Analysis: Broadcast security moves from the building to the workflow

For most of broadcasting’s history, security was largely a matter of geography. Signals traveled over circuits between facilities. Equipment sat in locked racks. Anyone who could not get into the building could not get into the chain.

That model has been eroding for a decade, and the latest round of Industry Insights responses suggested it is now effectively gone.

Contribution feeds arrive from third parties. Editors work remotely on freelance contracts. Processing runs in cloud regions the broadcaster does not own. Each connection is useful, and each is a potential way in.

Across responses covering zero trust, connected devices, vendor evaluation, resilience and content provenance, several through-lines emerged. Protection is attached to the content, the device, and the project rather than the facility. Visibility is breaking down where systems meet. And the controls most likely to fail are the ones that slow production down.

A security model that works on paper but not on deadline, in other words, does not work.

Security now travels with the content

The clearest point of agreement was that the walled garden no longer describes how production operates.

“Security now has to travel with the content, because the perimeter has disappeared,” said Russell Trafford-Jones, industry engagement manager at Techex.

“Modern distributed systems require security to be addressed at every node in the overall solution, with the clear understanding that the system is only as secure as its weakest link,” said Jan Helgesen, head of product and solutions at Nevion.

Advertisement

That raises a practical question: once the wall comes down, what carries the protection? The answers tended to reflect where each company sits in the chain. Trafford-Jones pointed to the media flow, with encryption and monitoring at each hand-off. Bea Alonso, marketing lead at Projective, pointed to the project, with permissions set at creation that follow the work through to archive.

“Encrypting the media is therefore only part of the job: every device, connection, user and control path has to be treated as a potential point of risk,” said Sergio Ammirata, chief scientist at SipRadius.

The weak point may not be the video

Ammirata’s broader point deserves attention.

Intercom, messaging, scripts, reference images, configuration files, passwords and remote device control can all expose sensitive information, he said, yet they are often handled through separate systems with different security models. He also described devices that store passwords or network information in clear text and provide maintenance access with elevated privileges.

A broadcaster can encrypt every frame and still leave the talkback system open.

Specialized equipment does not get a pass, either. Custom hardware is often assumed to be safer because fewer people study it, an assumption Helgesen rejected.

“Limited security research and lower public exposure do not make these systems inherently safer; they may simply be less visible while remaining accessible to well-resourced threat actors,” said Helgesen.

The deadline always wins

The most persistent theme was not a protocol or a standard. It was an editor with a delivery due.

“Security that depends on people remembering the rules erodes at exactly the moments production is under pressure, which is when the risk is highest,” said Alonso.

Her example was mundane: an editor copying media to a local drive to make a deadline. It is the kind of shortcut a written policy cannot prevent on its own.

Andrew Wierzan, president of products at Pixitmedia, described zero trust as the most tested model available but said it sits in tension with an industry that cannot accept dead air or a missed transmission. Controls that block the show, he said, get bypassed.

“Vendors must own their share of this by agreeing on governance standards and making secure implementation genuinely easier, rather than leaving the complexity with the customer,” said Wierzan.

Advertisement

Ammirata made the same argument from the engineering side, noting that in real-time production, disrupting the workflow “can itself be a serious failure.” Security is not permitted to become the outage.

The proposed remedies were consistent: templated workspaces, role-based access applied when a project is created, automated checks at ingest and resilience built into the transport layer rather than handed to operators. Alonso described the goal as an arrangement in which “the secure path is also the fast path.”

Visibility breaks at the seams

A second through-line concerned what organizations can actually see.

“Across the hybrid estates we measure for broadcasters and telcos, the organizations most exposed are consistently the ones with siloed visibility, not the ones running older technology,” said Kristan Bullett, CEO of Humans Not Robots.

It is a claim from a company whose business is measurement, but it matched what others described.

“You cannot secure what you cannot see, so monitor at every hand-off,” said Trafford-Jones.

He pointed to probe-grade monitoring such as ETSI TR 101 290, a widely used set of measurements for MPEG transport stream health, at each demarcation point, with the resulting telemetry fed into tools operations teams already use. Bullett added a caveat that applies to any media supply chain: the data should be measured independently rather than self-reported by the provider being assessed.

One rulebook for hybrid

On hybrid infrastructure, the advice converged: stop treating on-premises, cloud and legacy systems as separate security domains.

“The pressure always comes from urgency, a burst workflow, a short-term project, a show that starts Monday, and that is exactly when teams stand something up outside the framework,” said Wierzan.

Alonso said securing each environment separately produces inconsistent rules wherever those environments meet, and recommended one project structure, metadata model and access policy across all of them.

Advertisement

Bullett said his starting point would be workload-level observability rather than another security tool. Trafford-Jones offered an argument finance departments may appreciate: secure, monitored demarcation points between legacy and cloud systems can extend the life of existing equipment rather than forcing a rip-and-replace.

Certifications are a starting point

Some of the sharpest skepticism about vendor security claims came from vendors.

“Tender security questionnaires are easy to game, so treat certifications such as ISO 27001 as a baseline trust signal rather than an answer,” said Wierzan.

He advised buyers to ask for references running the same workflow at the same scale, “without a minder on the call.” Trafford-Jones said security “should be evidenced, not asserted,” and suggested asking how heavily a product relies on generic open-source media libraries. Helgesen pointed to EBU R 143, the European Broadcasting Union’s cybersecurity recommendations for media vendors’ systems, software and services, along with regular product penetration testing.

Ammirata offered the most concrete checklist: what operating system a device runs, how patches are distributed, how passwords and configuration data are stored, whether maintenance backdoors exist and whether the device must contact the vendor for licensing. Buyers should also establish exactly where a stream is encrypted and decrypted, he said.

“If a vendor cannot provide clear answers to those questions, that uncertainty should itself be treated as a security risk,” said Ammirata.

Resilience starts with subtraction

On resilience, the least conventional advice was to remove things.

“Every tool added to a workflow adds risk, another credential, another integration, another thing to patch, so resilience starts with subtraction rather than addition,” said Wierzan.

Bullett extended that logic to redundancy, arguing that duplicate cloud regions and standby instances carry ongoing cost and carbon that few organizations measure. More failover, in his view, is not automatically more resilience. Wierzan drew a line between disaster recovery, which restores systems and content, and business continuity, which keeps the show on air while that happens, and said the two need separate plans, owners and tests.

On transport, Ammirata described how RIST, the Reliable Internet Stream Transport protocol, can combine redundant paths with packet recovery. In SMPTE ST 2022-7-style operation, two copies of a stream travel separate paths, and retransmission is required only if the same packet is lost on both.

“The production team should simply see a reliable signal; the complexity required to maintain it belongs underneath the workflow,” said Ammirata.

Trust extends to the picture

The concern does not end with systems. As AI-generated and manipulated media becomes harder to spot, broadcasters are also looking for ways to prove what they publish is real.

Martin Lindsay, head of networked solutions at Sony Electronics, described growing interest in establishing provenance at the point of capture through camera-based authentication and C2PA, the open standard for content credentials, rather than relying solely on human review and detection tools after the fact.

“The adoption of open industry standards is essential to ensure this trust information remains interoperable across diverse tools, platforms and distribution environments,” said Lindsay.

The broadcast chain, in other words, is no longer protected by where it sits. Its security now depends on the device, the feed, the project and, increasingly, the frame itself. The control most likely to survive is the one an editor on deadline never notices.