Digital signage security: the four practices, and who is responsible for each

A connected screen is not just a screen

Digital signage security is first a problem of ownership: the screen is often bought by communications, installed by an integrator and forgotten by IT. Technically, though, it is a computer with an operating system, on the same network as the rest of the building. If it is compromised, the risk is not that the wrong picture shows up: it is that an attacker gets an entry point to everything sharing that network.

That is why the question comes up as early as the tender stage and in every security questionnaire. It is also usually asked badly: it goes to the software vendor alone, when half the answers do not belong to them.

What the public sources say

In a study reported in January 2025 by the trade press, HKCERT, Hong Kong's CERT, tested eight digital signage brands and found 20 vulnerabilities, 10 of them high-risk. One device was fully compromised in roughly three seconds. The same body reports, in its Hong Kong Cyber Security Outlook 2025, that 39% of the Hong Kong organisations surveyed run no cybersecurity risk assessment on their signage systems.

Internet-exposed hardware is a demonstrated attack surface. On 25 June 2026 the US CISA published advisory ICSA-26-176-04 covering three vulnerabilities in a family of controllers driving large-format LED displays and highway signs: combined, they let an unauthenticated attacker take complete control of the system. The researcher quoted reminds us that avoiding direct internet exposure is the operator's job, whatever firmware the manufacturer ships. The patch exists: the example illustrates a configuration, not a fate.

In April 2025 the digital menu boards of a Canadian quick-service restaurant chain, across nearly 300 locations, were taken over and made to display unauthorised political messaging. The way in was a third-party signage provider, not the restaurant's own network: the supply chain is inside the perimeter.

The four practices everyone converges on

Two different kinds of source describe the same foundation: AVIXA, the pro-AV trade association, in a guide published in September 2025, and the Hong Kong CERT cited above. One structures it as four practices, the other as six areas that cover the same ground.

Harden the player

The media player is the physical, reachable part of the installation. Use a tamper-resistant enclosure, disable unused USB and HDMI ports, and prefer enterprise-grade hardware with secure boot. The platform choice matters too: we have written elsewhere about what a Raspberry-class player changes across a fleet.

Segment the network

Put signage on its own VLAN or subnet. This is the measure that turns a compromised screen into a contained incident rather than a route into point-of-sale, HR or line-of-business systems. No software feature replaces it.

Keep patching

Operating system, signage software, firmware: a scheduled cadence, not updates deferred because the screen "works". A heterogeneous fleet makes that discipline tedious, which is why it slips.

Lock down remote access

Secured Wi-Fi, rotated credentials, unused ports closed. Remote access is what makes a fleet operable without a site visit; it is also what makes it attackable without one.

Who is responsible for what

This is where security questionnaires miss the point. These four practices do not have the same owner.

At Touchify, the platform is ours (hosting, encryption, isolation, backups, patching the service). The users and the devices are the customer's: their identity provider, their roles, their joiners and leavers, their screens and their players.

Here is one way to picture the split:

For an integrator that split is not an excuse: hardening and segmentation are already part of the trade. The boundary describes a division of labour, not a gap.

Seeing the fleet comes before everything else

The platform helps the customer on their side of the line: it inventories and monitors devices automatically. The customer owns the screens, and the software lets them see the fleet: which operating system, which player version, online or not, and since when.

You cannot patch what you do not know you own. A current inventory is where patch management starts, and it lets you respond to an incident without reconstructing everything first.

This is advanced supervision seen from the security side. Advanced supervision is a recent release: ask your Touchify contact whether it is enabled on your tenant.

Our security posture

Here are a few facts describing the platform, for information. You can ask our team for full documentation. We have already covered data management; these facts are its infrastructure counterpart.

• EU-only hosting, on two European providers, with France as the default data region and residency configurable on request.
• Encryption in transit over TLS 1.2 and 1.3, with no fallback to a weaker version. At rest, FIPS 140-2 compliant encryption across databases, file stores and backups.
• A customer's data is isolated from every other customer's.
• SSO via SAML and OpenID against the customer's own identity provider, two-factor authentication available, and role-based access control with permissions at organisation and team level on an Enterprise organisation: see the administration page.
• Vulnerability scanning runs on every change and blocks any deployment carrying a critical flaw. Scanning that only reports is table stakes, not an argument.
• Recovery objectives: Touchify targets a recovery time objective (RTO) of 2 hours and a recovery point objective (RPO) of 4 hours. These are objectives, not a contractual commitment.
• The cluster configuration does not depend on the provider running it, so a new cluster can be started elsewhere.

The questions worth asking before you sign

Ask the question in the right place

Rather than "is your software secure?", ask: here are my four lines, who holds each one, and what can I see of my own fleet? If you are scoping a project or working through a security questionnaire, we are happy to answer that question.