network segment isolated from corporate data systems. This limits the blast radius of a compromised device. A camera or codec that gets exploited cannot communicate with your file servers or HR systems if the network policy prevents it. VLAN segmentation is also the foundation for more advanced controls like traffic monitoring and east-west policy enforcement.

Establish a firmware update schedule. AV device firmware receives security patches. Those patches address documented vulnerabilities. An unpatched device is a device with known attack surface. Firmware management for AV should be part of whoever owns the service agreement, documented and recurring rather than reactive.

Audit management traffic encryption. Web-based and API-based management interfaces on AV devices should use current TLS configurations. Management traffic transmitted in cleartext is interceptable on the local network. Most modern AV platforms support encrypted management; most installations have never verified that it's enabled.

Additional controls worth implementing as maturity increases: 802.1X port authentication requiring devices to authenticate before receiving network access, IGMP snooping to control multicast AV traffic, and documentation of every AV endpoint with model, firmware version, and designated owner.

AVIXA publishes recommended practices specifically for security in networked audiovisual systems. It's a practical starting point for organizations formalizing their approach.

What This Means for How AV Gets Installed

The organizational gap in AV security is, in part, an integrator problem. If the team that designs and installs a conference room treats the network handoff as someone else's job, the security posture of that room is determined by whoever picks it up next, which is often nobody.

A better installation approach coordinates VLAN architecture alongside the AV design before the first device goes on the wall. It includes credential management as a documented step in the commissioning process, not an afterthought. It produces a device inventory with firmware versions and access credentials handed to IT at project close. And it builds firmware management into the service agreement rather than leaving it to chance.

At Spye, our in-house technicians handle both installation and long-term service. The person who knows how the room was built is also the person responsible for keeping it maintained. That continuity matters as AV systems become indistinguishable from IT infrastructure. It also means that when firmware needs updating or a device needs reconfiguration, there's a clear path to action rather than a gap between the integrator who's no longer involved and an IT team that inherited something they didn't design.

Where to Start

If you want to begin closing the AV security gap without a full audit, four questions will tell you how large the problem is:

• Can you list every AV device currently on your network, including make, model, and firmware version?

• Have default credentials been changed on all conference room equipment?

• Are AV devices on a dedicated VLAN, separated from corporate data traffic?

• Does your AV service agreement include firmware management and remote monitoring?

For most organizations, the honest answer to at least two of those questions is no. That's the starting point. Addressing them doesn't require a security budget or a specialized team. It requires someone with clear ownership and an integrator who treats security as part of the scope.

Your AV budgeting process should account for the ongoing cost of keeping systems secure, not just the upfront installation. That line item is increasingly non-optional.

FAQs

Are conference room AV systems really targeted by attackers?  

Yes. Security researchers documented active exploitation of networked meeting room devices in 2024 and 2025, including cameras used as remote listening devices and room controllers used as lateral movement points. These are real, documented attack patterns against enterprise environments.

Who should own AV security in an organization?  

IT should own AV as networked infrastructure, with facilities managing the physical space. In practice, that handoff is often unclear. The best outcomes happen when IT is involved in the AV design phase, not just provisioning a network port at the end.

What is an AV VLAN and why does it matter?  

A VLAN is a dedicated network segment isolating specific device categories from other traffic. Placing AV devices on a separate VLAN limits what a compromised device can communicate with. It's the most impactful single change for most organizations and requires no specialized tools to implement.

Does this only apply to large enterprise environments?

No. A small office with three conference rooms and a handful of networked AV devices has the same vulnerability patterns as a large enterprise. Default credentials and flat network access are risks at any scale.

Should our AV integrator be involved in the security conversation?

Yes, from the beginning. VLAN design, credential management, and firmware protocols should be part of the installation scope, not a post-handoff concern. An integrator who doesn't engage with these questions during design is leaving a gap that IT will eventually have to close on its own.

‍

If you're not sure how your conference room AV is configured from a security standpoint, it's worth finding out before an incident makes the question urgent.