- Start with network exposure: the on-site component should make outbound, encrypted connections only, with no inbound firewall ports and nothing exposed to the internet.
- Ask what the on-site hardware can reach and do: it should talk to AV equipment only, update itself through a signed channel and be removable cleanly.
- Check identity and access: two-factor sign-in, granular roles scoped by site and action, and an audit trail of every remote command and change.
- Confirm data residency and export: for Australian organisations, Australian hosting simplifies privacy and procurement reviews.
Enterprise AV platforms have moved onto the corporate network. They hold an inventory of every room, reach equipment across every site and can send commands to it. That puts them in front of IT security before they reach a purchase order, and a platform that can't answer the reviewer's questions clearly will stall there.
These are the questions a security team will ask about AV monitoring, control and lifecycle management platforms, grouped the way a review usually runs, with the answers that tend to pass and AVDesk's own answers alongside. Use them to compare enterprise AV control and monitoring systems on security before you compare them on features.
Network exposure
- Does the platform require any inbound firewall ports? The answer that passes is no. The on-site component should make outbound connections only.
- What does the on-site component connect to, and how? A short, documented list of destinations, over an encrypted connection.
- Does it need a VPN, port forwarding or remote-desktop access into our network? It shouldn't. Each of those is a standing hole a reviewer will ask you to justify.
- Are any AV devices exposed to the internet? None should be. Devices stay on the internal network; only the on-site component talks outward.
AVDesk: each site's Ody box dials out to the AVDesk cloud over an outbound-only encrypted tunnel. No inbound firewall ports, no VPN, no devices exposed.
The on-site hardware
- What can the on-site device reach and do? It should be scoped to AV equipment, not act as a general network scanner or touch business systems.
- What data leaves the site? Device status, readings and inventory details for AV equipment, not user files, email or business data.
- How is its software updated? Through a signed update channel, with the ability to roll back a bad update.
- How is it authenticated, and how is it removed? Each device should have its own credentials, and decommissioning should revoke them cleanly.
AVDesk: Ody talks to AV equipment only. Each site's Ody has its own login, its software updates are signed with rollback, and removing an Ody from a site logs the box out.
Identity, access and audit
- How do users sign in? Look for two-factor authentication and protection against password guessing.
- How granular are roles and permissions? Access should be scoped by site and by action (view, edit, control, administer), not all-or-nothing.
- Can stakeholders outside the AV team get limited access? Facilities, IT and site managers should see only their part.
- Is every remote command logged? With who sent it, to which device, when, and the result.
- Are changes to records audited? A field-level change trail on assets and tickets.
AVDesk: two-factor sign-in, brute-force protection, granular permissions scoped by site and action, scoped stakeholder logins, and an audit trail of remote commands and asset changes.
Data residency, retention and ownership
- Where is the data hosted? For Australian organisations, Australian hosting simplifies privacy and procurement reviews.
- What is stored, and for how long? Ask for the categories of data and the retention approach in writing.
- Can we export everything? The register, history and tickets should be exportable in a usable format.
- What happens to our data if we leave? Ask how it is returned and deleted.
AVDesk: built in Sydney and hosted in Australia, with data export available. Ask us for the current data-handling details as part of your review.
Device credentials and control
- Where are device control credentials held, and who can see them? They shouldn't be exposed to users or passed around in plain text.
- Can remote control be restricted? Who can send commands, to which sites and devices, should be a permission, not a default.
Installation and support access
- Who installs the on-site hardware, and who can access our estate for support? Named, accredited installers, and support access that is visible and controlled.
AVDesk: Ody is installed and commissioned by an accredited AVDesk integrator. Self-managed, your team runs the estate; under AVDesk Managed Support, our team works it for you.
How to compare enterprise AV systems on security
| Area | Good answer | Red flag |
|---|---|---|
| Network | Outbound-only, encrypted, documented destinations | Inbound ports, port forwarding or a permanent VPN |
| On-site hardware | Scoped to AV equipment, signed updates, its own credentials | General network scanning, manual updates, shared passwords |
| Access | Two-factor sign-in, roles scoped by site and action | Shared logins, all-or-nothing admin |
| Audit | Every command and change logged with who and when | No record of remote actions |
| Data | Known hosting location, export on request | Unclear hosting, no export |
Security is one of the criteria in the best AV monitoring software for enterprise AV systems, and one of the twelve questions in how to choose AV management software. For the platform itself, see enterprise AV management, or book a demo and bring your security team.
