Session: Cybersecurity risk management for public screens: the danger sits in the joins

• Event: ISE 2026
• From session: Protecting Digital Public Spaces in a Time of Cyberwar
• Speakers:
  • Neal Romanek, Founder, ¡AU!
  • Shaun Reardon, Head of Section - Industrial Systems Cyber Security, DNV Cyber
  • Irina Dymarsky, Executive Tech Leader and CIO, AVIXA
• Estimated read time: 8 minutes
• Watch the full session

Quick read summary

• Cybersecurity risk management for public spaces starts with the worst outcome and funds recovery, because an incident will happen.
• Hostile messages on airport screens showed how much the public trusts the screens around it.
• DNV Cyber’s Shaun Reardon would spend 40 per cent of a budget on defence and 60 per cent on identification and recovery.
• The most serious risks sit where systems and suppliers meet, so audit rights belong in every vendor contract.

Neal Romanek opened by asking the room whether it remembered the airport attacks of the past year. Screens in several North American airports had carried hostile political messages, and within a couple of months check-in systems at European airports crashed for days. For the pro AV channel that builds those screens, he argued, cybersecurity risk management is now part of the job.

Romanek, Founder of ¡AU!, moderated the panel at ISE 2026 in Barcelona. With him were Shaun Reardon of DNV Cyber and Irina Dymarsky, CIO at AVIXA. Their question: when a public space is a patchwork of venues, sponsors, integrators and vendors, who owns the risk, and where should the money go?

Reardon had set out the basics a year earlier in 7 essential cybersecurity insights every pro AV professional should know. This panel went further, into budgets, rehearsals and contracts.

Why would anyone attack an airport departure board?

An attacker targets a departure board because people trust it without thinking. Reardon said terrorism is about "making people unsure, disrupting society, causing panic in some circumstances." Two emergency signs tell crowds to go left and right, and two groups of panicked people meet in the middle.

An offensive message, Romanek suggested, is closer to vandalism than catastrophe. Reardon agreed, then raised hybrid warfare, attacking in more than one way at once. Confusing screens on their own may be minor. Add misrouted food deliveries and heating switched off in a cold snap, and the same airport tips into panic.

Who owns the risk when every supplier brings its own pieces?

No single party owns the risk at a shared venue, Dymarsky argued. At ISE itself, tens of thousands of visitors bring their own devices, the conference centre runs its own wifi, and the organisers and partners sit on top.

Her analogy was a puzzle in which everyone brings their own bag of pieces and nobody is sure what picture they are making. So every party should agree, before the event, what happens if the venue wifi fails, and who plays which role. ISE has also covered why live events need to treat every connection as a risk.

Why does cybersecurity risk management start with recovery?

Cybersecurity risk management starts with recovery because, Reardon argued, the incident will happen. When the screens go dark, does it matter at first whether the cause was an attack, an accident or negligence? His answer was no.

His method is to identify what must work without any doubt, such as safety or revenue, then work backwards to decide where to train, plan and spend. Given a million dollars, he would put 40 per cent into defence and 60 per cent into identification and recovery. A salesman who promises that a new firewall means you will never be hacked should be shown the door.

How does a business impact analysis change the board conversation?

A business impact analysis changes the conversation by asking about the business, not the technology. Dymarsky starts with the most critical system, which might be a CRM or email.

If the business cannot run, that system goes to the top of the list. For a venue, Reardon’s test points the same way: the screens that carry safety or revenue come first.

Bow tie analysis shows what a policy cannot

Bow tie analysis shows what happens after the worst case, which a policy never does. The knot in the middle is the worst case. On the left sit the causes, each blocked by more than one control. The right-hand side assumes the event has happened, through a zero day vulnerability for example, and asks which controls limit the damage. That shows the board what to fund.

Reardon added a warning. A policy nobody enforces, he said, is just a piece of paper.

Tabletop exercises matter more than certificates

Tabletop exercises matter more because they settle who does what before a crisis. Dymarsky said any crisis needs run books, checklists and named roles, down to who emails staff and customers. "Don’t worry that you’re not certified or that you’re not entirely compliant with every checklist." What counts first is a culture in which people talk about risk and know the first step.

How should vendor risk management work in a contract?

Vendor risk management should work through the contract: set the security terms, then check them. Reardon said European legislation such as NIS2 virtually forces a regulated buyer to pay more for the supplier with staff training and a continuity plan. Insurers will take the premium but will not pay out on negligence.

Reardon’s example made the point. His team assessed four systems on a floating liquefied natural gas vessel at a shipyard in South Korea. Each had faults, such as default passwords. The risks to life, though, sat where the systems joined, and each supplier could say its own contract was met.

His remedy was blunt. Write security into supplier contracts, then check it through an audit. A supplier that will not accept an audit should not be used.

One platform, or a specialist for what matters most

Asked whether one vendor could ever manage it all, Dymarsky said not quite yet: standardise where suppliers are similarly mature, and choose a specialist for whatever is most critical. Reardon saw the harder problem in people, not hardware, because the IT teams and the engineers who run operational technology (OT) think in different ways.

A pre-event checklist from the panel

• Critical systems: list every screen that carries safety information or revenue, and agree how long each can be down.
• The puzzle: record every party on site and who owns each interface.
• Worst case: draw it as a bow tie, and weight spending towards recovery.
• Rehearsal: walk through a crisis with suppliers, with a run book naming who sends which message.
• Contracts: write audit rights into every supplier contract, and carry the audits out.

FAQ

• How should a venue set priorities in cybersecurity risk management? A venue should set priorities by outcome, starting with the systems that must never fail. Shaun Reardon of DNV Cyber would spend 40 per cent of the budget on defence and 60 per cent on identification and recovery.
• Who is responsible for cyber security at a shared venue or event? Responsibility is shared between the venue, the organiser, sponsors, integrators and every vendor on site. Irina Dymarsky of AVIXA says they should agree crisis roles before the event.
• Should an AV buyer use a supplier that refuses a security audit? No, according to Shaun Reardon of DNV Cyber. He advises writing audit rights into every supplier contract, because the most serious risks sit where systems from different suppliers meet.
• Can one security platform protect every system in a venue? Not yet, according to Irina Dymarsky of AVIXA. She recommends standardising where suppliers share a similar maturity and choosing a specialist for the most critical systems.

The danger sits where the contracts meet

The airport incidents that opened the session looked like a story about screens. By the end, the panel had made it a story about joins. Reardon’s shipyard is the image to keep. Four systems were tested, each supplier could say its contract was met, and the danger to life still sat where those systems touched.

That is what a public space is: a set of interfaces owned by different people, each confident in its own piece of the puzzle. A firewall does not cover the join between two suppliers. What covers it is a conversation before the event, a contract that names the audit, and a rehearsal that shows who acts when a screen tells crowds the wrong thing.

For integrators, that makes security something to sell. Reardon’s advice was to assume the incident is coming and fund the recovery. Between them, the panel described the first protection any venue can put in place: knowing in advance who owns each join.

About the speakers

Neal Romanek
Founder, ¡AU!
Romanek moderated the panel at ISE 2026.

Shaun Reardon
Head of Section - Industrial Systems Cyber Security, DNV Cyber
Reardon assesses the security of industrial systems on oil rigs, in factories and at shipyards.

Irina Dymarsky
Executive Tech Leader and CIO, AVIXA
Dymarsky heads AVIXA’s IT department.

More on securing public screens

Public screens bring signage and security teams together.

• Security and emerging tech at ISE: security and emerging tech on the show floor.
• CyberSecurity Summit sessions: talks on keeping AV systems safe.
• Digital signage at ISE: the public screens and DooH networks at stake.
• The full ISE content programme: Megatrends sessions, summits and free stages across the show.
• New to ISE? Get your bearings with the first-time visitor guide.