Your security team probably knows how many laptops connect to the corporate network.
They may know which servers need patching, which cloud applications employees use and which endpoints need attention.
But ask a different question:
How many network-connected devices are sitting inside your boardrooms and meeting rooms?
That answer may be harder to find.
Modern conference rooms contain far more than a display and a speakerphone. A typical room can include cameras, microphones, touch controllers, room PCs, digital signal processors, control processors, displays and other network-connected equipment.
These devices support important business communication, but they can fall outside traditional IT security processes.
That creates an AV security blind spot.
The issue is not that every boardroom device represents a cybersecurity threat. The issue is visibility. If security and IT teams cannot identify, manage and monitor connected AV equipment, they have less information when assessing the organisation’s technology environment.
NIST’s IoT cybersecurity guidance recommends considering connected devices as part of broader system and organisational risk management rather than treating them as isolated hardware.
For businesses with large meeting-room estates, that principle deserves attention.
Why AV Devices Can Become a Security Blind Spot
Traditional IT environments usually have established processes for endpoints such as laptops, desktops and servers.
AV environments can be more complicated.
A single meeting room might contain equipment from several manufacturers, each with its own software, firmware, management interface and update process.
Some devices may run full operating systems. Others rely on embedded software or firmware. Some connect directly to the corporate network, while others communicate through dedicated AV infrastructure.
Responsibility can also become unclear.
The AV team may manage the equipment.
IT may manage the network.
Cybersecurity may manage security controls.
Facilities may manage the physical room.
When ownership is unclear, important security and maintenance tasks can fall between teams.
Nobody intended to create a blind spot. It simply happened because the room has too many owners and not enough coordination.
1. Start With an Accurate AV Device Inventory
Security starts with visibility.
NIST identifies device identification as a core cybersecurity capability for connected devices. Its guidance also highlights device configuration, logical access, software updates and cybersecurity state awareness.
The same thinking applies to enterprise AV.
A business should know what connected AV equipment it operates and where that equipment sits.
An AV inventory can include:
- Device manufacturer and model
- Device type
- Serial number
- IP address
- MAC address, where appropriate
- Physical room or location
- Firmware or software version
- Network segment
- Management platform
- Responsible team
- Administrative access method
- Support status
- Update status
This information becomes especially valuable when an organisation needs to investigate a vulnerability, replace unsupported equipment or troubleshoot a network issue.
Without an inventory, security teams may not even know which devices require review.
2. Understand Where AV Equipment Sits on the Network
A conference room may look like a physical space.
From an IT perspective, it can be a small networked ecosystem.
Modern AV systems can communicate with room-control platforms, conferencing services, management platforms and other network resources.
That makes network architecture an important part of AV security.
Organisations should understand:
- Which AV devices require network access
- Which systems they need to communicate with
- Which network segment they use
- What firewall rules apply
- Whether remote administration is enabled
- Which external services the equipment needs
The correct architecture will depend on the organisation and its technology stack. There is no single network design that fits every AV environment.
The important point is to make the design intentional.
A boardroom device should not end up on a network simply because someone found an available port.
Microsoft’s current Teams Rooms security documentation, for example, specifically addresses network security and the network access required by Teams Rooms environments.
3. Treat AV Firmware and Software Updates as Routine Maintenance
Firmware updates are rarely anyone’s favourite task.
They also have a habit of appearing five minutes before an important executive meeting.
Still, connected devices need ongoing maintenance.
NIST’s IoT cybersecurity capability catalog includes software update as one of the technical capabilities organisations should consider for connected devices.
Microsoft also states that Teams Rooms and their peripherals require ongoing software and firmware maintenance. Its management tools provide mechanisms for managing updates across supported Teams Rooms environments.
For businesses with many rooms, manual updates can become difficult to manage consistently.
A better process should answer:
- Which devices need updates?
- Which version is currently installed?
- Is the device still supported?
- Who approves the update?
- When should it be deployed?
- How will the team confirm that the update succeeded?
- What happens if the update fails?
The goal is not to update equipment simply for the sake of updating it.
The goal is to maintain supported, properly managed systems.
4. Review Administrative Access
A device can be perfectly installed and still have poor security controls around administrative access.
AV systems may include administrator accounts, service accounts, local credentials or cloud-based management accounts.
These accounts deserve the same attention as other technology credentials.
Microsoft’s Teams Rooms security guidance includes account-security considerations for meeting-room systems and discusses local administrator accounts and manufacturer-provided credentials.
For an AV environment, security teams should ask:
- Who has administrator access?
- Are default credentials still being used?
- Are unnecessary accounts disabled?
- Is remote administration enabled?
- Are privileged credentials controlled appropriately?
- Does the organisation know who can change device configuration?
NIST’s device cybersecurity guidance also identifies logical access to device interfaces as a relevant security capability.
The exact controls will depend on the device and environment, but the principle is simple:
Know who can change your AV system.
5. Don’t Forget Cameras and Microphones
Cameras and microphones deserve particular attention because they can capture audio and video from sensitive business environments.
A boardroom may host confidential discussions about finances, strategy, customers, employees or acquisitions.
That does not mean every conference-room camera is a security problem.
It does mean organisations should understand how the equipment works and who can manage it.
Security reviews should consider questions such as:
- Who can administer the camera or microphone?
- Can the equipment be accessed remotely?
- Which systems can communicate with it?
- What software or firmware does it use?
- How is access controlled?
- What happens when the room is not being used?
- What monitoring or logging capabilities are available?
NIST’s IoT guidance takes a device-level approach to cybersecurity and encourages organisations to consider how connected devices integrate into their wider systems.
That makes AV equipment worth including in the conversation.
6. AV Monitoring Helps Close the Visibility Gap
An inventory tells you what exists.
Security controls help determine how it is protected.
Monitoring helps you understand what is happening.
That distinction matters.
AV monitoring can give teams a central view of room equipment and help identify operational problems such as offline devices, failed peripherals, connectivity issues or room-system faults.
For example, instead of discovering a failed camera when the board meeting begins, an AV or IT team may be able to identify the issue earlier through centralised monitoring.
This is primarily an operational benefit, but better visibility can also support broader technology-management processes.
Microsoft’s Teams device-management capabilities provide information about device health and management for supported Teams environments.
For organisations managing many meeting rooms, that visibility can make a significant operational difference.
7. Establish Clear Ownership Between AV, IT and Security
Technology becomes difficult to secure when nobody knows who owns it.
AV security should not become a situation where the AV team says, “IT manages the network,” while IT says, “AV owns the equipment,” and security says, “We didn’t know those devices existed.”
Instead, establish clear responsibilities.
For example:
AV team
- Equipment configuration
- Room functionality
- Device maintenance
- Troubleshooting
IT team
- Network connectivity
- Identity and access infrastructure
- Network policies
- Device-management integration
Cybersecurity team
- Security requirements
- Risk assessment
- Access controls
- Security monitoring and incident processes
Facilities or business teams
- Physical room access
- Room ownership
- Operational requirements
The exact division will vary, but every organisation should know who is accountable for each part of the AV environment.
8. Include AV in Security and Technology Reviews
AV should not live in a separate universe.
When organisations conduct technology reviews, asset-management exercises or security assessments, connected AV equipment should be considered where relevant.
NIST’s guidance is useful here because it frames connected devices within broader organisational and system risk management.
That does not mean every microphone needs the same controls as a production server.
Risk should determine the level of control.
But organisations should understand what the device does, what it connects to, who manages it and what support it receives.
A Practical AV Security Checklist
Before considering a meeting-room environment secure and manageable, ask:
- Do we have an accurate inventory of connected AV devices?
- Do we know where each device connects?
- Are network requirements documented?
- Are administrative accounts controlled?
- Have default credentials been addressed?
- Are supported firmware and software versions tracked?
- Is there a defined update process?
- Can device health be monitored?
- Is ownership clearly assigned?
- Do we know which equipment has reached or is approaching end of support?
- Are AV systems considered in relevant security and risk reviews?
If several answers are “no,” the organisation may have an AV management gap worth addressing.
AV Security Doesn’t Mean Turning Every Room Into a SOC
There is a sensible middle ground.
Businesses do not need to treat every conference-room display like a critical server. They do need enough visibility and control to manage connected equipment responsibly.
The right approach is usually straightforward:
Identify → Configure → Protect → Update → Monitor → Review
Start with visibility.
Then establish appropriate controls based on the device, network, business importance and risk.
This approach is much more practical than waiting for a boardroom problem to expose an unmanaged device.
The Bottom Line: Your Boardroom Is Part of Your Technology Environment
The modern boardroom is no longer just a room with a screen.
It can contain a collection of network-connected devices that rely on software, firmware, accounts, network access and management platforms.
That makes AV part of the wider technology environment.
The answer is not to panic about every camera, microphone or touch panel.
It is to stop treating AV as invisible infrastructure.
Build the inventory. Understand the network. Control administrative access. Maintain supported firmware and software. Establish ownership. Monitor device health. Bring AV into relevant IT and cybersecurity conversations.
NIST’s guidance reinforces the importance of identifying and managing cybersecurity capabilities at the connected-device level, while Microsoft’s current Teams Rooms guidance demonstrates that meeting-room platforms themselves involve hardware, software, account and network security considerations.
For organisations with a growing meeting-room estate, AV device monitoring can become an important part of maintaining visibility across that environment.
Because the biggest AV security problem may not be the device your security team knows about.
It may be the one nobody remembered to put on the list.
Frequently Asked Questions
Are AV devices a cybersecurity risk?
Any network-connected device should be considered within the organisation’s broader security and risk-management approach. The level of risk depends on the device, configuration, connectivity, access controls and business environment. NIST recommends considering connected devices as system elements when establishing cybersecurity requirements.
Why should businesses monitor conference-room AV devices?
Monitoring can provide visibility into device health and operational problems. It can help teams identify issues before users report them and can support more consistent management of larger AV estates.
Should AV devices be included in an IT security review?
Yes, where the devices connect to organisational systems or networks. The review should consider appropriate factors such as device identification, configuration, access, updates, connectivity and ownership.
How can businesses improve AV security?
Start with an accurate device inventory. Then review network placement, administrative access, supported software and firmware, update processes, monitoring and ownership. Controls should match the organisation’s environment and risk.
Is AV monitoring the same as cybersecurity monitoring?
No. AV monitoring primarily focuses on the health, availability and operation of AV systems. Cybersecurity monitoring addresses security threats, events and controls. The two can complement each other, but they serve different purposes.
