Meeting rooms and classrooms now behave a lot like the laptops IT teams already protect, yet they are often still managed as AV. Joe McCallion, Product Manager at DisplayNote, looks at why shared spaces deserve a place in your endpoint strategy and what good governance looks like in practice.
Most organisations would be uncomfortable allowing an employee laptop to operate outside normal IT governance.
The device would usually be inventoried, patched, monitored and subject to security policy. Applications would be controlled. Network access would be managed. User identities would be protected. Administrators would expect visibility into its state, and there would be clear ownership if something went wrong.
Now consider the average shared meeting room.
It may contain a Windows PC or embedded operating system. It can access Microsoft Teams, Zoom, Google Meet or other cloud applications. It connects to corporate and guest networks. People may use browsers, sign into applications, share content and connect personal devices. Software changes, updates arrive and local settings can evolve over time.
In a classroom, the same principle applies. A connected display may interact with staff accounts, student devices, browser applications, wireless networks and cloud services throughout the day.
Technically, these spaces increasingly share many of the characteristics that cause organisations to treat laptops and other connected devices as endpoints.
Operationally, however, they can still be treated as AV.
That creates an important governance question: if shared rooms can interact with identities, applications, browsers, networks and organisational data, why are they sometimes governed differently from the rest of the technology estate?
Shared spaces have changed faster than the model used to govern them
The meeting room of twenty years ago was relatively easy to define. It contained a display or projector, perhaps a fixed computer, some cables and a conference phone.
Much of the technology was self-contained. The room performed a limited number of tasks, and the distinction between AV infrastructure and corporate IT was reasonably clear.
That boundary has eroded.
Modern collaboration spaces increasingly combine hardware, operating systems, cloud software, wireless connectivity, conferencing applications, browsers, calendars, identity services and remote management tools. Users expect to move between physical and digital environments without thinking about the technology underneath.
The change has been driven by good reasons. Hybrid working has made video collaboration routine. Teachers increasingly depend on digital resources in lessons. Organisations want users to be able to enter different rooms and work in broadly the same way. Businesses also want to manage larger estates more efficiently rather than treating each room as an isolated installation.
Yet every increase in capability also creates another element that needs to be understood and governed.
The UK National Cyber Security Centre increasingly describes cybersecurity in terms of organisational resilience and governance rather than purely technical protection. Its 2025 Annual Review highlights board-level cyber governance alongside frameworks intended to help organisations protect systems, prepare for incidents, detect threats and respond effectively. The NCSC's position is straightforward: because organisations depend on digital technology to operate, cyber risk should be managed alongside other material business risks.
The significance for shared spaces is not that every meeting room suddenly represents a major cyber threat. It is that the criteria organisations use to decide what belongs inside their cybersecurity model need to evolve as technology evolves.
A room containing software, identities and network access is fundamentally different from a passive display.
When does a room become an endpoint?
There is a danger in applying the word "endpoint" too casually. A classroom display is not identical to an employee laptop, and a meeting-room system may have a very different risk profile from a mobile phone or workstation.
The objective should therefore not be to force every device into the same security model. A more useful approach is to examine what the technologies have in common.
Operating system: Windows room PC, Android display or other embedded OS
Applications: Teams, Zoom, Meet, browsers and room applications
User identity: Cloud accounts, meeting credentials and authenticated sessions
Network connectivity: Corporate, guest and segmented networks
Data interaction: Files, shared content, browser state and meeting information
Configuration: Apps, permissions, settings and room policies
Software lifecycle: OS, firmware, application and platform updates
Remote administration: Central configuration, monitoring and troubleshooting
Once viewed this way, the distinction becomes less about whether a room meets a textbook definition of an endpoint and more about whether it presents endpoint-like governance requirements.
Can IT see what software is running? Can access be controlled? Can the device be updated? Can policy be applied consistently? Can an administrator establish its current state? Can users leave authenticated sessions behind? Can the organisation determine what happens after a user finishes?
If the answer to those questions matters on a laptop, it is reasonable to ask why it should matter less because the technology happens to be mounted on a meeting-room wall.
The principle is not treat every room exactly like a laptop.
It is do not exclude shared spaces from appropriate endpoint-style governance simply because they have historically belonged to AV.
The ownership problem: everyone owns part of the room
One reason shared spaces can fall outside conventional security models is organisational rather than technological.
Meeting and learning spaces often sit between several disciplines.
IT Operations may own the network and computing layer. Unified Communications may manage conferencing platforms. AV teams or integrators may own displays, peripherals and room design. Workplace or facilities teams may be responsible for the physical environment. Security teams establish wider policies. Display vendors and software providers control parts of the underlying technology.
Each party can legitimately say it owns part of the solution.
The difficulty arises when nobody owns the total governance outcome.
This can create subtle gaps rather than obvious failures. An AV integrator may correctly configure a room at deployment, while responsibility for maintaining that configuration later remains unclear. The security team may govern employee endpoints rigorously but have limited visibility into collaboration devices. IT may own the room PC but not the embedded software inside the display. A local administrator may make a necessary exception that becomes permanent because no central system records the change.
Shared spaces therefore rarely suffer from having no owner at all.
The more common problem is that they can have multiple partial owners without one coherent governance model.
That becomes increasingly difficult as estates grow. Security responsibility cannot depend indefinitely on knowing which person originally configured a particular room or which supplier installed it three years earlier.
Governance requires a clearer answer to the question: who is responsible for maintaining the room's approved state throughout its lifecycle?
The risks extend well beyond somebody leaving a file behind
Discussion about shared-room security can quickly become too narrow.
Credentials and data residue are important. They were central to the first question in this campaign: what gets left behind when the meeting ends?
But the wider governance issue is larger.
An organisation may also need to think about:
Application control. Can users access or install applications that were never intended to run in the room?
Configuration changes. Can local changes alter the room's security or operating behaviour?
Software versions. Are rooms running different versions because updates have been applied inconsistently?
Permissions. Are controls the same across every location, or have exceptions accumulated?
Network access. Does the room interact appropriately with corporate, guest and segmented networks?
Identity and authentication. How are accounts, browser sessions and access tokens managed?
Visibility. Does IT know the current state of every shared space, or does it discover problems when someone raises a ticket?
Lifecycle management. Who owns patching, upgrades, deprecation and eventual replacement?
The wider cyber landscape demonstrates why identity and unmanaged access deserve particular attention.
Verizon's 2025 Data Breach Investigations Report found that compromised credentials were used as an initial access vector in 22% of the breaches analysed. Its research also found corporate logins appearing on unmanaged devices alongside personal credentials, illustrating the broader challenge created when organisational identities move through technology that sits outside consistent control.
That evidence does not tell us that meeting rooms are a significant source of credential compromise. It would be misleading to suggest otherwise.
What it does show is why organisations place such emphasis on protecting authenticated access wherever corporate identities appear.
The principle should follow the identity rather than the furniture.
Scale turns minor inconsistency into governance debt
A small office with five rooms can survive a surprising amount of manual administration.
Someone knows which room has the unusual configuration. A technician remembers that the software on the second-floor display needs updating differently. If something breaks, an engineer can walk down the corridor and fix it.
At 50 rooms, this becomes less comfortable. At 500, across multiple buildings or regions, it becomes an operating model.
The challenge is that technology estates rarely remain static after deployment. Hardware generations change. Operating systems are updated. New applications are introduced. Collaboration platforms alter their requirements. Users create workarounds. Security policies evolve. Temporary exceptions accumulate.
The difference between the intended standard and the actual estate begins to widen.
This is configuration drift, but the consequences extend beyond configuration itself. The organisation begins to accumulate governance debt: a growing gap between what it believes is controlled and what it can reliably prove is controlled.
At small scale, inconsistency is mostly inconvenient.
At enterprise scale, inconsistency becomes a risk because the organisation no longer knows with certainty whether the same controls are operating everywhere.
A security policy might require a particular application to be restricted, for example. If enforcement depends on somebody checking each individual room, the issue is no longer whether the policy is sensible. It is whether the organisation has an operating mechanism capable of implementing it.
This distinction is particularly important for MSPs and channel partners.
An integrator may deliver a technically strong solution on day one, but the customer will live with the environment for years. A managed service provider supporting hundreds or thousands of collaboration endpoints across multiple customers needs confidence that room behaviour can remain predictable without proportional increases in support effort.
Likewise, a display vendor embedding collaboration technology into displays has to think beyond whether a feature works in a controlled demonstration. Product teams increasingly need to consider patching, release governance, remote control, certification and security behaviour across potentially very large installed bases.
Security at scale is therefore inseparable from manageability.
Education shows why estate governance matters
The challenge becomes especially visible in education, where relatively small IT teams can be responsible for large numbers of connected devices, users and teaching spaces.
The UK Government's Cyber Security Breaches Survey 2025/2026 found that 73% of secondary schools, 88% of further education colleges and 98% of higher education institutions had identified a cyber breach or attack during the previous 12 months. Almost half of primary schools had also identified one.
Educational institutions are not ignoring the issue. The same research found formal cyber policies were in place across more than eight in ten primary schools and at least nine in ten institutions at other education levels. Risk assessment, security monitoring and business continuity planning were also widespread.
This makes an important point about governance.
The question is not simply whether an organisation has a cybersecurity policy.
The more demanding question is whether that policy reaches every relevant part of the technology environment in a practical and enforceable way.
A school district might have an excellent security framework at institutional level while still managing hundreds of classroom displays with varying configurations, software versions or management capabilities.
A university may have sophisticated identity, network and endpoint controls while operating a heterogeneous estate of lecture theatres, seminar spaces and meeting rooms installed over many years.
The gap can therefore sit between policy and implementation.
That is precisely where centralised governance matters.
Secure by default is stronger than secure by instruction
User education remains an important component of cybersecurity, but it has limits.
The person entering a meeting room is usually there to hold a meeting, not administer the endpoint. A teacher enters a classroom to teach. A visiting customer may have no knowledge of the organisation's security procedures. An executive running late has little interest in understanding the technical architecture of the room.
This is why the strongest shared-space controls should operate without requiring constant user decisions.
Applications that should not be available can be restricted centrally. Session data that should not persist can be removed automatically. Configurations can return to a known state. Administrators can define what the user is permitted to change.
This principle also addresses an important tension between security and experience.
Organisations sometimes respond to risk by adding friction: more authentication, more instructions, more prompts and more restrictions for the user to navigate.
That approach can be counterproductive when it pushes people towards workarounds.
The better objective is secure by default without difficult by default.
That means designing security controls around how shared spaces are actually used. The person entering the room should be able to do what they legitimately came to do, while the platform quietly enforces the boundaries around that activity.
This is particularly important because shared-room users are unusually diverse. The same meeting space might be used by an employee, external customer, consultant and executive within a few hours. A classroom screen interacts with teachers, students and visiting staff.
Security designed around a single persistent user identity is therefore not necessarily appropriate.
The room needs its own governed state.
What good shared-space governance looks like
The precise controls will vary by organisation, industry and technology architecture, but six principles provide a useful starting point.
1. Clear ownership
Someone should ultimately be accountable for the security and operating state of the shared-space estate.
That does not mean one team must perform every task. IT, security, AV, workplace and partners may continue to collaborate. What matters is that responsibilities and escalation paths are explicit rather than assumed.
2. Estate visibility
IT teams should be able to understand what is deployed and how it is configured.
Visibility should cover the areas relevant to the organisation's risk model: devices, software versions, configurations, policies, status and material exceptions.
Without visibility, control depends heavily on assumptions.
3. Consistent policy
An employee walking from one meeting room to another should not cross into a fundamentally different security model without good reason.
The same principle applies across classrooms and sites.
Some spaces will legitimately require different controls, but those differences should be intentional rather than accidental consequences of deployment history.
4. Central policy enforcement
Security standards become much more robust when they can be enforced rather than simply documented.
This can include application access, room configuration, permissions, session behaviour and other appropriate controls.
Central administration also makes it easier to change policy when the organisation's requirements evolve.
5. Lifecycle control
A secure room at installation is not necessarily a secure room three years later.
Operating systems, applications and collaboration platforms continue to change. Organisations therefore need a defined approach to updates, patching, configuration change, support and eventual decommissioning.
Display vendors and channel partners have an important role here because product architecture can either make lifecycle governance easier or make it dependent on manual intervention.
6. Auditability
Organisations should be capable of demonstrating that the controls they believe are operating actually are operating.
The appropriate level of evidence will differ depending on the organisation and regulatory environment, but the underlying principle remains useful:
Could we establish the state of this estate without physically inspecting every room?
If not, there may be a gap between policy and proof.
Governance gaps become business risks
It is important not to inflate the threat associated with shared spaces. Meeting-room devices should not become another cybersecurity scare story.
But organisations equally should not dismiss governance weaknesses simply because there has not yet been an obvious incident.
IBM's 2025 Cost of a Data Breach Report put the global average cost of a breach at $4.44 million. More interesting for this discussion is its wider finding that governance often struggles to keep pace with rapidly adopted technology. IBM found 63% of organisations surveyed lacked governance policies to manage AI or prevent shadow AI, while 97% of those reporting an AI-related security incident lacked appropriate AI access controls.
AI and meeting-room technology are clearly very different environments, but the governance lesson travels.
New technology often enters organisations because it solves an immediate operational problem. Governance catches up later.
When that happens repeatedly, organisations create pockets of technology that work well functionally but sit awkwardly inside the wider risk model.
The cost of those gaps is not limited to catastrophic breaches. It can manifest as additional audit effort, manual remediation, support overhead, slower security approval, difficult procurement processes and lower confidence among enterprise customers.
For display vendors and partners, those issues can become commercial barriers. Technology that cannot satisfy security teams consistently may struggle to become a standard, regardless of how good the user experience is.
Security governance is therefore increasingly part of product credibility.
Different members of the buying group should ask different questions
The shared-space security issue looks different depending on where somebody sits in the ecosystem.
For IT Operations, the primary question is operational: “Can we manage the security state of every room without treating each one as an individual exception?”
For security teams, the question is governance: “Are shared spaces visible within our existing security model, and do we understand the identities, access and data that pass through them?”
For channel influencers and solution architects, the question becomes architectural: “Are we designing systems that remain governable after deployment, or merely systems that meet the specification on day one?”
For managed service providers, it is about repeatability: “Can this environment be supported, monitored and controlled efficiently across multiple customers?”
And for display vendor product teams, the issue reaches into product design: “Does our embedded software architecture allow customers to apply appropriate security, lifecycle and management controls at scale?”
Those questions are closely related, but not identical. That is why shared-space security cannot be solved solely by adding another security feature to a product specification. The broader operating environment matters.
Shared rooms should sit inside the governance conversation
The evolution of shared spaces is unlikely to reverse.
Meeting rooms will become more software-defined, not less. Classrooms will continue to connect more devices and digital services. Collaboration platforms will evolve. Users will expect technology to become easier and less visible rather than more complicated.
That makes the governance question increasingly important.
The objective is not to classify every screen as a conventional endpoint or apply laptop policies indiscriminately to classroom technology. Different technologies require proportionate controls.
But historical categories should not determine future security decisions.
If a shared space uses organisational identities, accesses networks, runs applications, stores temporary state and depends on software that changes over time, it belongs somewhere inside the organisation's cybersecurity model.
The organisations most likely to manage this well will be those that stop thinking about rooms as isolated pieces of AV equipment and start thinking about them as governed parts of a wider technology estate.
That means establishing ownership, creating visibility, enforcing appropriate policy, managing the lifecycle and ensuring controls remain consistent as estates grow.
The question, ultimately, is not whether a meeting room is technically the same thing as a laptop.
It isn't.
The more important question is this: If the room has become part of your technology estate, has it also become part of your security strategy?
How visible are shared spaces within your security strategy?
DisplayNote helps organisations make meeting rooms and learning spaces easier to manage, easier to govern and more secure by design. If you’re reviewing how shared spaces are governed across your estate, explore our security and governance approach or speak to the team.