Session: Cyber resilience for AV: how integrators plan for the attack

• Event: ISE 2026
• From session: Building Cyber Resilience: When AV systems become part of critical infrastructure
• Speaker: Shaun Reardon, Head of Section - Industrial Systems Cyber Security, DNV Cyber
• Estimated read time: 8 minutes
• Watch the full session

Quick read summary

• Cyber resilience is the ability to withstand an attack or failure, and Shaun Reardon of DNV Cyber says it can only be achieved through planning.
• Networked AV in control rooms on rigs, ships and factories is now a possible route into critical systems.
• Industrial sites secure equipment in zones and conduits, not machine by machine as zero trust does, and AV that feeds a zone is another path into it.
• Small suppliers in the supply chain of regulated sectors can fall inside European cyber rules, whatever their turnover.
• A certificate sets a minimum. Reardon says security is a continuous process, owned at board level.
• The most serious faults he finds sit where two systems meet, which puts the integrator at the centre of the risk.

Plenty of AV businesses still treat cybersecurity as the IT department’s job, and a certificate on the wall as proof that the job is done. Shaun Reardon of DNV Cyber told ISE 2026 that both beliefs are wrong. Cyber resilience is a business risk, he said, and it is built by planning long before an attacker or a failure arrives.

Reardon spent 26 years as a Scotland Yard detective before joining DNV in Norway, where he now tests control rooms on oil rigs, ships and factory floors. Here is his method for AV suppliers and integrators whose equipment now sits inside critical infrastructure. His ISE 2025 session is summarised in 7 essential cybersecurity insights every pro AV professional should know.

Why is cyber resilience a board decision, not an IT task?

Cyber resilience is a board decision because an incident puts the whole business at stake, not only its networks. In Reardon’s words, "At the end of the day, it’s your business. It’s a business risk." His advice to integrators was to give it a champion at board level or in senior management.

A control room screen is no longer passive

Networked AV has turned the screen from a passive display into a route into critical systems. Once AV equipment runs over internet protocol, Reardon said, it brings more vulnerability into every network it joins.

Operators have to know what is going on, and trust that what they see is true. If a remote access link lets an attacker into the core industrial system, people get hurt. ISE has also covered proactive control room defence.

Does the supply chain put smaller AV firms inside the rules?

Yes, being a small supplier does not take a business outside Europe’s cyber obligations. Reardon pointed to NIS2, which puts a heavy cybersecurity burden on sectors such as health, energy and public administration. Suppliers in those sectors’ supply chains are part of the regulations too, and a company cannot argue that its turnover is too small. ISE’s guide to NIS2 for pro AV sets out the duties in more detail.

How do you plan for cyber resilience before anything goes wrong?

You plan by deciding now which systems and processes are essential, and by thinking about risk more widely than feels natural. Reardon opened with an old English saying: you cannot learn to dance five minutes before the party.

He drew a line between resilience and business continuity. Continuity is the other end: recovering once something has gone wrong. Without a plan for which systems matter most, recovery fails. He cited a recent figure that 80 per cent of small and medium-sized enterprises go bankrupt within two years of a significant cyber incident, without naming its source.

The second part of planning is imagination. Who would cut the power to a special care baby unit, or attack a power station? Both have happened. His advice was to set the scope of a risk assessment as wide as humanly possible. Security considered at the design stage also costs far less than bolting it on later.

How should AV equipment fit into zones and conduits?

AV equipment should be mapped to the security zone it connects to, and any gap against that zone’s level dealt with before it is installed. In a well-designed IT system, zero trust means no machine trusts another, and each one reauthenticates every time they interact. Reardon warned that the model is about machines, not people. Applied to staff, he said, it creates a staff problem.

Industrial sites work differently. They group equipment into zones by how much protection it needs, on security levels from 0 to 4. A conduit is how zones of the same level communicate, through encryption or other methods.

AV that feeds into a zone, or takes output from it, is another path into the critical functions. A supplier’s equipment may fall short of that zone’s needs, but it can be mitigated if it is thought about in advance.

Certificates set a floor, not a defence

A certificate proves that a minimum standard was met, not that a system is secure today. DNV is itself a certification body, which gave weight to Reardon’s warning that "conformity is not security."

ISO 27001 covers information security, and for industrial systems the reference is IEC 62443. Done properly, both are effective, but he warned against the tick-box mentality. Security, he said, is a continuous process. Policy needs the same follow-through: "a policy is just a piece of paper until it’s enforced."

Where do integrated AV systems usually fail?

They usually fail at the interfaces, where one system meets another. Reardon tested a complex new-build ship in South Korea, and the really serious problems, the ones that put lives at risk, were where two systems came together. So an integrator should not simply accept company A’s assurance and company B’s assurance. It should assure itself that security holds across the whole installation.

Liability follows the same path. If a supplier simply has its equipment certified, Reardon said, liability passes to the integrator and, ultimately, the asset owner, who will look to the supply chain to find out who was at fault. He cited the Colonial Pipeline and Maersk incidents. One failing part is enough.

How do you secure legacy kit that no vendor supports?

You secure it with compensating controls rather than ripping it out. In Qatar, his team found two computers that kept falling over, running HP-UX, a Unix system from 1984. Replacing it all, he said, will not happen in reality. Instead, add zones and conduits, extra hardware or new routing for data traffic. Once a risk is assessed, it can be refused, accepted or transferred.

A cyber resilience checklist for AV suppliers and integrators

• Name a champion: put cyber risk on the board agenda, with one senior owner.
• Write it into contracts: specify what you mean for every supplier.
• Design it in: adopt a secure development lifecycle and ask what could go wrong at the design phase.
• Read the free guidance: Reardon said IEC 62443 is free and shows which parts apply to suppliers, integrators and asset owners.
• Enforce and audit: turn every policy into a control that someone checks.

FAQ

• Is cyber resilience the same as business continuity? No. Cyber resilience is the ability to withstand a problem, an attack or a failure, and Shaun Reardon of DNV Cyber says it is achieved only through planning. Business continuity is about recovering once something has gone wrong, and he sees it as part of overall resilience.
• Does a small AV supplier have to meet critical infrastructure cyber rules? It can. Shaun Reardon of DNV Cyber says a company in the supply chain of a regulated sector, such as energy or health, is part of those regulations whatever its size.
• Can legacy equipment stay in a critical system if no vendor supports it? Yes, with compensating controls. Shaun Reardon of DNV Cyber suggests segmenting it, adding hardware or changing how data is routed, because replacing everything rarely happens in reality.

The weakest point is where two systems meet

Reardon’s sharpest point came from the test bench, not the standards. The faults that could cost lives, he found, sat where two systems joined. That puts the integrator, the business that makes those joins, at the centre of cyber resilience for any control room.

For AV firms, that changes what a good project looks like. The screen, the controller and the remote access link are no longer accessories to someone else’s critical system. They are part of it.

A business that can show a client where its equipment meets each security zone, what it has tested and who owns the risk is selling more than hardware. One that relies on a supplier’s certificate and a policy in a drawer is carrying liability it cannot see. Reardon’s final word was that security is a mindset. The question for every AV business is whether that thinking starts at the design phase, or after the incident he says is coming.

About the speaker

Shaun Reardon
Head of Section - Industrial Systems Cyber Security, DNV Cyber
Before joining DNV in Norway he was a Scotland Yard detective for 26 years, focused on counter-terrorism, organised crime and digital forensics.

Explore cyber resilience at ISE

Resilience planning is now part of every critical AV project.

• Security and emerging tech at ISE: security and emerging technologies at ISE.
• CyberSecurity Summit sessions: the summit on securing AV in critical sectors.
• The wider ISE programme: summits, Megatrends and the free ISE Open stages.
• Planning your first ISE? Read the first-time visitor guide before you go.