Industry Insights: Securing the modern media environment

As broadcast production becomes more distributed, security can no longer stop at the network perimeter.

Cloud services, IP infrastructure, remote contributors and hybrid workflows create more connections across the production chain, and more opportunities for gaps to emerge.

In the first part of this three-part Industry Insights roundtable, vendors examine how broadcasters are adapting security strategies to environments where content, users and infrastructure routinely cross organizational and technical boundaries. The discussion explores zero-trust principles, workload visibility, secure media transport and the challenges of protecting creative workflows without slowing production.

Participants also consider the disconnect between cybersecurity policies and everyday behavior, as well as the need for consistent governance across legacy systems, on-premises infrastructure and cloud services.

Key takeaways from this Industry Insights roundtable

• Perimeters are disappearing: Cloud, IP and distributed production require security controls to extend across individual devices, connections, users and infrastructure rather than relying primarily on a protected facility boundary.
• Visibility reduces risk: Fragmented monitoring across cloud and on-premises systems can create blind spots, making end-to-end workload visibility increasingly important for identifying security exposure.
• Workflows matter: Security policies can break down when production teams face deadline pressure, making controls that are embedded into normal creative workflows more effective than those dependent on user behavior.
• Video is not enough: Securing media streams alone leaves other production systems, including intercom, messaging, configuration files, credentials and remote controls, as potential points of exposure.
• Consistency across hybrid: Broadcasters need common governance, access policies and monitoring across legacy, on-premises and cloud environments rather than treating each infrastructure layer as a separate security domain.

What security and reliability concerns are broadcasters and media organizations asking your company to address most frequently?

Jan Helgesen, head of product and solutions, Nevion: Customers are increasingly focused on how we manage client-specific information, access their systems, and ensure the security of the products we deliver. They also expect our solutions to operate in zero-trust environments, with growing emphasis on penetration testing and compliance with security requirements such as EBU RP143.

Bea Alonso, marketing lead, Projective: The concern we hear most is that security stops at the asset library and leaves the active creative process wide open, which is where freelancers, external collaborators, and unmanaged workspaces actually live. Teams want granular control over who can touch which project, and they want that control applied automatically rather than reconstructed by hand every time someone new joins. One of our clients, a large European broadcaster, found that the payoff their IT team valued most was peace of mind, because reliability and governed access finally stopped being a weekend firefighting exercise.

How has the shift toward cloud, IP and distributed production changed the security risks facing media operations?

Jan Helgesen, head of product and solutions, Nevion: As systems become more open and accessible from multiple locations, customers can no longer rely solely on a traditional walled-garden model, where individual components are protected by a perimeter such as a firewall or air-gapped environment. Modern distributed systems require security to be addressed at every node in the overall solution, with the clear understanding that the system is only as secure as its weakest link.

Kristan Bullett, CEO, Humans Not Robots: The shift to cloud and IP hasn’t just moved where media workloads run, it’s multiplied the number of places where capacity, cost and configuration decisions get made, often by different teams working from different dashboards. That fragmentation is where security gaps actually open up: when nobody holds a single, workload-level view of what’s running and who’s touching it, blind spots form in exactly the places nobody is watching. Across the hybrid estates we measure for broadcasters and telcos, the organizations most exposed are consistently the ones with siloed visibility, not the ones running older technology.

Advertisement

Russell Trafford-Jones, industry engagement manager, Techex: Security now has to travel with the content, because the perimeter has disappeared. The move to IP and the cloud has turned a closed, point-to-point broadcast chain into a web of facilities, cloud regions and third parties, and every new connection is a potential way in. As live video moves between ground and cloud, the ability to secure and monitor live media between different production infrastructure and availability zones becomes crucial, with encryption, protected transport and monitoring at every hand-off.

Sergio Ammirata, Ph.D., chief scientist, SipRadius: Traditional broadcast infrastructure had a degree of inherent security because it relied on dedicated hardware, specialist connections and controlled facilities; moving media onto shared IP infrastructure removes much of that isolation. Distributed production also increases the number of locations, devices, operating systems and networks that sit in the signal path, often including infrastructure outside the broadcaster’s direct control. Encrypting the media is therefore only part of the job: every device, connection, user and control path has to be treated as a potential point of risk.

Where do you see the greatest gaps between the cybersecurity strategies organizations have established and the realities of their day-to-day workflows?

Bea Alonso, marketing lead, Projective: The gap is almost always between policy and behavior: the strategy assumes disciplined file handling, while the reality is users take shortcuts, such as copying media to local drives just to hit a deadline. Security that depends on people remembering the rules erodes at exactly the moments production is under pressure, which is when the risk is highest. The fix is structural, embedding permissions and project structure into the workspace itself so the secure path is also the fast path.

Sergio Ammirata, Ph.D., chief scientist, SipRadius: One of the biggest gaps is between securing the media stream and securing the production around it. Intercom, messaging, scripts, reference images, configuration files, passwords and remote device control can all contain sensitive information or provide a route into the wider infrastructure, yet they are often handled through separate systems with different security models. If those workflows sit outside the security architecture protecting the video, then encrypting the video alone does not make the production secure.

What makes media and broadcast environments uniquely difficult to secure compared with traditional enterprise IT?

Jan Helgesen, head of product and solutions, Nevion: Broadcast infrastructure is moving from dedicated hardware toward open IP and software-based systems. Many legacy hardware platforms were designed when security received less attention and have remained in operation for years. As a result, IT security practices must be adapted to reflect the practical realities of today’s broadcast environments, even though there is a modernization ongoing towards generic IT infrastructure also in broadcast.

Bea Alonso, marketing lead, Projective: Traditional enterprise IT secures a stable user base behind a defined perimeter, whereas media production often involves a regular churn of freelancers moving enormous files across hybrid storage under relentless deadline pressure. That reality breaks conventional security models, because any control that slows an editor down gets bypassed the moment a delivery is at risk. The real challenge is governing the active creative process itself so that permissions and structure travel with the work from project creation through to archive.

Sergio Ammirata, Ph.D., chief scientist, SipRadius: Professional media combines the security challenges of an IP network with an unusually demanding operational requirement: signals have to keep moving in real time, at high bandwidth and with very low latency. Modern environments can also contain specialist appliances, standard computers, virtual machines, remote edge devices and third-party networks, all of which may have different operating systems, update processes and access mechanisms. That means security cannot be considered separately from performance, timing and operational continuity because disrupting the workflow can itself be a serious failure.

How should broadcasters approach security across hybrid environments that combine legacy systems, on-premises infrastructure and cloud services?

Andrew Wierzan, president of products, Pixitmedia: On-premises and cloud should not be treated as separate islands with separate rules; both are extensions of the same core infrastructure and deserve the same governance. The pressure always comes from urgency, a burst workflow, a short-term project, a show that starts Monday, and that is exactly when teams stand something up outside the framework. The discipline is to apply one common framework and one set of practices regardless of how temporary the workload claims to be.

Kristan Bullett, CEO, Humans Not Robots: Hybrid environments tend to fail on security for the same reason they fail on cost and carbon: nobody has one honest, granular view spanning legacy systems, on-premises infrastructure and cloud services, so risk gets judged one silo at a time. My starting point wouldn’t be a new security tool, but workload-level observability that pulls data from every source into one place that finance, engineering and operations can all read. Once you can see a workload end to end across the whole hybrid chain, you can judge where the real exposure sits instead of guessing.

Bea Alonso, marketing lead, Projective: A typical mistake is trying to secure each environment separately, which produces inconsistent rules at every seam where on-prem, cloud, and legacy storage meet. A better approach applies one consistent project structure, metadata model, and access policy across all of them, so a project carries its security with it wherever it runs. We’ve seen large organizations unify remote teams, moving off physical data centers without fragmenting how content is governed.

Russell Trafford-Jones, industry engagement manager, Techex: Apply the same controls everywhere, rather than bolting security on to each island. Hybrid is the reality for most broadcasters, so the goal is to bridge the gap between the rigors of traditional broadcast and the agility of cloud native infrastructure, whether workloads run on bare metal, virtualized, in containers or in the cloud. Secure, monitored demarcation points between legacy, on-premises and cloud systems also extend the life of existing investment rather than forcing a risky rip-and-replace.

Advertisement