In October, US federal prosecutors charged an OpenAI engineer with planting an audio recording device in an executive conference room at the company's San Francisco offices. According to the complaint, the device was wrapped in toilet paper and plugged into a USB port on the back of a television. OpenAI says its technical surveillance countermeasures team found it during a room sweep.
A sweep of the room found it. Nothing on the network did.
That should bother the Pro AV and IT industry. Most of our security conversation is about VLANs and access control. All of that matters, and none of it would have caught this device. The case sits in the gap between physical security, AV operations and IT, where ownership blurs.
Know What Belongs on the Network
Most AV teams can scan a subnet. Tools such as LanScan or Angry IP Scanner are useful during commissioning and fault-finding. They show which addresses respond and turn up obvious surprises. A scan is a snapshot, though. It can't tell whether a device is authorized, who owns it, or whether something new appeared five minutes later. A device can stay silent or sit on another interface. It can also record locally and never touch the network.
AV networks need what any enterprise network needs: continuous comparison between the expected estate and the observed one. For every AV VLAN, the operator should know each approved device, its role, location, switch port, MAC address, firmware level, owner and normal traffic pattern. Switch telemetry, passive discovery and light active checks should flag new endpoints and material changes as they happen. Periodic audits are still relevant, especially after room changes or service visits. They verify the system, but they shouldn't be the main defense.
When an unknown endpoint appears, the network should restrict it automatically, move it to a quarantine segment and alert its owner. Network access control (NAC), port policies and device profiling do this today. In high-risk rooms, you should disable unused switch ports and USB power, or physically secure them.
Here's the test I'd apply. Can the AV team say what belongs on the network, and cut off anything that doesn't within minutes? If not, it can see the network but can't control it.
It Could Have Been Worse
Now suppose the device had ignored the corporate and AV WiFi and sent its recordings out through a personal mobile hotspot hidden in the same room. An IP scan would still show nothing.
Wireless intrusion detection could catch it. Rogue access point monitoring watches the RF environment, so it can spot an unapproved hotspot and suspicious associations even when the traffic never reaches the enterprise LAN. The system should tell that hotspot apart from legitimate neighboring networks, alert security and keep enough evidence for an investigation. A device that transmits only now and then is harder to catch, but continuous monitoring still narrows the window.
Remote Access Without Exposing the Room
Remote support saves truck rolls and gets rooms working again faster. It can also turn every device web interface into a way in.
Forwarding a port straight to an encoder, DSP, controller or display is indefensible. So is a broad VPN that gives a technician the equivalent of a cable into the whole AV subnet. Many AV devices were built for trusted local networks. Their web interfaces often run old protocols on firmware that can't be patched quickly.
The safer standard is brokered access to a named device or management controller. The session starts with an outbound encrypted connection. It requires single sign-on and multifactor authentication, grants time-limited permissions by role, and logs every action. Shared installer accounts should go. Access should be approved for a specific job and revoked when the job is done.
NETGEAR uses this model for the NETGEAR Align Controller. NETGEAR Insight brokers remote access into the local controller, so support teams reach the management function without exposing the AV network to the internet.
Brokered access has trade-offs. It adds a dependency on a cloud service and on the vendor running it securely. Customers should ask where credentials and telemetry are stored, how access is revoked, whether logs can be exported, what happens during an outage, and who tests the service independently.
Set Policy at the AV-IT Boundary
Segmentation is essential, but address-and-port firewall rules are a blunt tool between AV and enterprise IT. They don't know which multicast flows are legitimate, or whether a support session was authorized for a specific endpoint.
AV systems depend on discovery, multicast, timing and dynamic relationships between services. The common fix is to open a wide range of ports between VLANs. That restores function by gutting the boundary. It's like leaving every door unlocked because you'd rather not carry keys.
The better approach ties policy to what each device is for. A room controller can reach its own management service. A support engineer can reach one endpoint for a set period. None of those permissions should open general access to the corporate network. Most enterprises already own the tools for this. NAC and segmentation policy need to be set up with AV traffic in mind.
This takes more design work. Some AV protocols won't fit neatly, and every enforcement point adds a dependency in the signal path. Test the policy against real AV traffic before go-live, and write down what happens when a component fails. Whatever enforces the boundary is security infrastructure, and it needs to be run that way.
Make Security Part of Handover
The OpenAI case shows the answer can't stop at the network. High-value rooms need physical checks as well. Integrators are well placed to build those checks into commissioning and acceptance.
Before sign-off on a high-value room, the handover pack should include:
- A device inventory for every AV VLAN, matched against what the switches actually see
- A record of connected peripherals, including anything plugged into display USB ports
- Unused switch ports and USB power disabled or physically secured
- Documented remote access: who can reach which device, through what, and how access is revoked
- Tamper-evident seals on displays and racks where the risk justifies them
- A named owner in IT and in corporate security for alerts from AV systems
Repeat the physical and inventory checks after every service visit or room change.
Today, nobody clearly owns the space behind the screen. The integrator knows the room, IT owns the network policy and corporate security owns the evidence. A shared handover checklist is a cheap way to give that space an owner.
