We explore the main challenges faced by the broadcast industry — and the keys to overcoming them — with insights from Hugo Izard, Cybersecurity Partner at Deloitte, and María Rodríguez, Cybersecurity Expert at the same firm

*This content is included in the December issue of TM BROADCAST. You can access the full magazine here.

When we think of physical security, few question the need to protect spaces from external threats. Locks, keys, CCTV systems, and alarm devices are part of our everyday lives. Yet, when the risk moves into the digital realm, the perception of danger tends to fade — leaving organizations exposed to threats that are just as real.

The broadcast and ProAV industries provide a clear example. The transition to native IP environments has given rise to an increasingly virtualized ecosystem, where software and cloud services lay the foundations for producing, managing, and distributing content with greater flexibility, scalability, and efficiency. In this context, cybersecurity becomes, more than ever, a strategic pillar that must evolve in step with technological innovation.

To delve deeper into this transformation — and the risks it entails — TM BROADCAST spoke with Hugo Izard and María Rodríguez, who shed light on the key issues at stake.

Although Deloitte is not traditionally associated with the broadcast world, its contribution to this market is significant. As they explain, the firm’s role within the broadcast and ProAV ecosystem is built around two main pillars: first, to add value to the sector’s technological transformation through integrated, differentiating solutions; and second, to safeguard operations and critical workflows in an environment defined by total connectivity.

Among its most notable initiatives is the Sports Innovation Hub, a space created to accelerate the technological transformation of sports, through which Deloitte collaborates in the digitalization of the Olympic ecosystem — covering design, implementation, and the cybersecurity of the technologies that will support the Games between 2026 and 2032.

The shift toward IP-, cloud-, and software-based models has not always been accompanied by an equivalent level of maturity in terms of security, governance, and risk management

Cybersecurity: From a barrier to innovation to an enabler

According to Hugo Izard and María Rodríguez, the shift toward IP-, cloud-, and software-based models has not always been accompanied by an equivalent level of maturity in terms of security, governance, and risk management.

“For a long time,” they acknowledge, “the sector tended to perceive cybersecurity as a constraint or limiting factor — a layer that slowed down innovation efforts and reduced the agility of technical teams during critical operations.”

At Deloitte, the goal has been to reverse this perception and demonstrate that cybersecurity can actually empower innovation rather than hinder it. “We’re not exaggerating when we say that this has been one of the major cultural challenges we’ve been helping organizations to overcome. Our work — as trusted advisors, often positioned on the first line of defense — has precisely consisted of changing that perception,” they explain.

Their approach focuses on listening to both technical teams and management, understanding why security was viewed as a roadblock, and transforming that limitation into a genuine enabler. “When cybersecurity is intelligently integrated — aligned with the organization’s own culture and embedded in its native technology strategy — it ceases to be an obstacle and becomes the very foundation that allows innovation to thrive with confidence.”

The main challenges for broadcasters

The challenges facing broadcasters are not only technological, but also structural, operational, and cultural, Deloitte points out. One of the most evident is the protection of hybrid and distributed environments, where IP infrastructures, legacy systems, and cloud solutions coexist. This convergence expands the attack surface, complicating visibility and control over the multiple flows, devices, and users involved in content production and distribution.

Added to this is the need to balance agility and security in an environment where immediacy and on-air continuity are non-negotiable. “The only way to achieve this,” Deloitte explains, “is by integrating cybersecurity from the very design of processes — Security by Design, as we call it. This methodology is a fundamental pillar and should not be added at the end as a superficial layer, which, instead of helping, becomes a nuisance.”

Another sensitive point arises during the coverage of major events, where the workforce expands exponentially and depends largely on freelance technicians and external providers. “This model introduces new risks such as temporary access, personal devices, and heterogeneous environments — all of which require robust identity controls, segmentation, and traceability, as well as a shared security vision and culture among all parties involved.”

The heterogeneity of the broadcast ecosystem is also reflected in its technological diversity and the absence of common standards. Within the same environment — Deloitte notes — manufacturers, protocols, and platforms with differing levels of maturity and security coexist, “sometimes even with technical incompatibilities that can affect the performance of cybersecurity solutions.”

This reality forces the industry to design broader and more adaptive protection strategies, capable of connecting very different realities under a single, trusted framework.

Addressing the new challenges

In this scenario, awareness stands as the first line of defense. No matter how many protective layers or technologies are implemented — even with substantial budgets — the main vulnerability will always be the human factor. “For this reason,” note Hugo Izard and María Rodríguez, “employees, freelancers, and temporary external staff must all receive proper security awareness training, aligned with their specific roles and daily responsibilities.”

Building on that foundation, Deloitte’s experts highlight the importance of designing network architectures based on segmentation and the principle of least privilege, integrated from the outset in the system design. “For this segregation to be effective, it must take into account the critical audiovisual network — whose exposure to the Internet must be extremely limited — and the control network, which may have potential Internet access. Both must always be protected through perimeter firewalls, creating a DMZ zone.”

The protection of critical devices through EDR (Endpoint Detection and Response) solutions and the use of secure remote access technologies — such as VPNs or Zero Trust architectures — are also regarded as essential pillars for ensuring secure operations.

When video signal communication takes place over external networks, Deloitte recommends applying Trust Boundary technology, as defined in SMPTE RP 2129. “This security mechanism provides key features such as monitoring, bandwidth control, replication, and protection. Such control over UDP video communication reduces risk in video transport and prevents disruptions to availability. To this, proper network segmentation must always be added, as it remains a critical component of security.”

“When cybersecurity is intelligently integrated, it ceases to be an obstacle and becomes the very foundation that allows innovation to thrive with confidence”

Artificial intelligence: opportunity and risk

Artificial Intelligence (AI) has made a powerful entrance into the audiovisual industry — one that has embraced it with enthusiasm — and it promises to transform production, postproduction, and distribution workflows. Today, AI algorithms are already capable of editing, cataloguing, subtitling, personalizing user experiences, and even making decisions in real time. However, there is still a long way to go, and it remains crucial to test use cases in real environments before broad adoption.

Deloitte emphasizes that, when properly managed, AI can become a powerful accelerator of efficiency and quality in broadcast operations. Yet the firm also warns about its less visible side: without a strong security foundation and proper data governance, AI can quickly turn into a critical vulnerability point.

“Each time an AI model enters the content value chain,” they explain, “potential cracks may appear: training datasets that include sensitive or copyrighted information, manipulated or compromised models producing altered results, deepfakes that undermine the authenticity of the signal, or automated decisions without human supervision that negatively impact broadcast output.”

For this reason, Deloitte recommends implementing specific governance frameworks for AI that ensure traceability of processes, data protection, and content integrity. These frameworks should include access controls, audit systems, source validation mechanisms, and early anomaly detection tools.

“All of this,” they add, “must go hand in hand with AI regulation, whose European framework came into force in 2024. This regulation should always be considered — particularly when dealing with sensitive information.”

“We must know where the data resides, which legislation applies, and how its integrity, availability, and recovery are ensured in the event of failure or cyberattack”

Migration to the cloud: Security in distributed environments

The ability to work remotely, scale resources on demand, and connect geographically dispersed teams has driven massive adoption of cloud-based models across the industry. However, this evolution has also introduced a new set of challenges.

“The first key aspect,” Deloitte explains, “is that organizations must ensure proper management of identities, access, and privileges in the cloud. In environments where multiple teams and providers interact, logical segmentation, multi-factor authentication, and the principle of least privilege are non-negotiable to prevent unauthorized access or accidental or malicious data exfiltration.”

Another critical aspect is the protection of signals and data in transit. End-to-end encryption and continuous infrastructure monitoring — through SIEM or XDR solutions, or native tools provided by each cloud vendor — make it possible to detect and respond to incidents in real time, minimizing their impact on ongoing broadcasts or productions.

Finally, Deloitte underscores the importance of reinforcing data governance and sovereignty:
“We must know where the data resides, which legislation applies, and how its integrity, availability, and recovery are ensured in the event of failure or cyberattack.”

“In this context,” they add, “it is essential for cybersecurity teams to lead the definition of control and oversight models, working in close coordination with compliance departments and, where applicable, the Data Protection Officer (DPO). This ensures that technical and regulatory criteria evolve in the same direction, avoiding overlaps or grey areas of responsibility.”

Real-world projects and case studies

Deloitte’s international experience includes high-impact projects focused on protecting broadcast infrastructures for major sporting events — characterized by their technological complexity, geographical dispersion, and the heterogeneity of the teams involved.

In these projects, the firm distinguishes between two key phases: readiness and operation.

“The first phase focuses on planning, knowledge, and operational maturity. The main goal here is to assess the organization’s current cybersecurity posture and maturity level, and to design a long-term transformation plan aligned with business objectives and the unique characteristics of the broadcast ecosystem. During this stage, we review the security architecture, network segmentation, and critical systems, mapping the specific risks associated with signal production and distribution. We also provide hardening guidelines.”

This phase also includes the creation of a global governance framework integrating risk management, regulatory compliance, international certifications, and business continuity and cyber-resilience plans — all with the aim of establishing the conditions required to operate with confidence in highly critical environments.

The second phase corresponds to the operation of the live sporting event, where Deloitte deploys a comprehensive cybersecurity ecosystem and real-time infrastructure. “This environment includes both digital security experts specialized in broadcast environments and a dedicated Security Operations Center (SOC) responsible for real-time monitoring, detection, and response. Operations are managed both onsite at the event’s command center and remotely from our Sports Innovation Hub (SIH) in Madrid [Spain], supported by internationally distributed teams to ensure continuous 24/7 coverage.”

This integrated model, combining local capabilities with global resilience, has enabled Deloitte to coordinate end-to-end security, align teams under a shared vision, and ensure continuity, traceability, and trust throughout the entire broadcast operation.

“Each time an AI model enters the content value chain, potential cracks may appear: training datasets that include sensitive or copyrighted information, manipulated or compromised models producing altered results, deepfakes that undermine the authenticity of the signal, or automated decisions without human supervision that negatively impact broadcast output”