In the world of cybersecurity, it's easy to overlook the most vulnerable areas. But what if I told you that the very technologies we trust the most could be the ones putting our organizations at risk? This is the case with Audiovisual (AV) systems, which are increasingly integrated into enterprise networks and the internet, and are now AI-enabled. According to Dr. Maiendra Moodley, Professional CIO at the Institute of Information Technology Professionals South Africa (IITPSA), AV systems are one of the most overlooked attack surfaces in enterprise cybersecurity. In my opinion, this is a critical issue that demands our attention. What makes this particularly fascinating is the fact that AV systems are often the very technologies that organizations rely on for critical decision-making and strategic planning. As Jesse Bosch, Head of Commercial at Prosirius, points out, AV systems are not just limited to boardrooms. Digital signage, media players, wireless presentation devices, touch panels, IPTV endpoints, control processors, and many other edge devices all fall within the AV category and are hitting our networks, creating vulnerabilities. What many people don't realize is that the moment these devices connect to a network, they become part of the organization's cyber attack surface. If a device is connected, it must be governed. From my perspective, this is a critical lesson for organizations to learn. One thing that immediately stands out is the need for accountability and governance. AV systems frequently fall between facilities, IT, operations, and security, creating accountability gaps that attackers are more than happy to exploit. Attackers do not respect organizational charts, and this is a critical detail that organizations must address. Historically, functionality, interoperability, and user experience have often taken precedence over security. But security and usability should not be viewed as competing objectives, as Dr. Moodley emphasizes. As the complexity and interconnectedness of AV systems have increased, along with the rapid uptake of AI systems, organizations are focusing more on cybersecurity around AV systems. It's no longer sufficient to have enough IT and cybersecurity knowledge just to get by. Organizations need specialized expertise or collaboration between traditional AV and traditional IT systems to collectively tackle and address this risk. This raises a deeper question: how can organizations ensure that their AV systems are secure without compromising usability? In my opinion, the answer lies in adopting security-by-design principles. Manufacturers should incorporate authentication, encryption, secure update mechanisms, vulnerability management, and supply chain assurance throughout the product life cycle. At the same time, organizations should focus on designing secure environments where strong authentication, access controls, device management, and monitoring operate largely behind the scenes. Security can no longer be treated as a feature to be added later. It must be embedded from the outset. In conclusion, the integration of AV systems into enterprise networks and the internet presents a significant cybersecurity risk. But by adopting security-by-design principles and focusing on accountability and governance, organizations can better secure their AV environments and protect their critical assets. Personally, I think that this is a critical issue that demands our attention and action. What this really suggests is that organizations must take a proactive approach to cybersecurity, and that means addressing the overlooked attack surfaces in their networks.
