Every meeting leaves a trace. In this article, Miguel Del Amor, CTO at DisplayNote, explores what a shared room can quietly retain once the last person has walked out, from signed-in accounts to open applications and downloaded files, and why those small remnants matter for any organisation running shared spaces at scale.
When a meeting finishes, most people give little thought to the technology they leave behind. They close the laptop, gather their belongings and move on to the next conversation. In a classroom, a teacher might finish a lesson, disconnect a device and leave the room to the next class. From the user's perspective, the interaction with the room has ended.
The technology may tell a different story.
A browser may still be authenticated. An application may remain open. A cloud account could still be signed in. Files might have been downloaded locally. A meeting platform may retain information from the previous session. Settings might have been changed temporarily and never restored. In a room used by dozens of people every week, these small remnants can accumulate into something much more significant.
This raises a deceptively simple question: what gets left behind when the meeting ends?
The answer matters because the modern shared space is no longer simply a screen connected to some AV equipment. Meeting rooms and classrooms increasingly contain computers, browsers, applications, wireless sharing technology, cloud services, cameras, microphones and network connections. They interact with identities, devices and data from people across the organisation, as well as customers, partners, students and guests.
In other words, a shared room is becoming a multi-user endpoint within the wider technology estate. The challenge is that it is not always governed like one.
The room has become part of the security perimeter
Cybersecurity strategies have traditionally concentrated on recognisable technology assets: laptops, mobile devices, servers, networks, cloud applications and user identities. Those environments remain critically important, but the boundaries of the technology estate have expanded.
Meeting rooms are more connected. Classrooms have become digitally enabled. Users expect to walk into a space and immediately access Microsoft Teams, Zoom, Google Meet, web applications, cloud content and wireless sharing. Guests increasingly connect their own devices. Displays that were once passive pieces of AV equipment now contain operating systems, applications and network connectivity.
This expansion is happening against a backdrop of mounting cyber risk.
The UK's National Cyber Security Centre described an intensifying threat environment in its 2025 Annual Review, reporting a record number of nationally significant incidents during the year. Alongside its work on technical security, the NCSC has also increased its focus on board-level governance, assurance and organisational oversight of cyber risk.
That shift towards governance is important. It reflects a wider recognition that cybersecurity cannot be addressed simply by purchasing security products. Organisations need to understand where risk exists, who owns it, how controls are applied and whether those controls continue to work as technology changes.
Shared collaboration spaces deserve to be part of that conversation.
This does not mean meeting rooms should suddenly be treated as the greatest cyber threat facing an organisation. They clearly are not. The more useful question is whether they represent an area of the technology estate where security assumptions have failed to keep pace with how the technology is now being used.
The answer may depend on what happens when one user leaves and another walks through the door.
What can actually remain after a session?
Shared-room security is partly unusual because the device does not belong to the person using it. A laptop normally has a primary user, an identity and a defined security policy. A meeting-room computer or classroom display may instead interact with hundreds of people over its lifetime.
Each interaction creates the potential for something to persist beyond the session.
Credentials: Authentication details or tokens can provide continued access to user accounts or services if they are not removed correctly
Browser sessions: A user may remain signed into email, cloud storage, collaboration tools or other web applications
Cached data: Browsers and applications may retain temporary information generated during a session
Applications: Apps can remain open, authenticated or in a state intended for the previous user
Files: Documents or media may be downloaded or copied locally and remain available after the meeting
Personal accounts: Cloud and collaboration accounts can expose information to the next person using the room
Permissions and access: Temporary changes can leave users with access that was not intended to persist
Configuration changes: Users or administrators may alter room behaviour, creating inconsistencies or weakening controls
Inconsistent policy: Different rooms may apply different security rules, making exposure difficult to identify or govern
None of these conditions automatically results in a security breach. That distinction matters. A browser left open is not the same thing as an attacker gaining access to a corporate network.
But good security is rarely based on waiting for individual weaknesses to become incidents. It is based on reducing unnecessary exposure and eliminating avoidable opportunities for misuse.
Credentials provide a useful example. Verizon's 2025 Data Breach Investigations Report research found that compromised credentials were the initial access vector in 22% of the breaches it reviewed. Credentials remain attractive precisely because legitimate authentication can allow an attacker to appear like an authorised user rather than an obvious external threat.
That does not mean credentials left on a meeting-room computer are driving a significant proportion of those breaches; Verizon's research does not make that claim. It does, however, reinforce why organisations spend so much effort protecting identities and authenticated sessions elsewhere in the technology estate.
The question for a shared space is therefore straightforward: why should that discipline end at the meeting-room door?
The real problem is not one room. It is the estate.
It is relatively easy to imagine how an IT administrator might secure a single executive boardroom. The configuration can be inspected, applications restricted, accounts checked and behaviour tested.
That model becomes much less practical when the organisation has 50 rooms across several offices, 500 classrooms across a school district, or thousands of collaboration spaces distributed internationally.
Scale introduces variation.
One group of rooms may have been deployed several years ago while another was installed last month. Hardware changes. Operating systems update. Applications are added. Security policies evolve. Different local teams make different decisions. Users discover workarounds. A temporary configuration change becomes permanent because nobody remembers why it was made.
Over time, the estate can drift away from the standard that was originally approved.
Security therefore becomes less about whether an individual room was configured correctly on the day it was installed and more about whether the organisation can maintain a known state across the entire estate.
That distinction is fundamental.
Securing one room is a configuration task. Securing hundreds of rooms is a governance problem.
Governance requires visibility. IT teams need to understand what is deployed, how it is configured, which policies are being enforced and where exceptions exist. They need a way to make changes consistently rather than relying on someone physically visiting each room. They need confidence that an update or configuration change has been applied across the estate rather than assuming that it has.
This also raises a question of ownership. Shared spaces can sit awkwardly between IT, AV, workplace technology, facilities, security teams and external integrators. Each party may legitimately own part of the environment, but fragmented responsibility can make it harder to establish who ultimately owns the security outcome.
If everyone manages part of the room, it is worth asking who is responsible for the room as a whole.
Education makes the challenge particularly visible
The scale and diversity of education technology estates makes this issue especially important for schools, colleges and universities.
The UK Government's Cyber Security Breaches Survey 2025/2026 found that 49% of primary schools, 73% of secondary schools, 88% of further education colleges and 98% of higher education institutions had identified a cyber breach or attack during the previous 12 months. The survey also found that secondary schools had experienced a significant increase compared with the previous year, when 60% reported identifying an attack or breach.
The figures become more striking further up the education system. Around a quarter of further education institutions and almost three in ten universities reported experiencing breaches or attacks at least weekly. Among further and higher education institutions that had experienced an incident, the Government also recorded unauthorised access to files or networks by both staff and students.
Again, those statistics do not mean classroom displays are responsible for the incidents. The evidence does not support that conclusion.
What the research does demonstrate is the environment in which classroom technology now operates. Education organisations are already managing significant cyber exposure while simultaneously expanding their use of connected technology. Shared teaching spaces are therefore not separate from the institution's security posture simply because their primary purpose is teaching rather than computing.
For a school IT team managing hundreds of classrooms, the challenge becomes one of making sensible security controls repeatable without making the technology harder for teachers to use.
That final point is critical.
Security cannot depend on perfect user behaviour
There is a tendency in security design to assume that the user will do the right thing if given sufficient instruction.
They will remember to sign out. They will close every application. They will remove downloaded files. They will clear the browser session. They will restore the room to its original configuration. They will check that personal information is no longer visible before walking away.
Sometimes they will.
Sometimes they will be late for their next meeting.
A teacher may have thirty students waiting outside the classroom. An executive may leave one meeting and immediately join another. A visiting client may not even know the organisation's room-security procedures. A presenter who has spent the previous hour concentrating on a high-stakes discussion is unlikely to conduct a miniature security audit before leaving.
That is not necessarily negligence. It is the reality of shared spaces.
Security controls that depend heavily on users remembering a sequence of clean-up tasks introduce human variability into the system. At small scale that may appear manageable. Across thousands of interactions, it becomes increasingly difficult to predict.
The stronger design principle is therefore to reduce the number of security decisions the user has to make.
If sessions can be cleaned automatically, they should be. If applications can be restricted centrally, there is less reason to rely on users avoiding unauthorised applications themselves. If configurations can return to a known state, the organisation reduces its dependence on someone remembering to undo a temporary change.
Good shared-space security should make the secure behaviour the default behaviour.
It should also resist the temptation to solve every security issue by adding another layer of friction. A meeting room that requires excessive authentication, complicated setup or specialist knowledge may be secure in theory, but users will search for workarounds if it repeatedly obstructs what they came into the room to achieve.
Security and usability should therefore not be treated as opposing forces. Well-designed controls can strengthen security precisely because users do not need to circumvent them.
Poor governance carries consequences beyond the room
The wider cybersecurity market provides a useful reminder of why governance matters.
IBM's Cost of a Data Breach Report 2025 calculated the global average cost of a data breach at $4.44 million. More interesting than the headline figure, however, is the report's focus on governance gaps created when technology adoption moves faster than security oversight. IBM found that 63% of organisations in its research lacked AI governance policies to manage AI or prevent shadow AI, while 97% of organisations experiencing an AI-related security incident lacked proper AI access controls.
Shared-room technology and AI are clearly different categories, and it would be misleading to draw a direct equivalence between them. The useful lesson is broader: technology that sits outside consistent governance can create exposure that organisations struggle to see until something goes wrong.
The business consequences of weak governance also extend beyond a security incident itself. They can include additional staff time, operational disruption, regulatory scrutiny, reputational damage and loss of confidence.
The UK Government's education research illustrates this operational dimension. Among further and higher education institutions that had identified breaches or attacks, almost half reported a negative outcome affecting their systems. Institutions also described impacts such as staff being unable to perform normal work and additional time being required to respond.
The objective should therefore not be to make every connected display sound dangerous. It should be to remove unnecessary uncertainty from an environment organisations increasingly depend upon.
What should secure shared spaces look like?
A useful security model for a shared space starts from the fact that the room has many users but should have one governed state.
When one person leaves, the next should not inherit their digital footprint. IT should not have to rely on local knowledge to understand how a particular room has been configured. Security policy should not change simply because somebody has walked into a different building.
Six principles follow from that:
Clean after every session. Personal credentials, authenticated browser state, files and unnecessary session data should not remain available to the next user.
Controlled by default. IT should be able to determine which applications, services and settings users can access rather than allowing the room to become an unrestricted shared computer.
Consistent across the estate. A secure-room policy has limited value if it applies to only some spaces. Security behaviour should remain predictable from room to room and site to site.
Visible to IT. Administrators need sufficient central visibility to understand room status, configuration and exceptions rather than discovering problems only when users report them.
Manageable remotely. Configuration, policy and routine interventions should not require a technician to physically visit every space.
Simple for the person in the room. Security should operate around the user wherever possible, allowing teachers, employees and guests to concentrate on the lesson, presentation or conversation rather than the technology.
These principles change the discussion from individual security features to the operating model surrounding shared spaces.
That is an important distinction. An organisation can have strong security capabilities inside individual products and still struggle with the overall estate if those capabilities are configured inconsistently, difficult to monitor or dependent on room-by-room intervention.
From room security to estate governance
As meeting rooms and classrooms become more software-defined, the divide between AV management and IT governance will continue to narrow.
The devices inside a room increasingly consume the same identities, applications, networks and cloud services as the rest of the organisation. That makes it difficult to justify a model in which their security is managed entirely outside the policies governing other technology.
The future is therefore likely to involve stronger central management of shared spaces: common configurations, controlled application access, consistent session behaviour, remote administration and clearer visibility into what is happening across the estate.
This does not require every organisation to treat a classroom screen exactly like an employee laptop. Different devices have different purposes and risk profiles.
It does require security teams to ask whether shared spaces are visible within the organisation's wider governance model and whether the controls around them reflect how they are actually used.
For many IT teams, that may mean starting with a small set of practical questions. What information can persist after a user leaves? Who can change the room configuration? Which applications can be accessed? Are the same rules applied everywhere? How quickly could the organisation establish whether a policy had been applied across every room?
If answering those questions requires manually checking individual spaces, there is likely to be a governance gap.
The meeting should end when the people leave
The best shared-room technology is often the technology people barely notice. They walk into a room, begin the meeting or lesson and focus on what they came there to achieve.
Security should work in much the same way.
Users should not have to become security administrators every time they present. IT teams should not have to hope that every person remembers to remove every trace of their session. Security teams should not have to treat hundreds of shared spaces as hundreds of unrelated exceptions.
When a meeting finishes, the technology should return to a known, controlled state, ready for the next person without carrying unnecessary remnants from the one before.
As shared spaces become more connected and more deeply integrated into everyday work and learning, that expectation will become increasingly important. Meeting rooms and classrooms are no longer simply AV environments operating at the edge of the technology estate. They are multi-user, software-enabled spaces through which identities, information and applications continually pass.
The question is therefore no longer simply whether the technology in the room works.
It is whether, when everyone walks out, the room knows how to let go.
How secure are your shared spaces when the meeting ends?
DisplayNote helps organisations make meeting rooms and learning spaces easier to manage, easier to govern and more secure by design. If you’re reviewing how shared spaces fit into your wider IT and security strategy, explore our security and governance approach.