Your AV System Is a Network Endpoint Now — Is It Being Treated Like One?
AVIXA named cybersecurity the top AV industry trend for 2026, and ISE just launched its first-ever Cybersecurity Summit to address it directly. That's a notable shift for an industry that spent years treating security as someone else's problem — usually IT's. The reason for the shift is simple: AV systems aren't isolated equipment anymore. They're networked endpoints, and they're being targeted like one.
How AV Quietly Became a Network Risk
A modern conferencing room has a camera, one or more microphones, a DSP, a control processor, and a display, and nearly all of it sits on the same network as everything else in the building. Each device is a small computer with firmware, credentials, and network access — which means each one carries the same risks as any other networked device: unpatched firmware, default passwords left unchanged at install, and flat network placement that gives one compromised device a path to everything else.
None of this happened because anyone was careless. AV specialists are experts in signal flow, room acoustics, and system design — not network hardening. IT and security teams are experts in network hardening — not in what a DSP's management port is actually exposing. AV security risk lives in the gap between those two areas of expertise, and until recently, most projects didn't have anyone responsible for closing it.
What's Actually at Stake
The risks aren't hypothetical. A compromised meeting-room camera or microphone is an audio and video feed into a private space — effectively a listening device installed with the building's own budget. A networked DSP or control processor with default credentials and an open management port is a foothold an attacker can use to move laterally into the rest of the network. Neither of these requires a sophisticated attack. Default credentials and unpatched firmware are the kind of gaps that get found by scanning, not by targeting.
For healthcare and education environments in particular, this isn't just an operational risk — it's a compliance one. A boardroom camera on the same flat network as patient records or student data isn't a separate system from a compliance standpoint; it's part of the attack surface that has to be accounted for.
What Should Actually Be in the Spec
Security gets treated as an afterthought when it isn't written into the project from the start. A few things worth requiring at the spec stage, not discovered after install:
Default credentials changed and documented before handoff, not left on factory settings. A firmware update and patching plan for every networked AV device, with an owner assigned — not just "the integrator will handle it" with no follow-up. Network segmentation that keeps AV devices off the same flat network as sensitive systems, agreed with IT before equipment goes in, not negotiated after. And a clear answer, in writing, to who is responsible for monitoring and patching this equipment a year from now — because most security gaps don't show up at commissioning, they show up eighteen months later when nobody's been checking.
Where This Fits in a Project
This is squarely the kind of gap that independent design and QC work is built to catch — not because integrators or IT teams are doing their jobs poorly, but because AV security sits between two specialties and needs someone who understands both the systems and the network risk to write it into the spec in the first place. A design phase that includes these requirements from day one costs far less than finding out about them during a security review after the system's already live.
The Bigger Picture
Cybersecurity becoming AVIXA's top trend for 2026 isn't a marketing angle — it's a reflection of how much AV infrastructure has changed. These systems used to be closed and isolated. Now they're networked, connected, and in scope for the same threats as every other piece of enterprise IT. Treating them that way from the start is a lot cheaper than treating them that way after an incident.
Sources for AV cybersecurity trend data:
Comments