Dictionary.com defines trust as both a noun and a verb, including the following definitions:

• Noun: reliance on the integrity, strength, ability, surety, etc., of a person or thing; confidence
• Verb: to rely upon or place confidence in someone or something

In AV Land, the idea of trust can often be fleeting. Stories of backstabbing or stealing AV projects are not uncommon. Marketing can often be misleading, using words like “zero latency” in digital audio or video systems, when most require to 1-10 milliseconds to process data.

Cybersecurity language in AV Land is also not very trustworthy. Trendy phrases like “Zero Trust” get thrown around like a Catchbox at a trade show, and just as quickly, dropped.

Securing AV devices is often left to the network administrator or IT department, who may have no idea of their vulnerabilities or how they could be used in a cyberattack. When a vulnerability is discovered, often by a cybersecurity researcher, they are reported to the hardware or software manufacturer, and then ignored for months or sometimes forever.

The better AV manufacturers have bug bounty programs to encourage the reporting of “bugs” or “vulns”, or whatever else you would call a discovered security weakness. The best in the business will announce the vulnerability along with an appropriate update that patches the issue, or will instruct the users on how to configure the device to work securely.

But many manufacturers don’t bother. They don’t offer an easy way to contact them. They don’t fix the bug when it gets reported; oftentimes, they don’t even respond until it gets published online, then scramble to issue a patch, and say they have no reports of the vuln ever being used “in the wild.” Well, if it had been used in an attack, do you think it’s possible that no one noticed?

AV technicians, programmers, or engineers who discover a vulnerability often don’t know if they should report it, or ignore it. Who will help them verify and document their possible bug in a safe research lab? Who will back them up when the AV brand refuses to patch or even acknowledge the issue? In the words of the famous 1980s movie, “Who you gonna call?”

Answer: AV Trust

On Feb. 26, 2026, a Non-Profit Security Organization for the Commercial Audio-Visual industry was launched. According to the presser,

“Founding members Douglas Schaefer (President), Colin Birney (Vice President & Treasurer), and Frank Padikkala (Secretary) created the organization with the mission of advancing cybersecurity in AV and unified communications technology through community education, research and communication about vulnerabilities and security standards frameworks. AV Trust will serve as an independent, trusted resource for identifying, cataloging and communicating security vulnerabilities and best practices in audiovisual and unified communications systems.”

I reached out to Colin Birney to get some more information about this new group.

Paul: Why did you and your partners decide to start AV Trust?

Colin: “I’ve learned in my many (ugh) years in the industry that change happens when it’s driven by a collective movement that cares about that change. Manufacturers, integrators, and consultants don’t generally start to change unless there is an overwhelming push that overrides their sense of comfort. Take APIs, for instance – while those became commonplace across most technology products, we resisted and continued to run our hardware as black boxes until it became financially harmful to not provide them. Even now, we’re still waiting on products to come up to speed. Security is the same way. We are very reactive to providing better security on products and in practice when installing, integrating, and managing devices. While I’m sure eventually change will come, it’s not soon enough. Last InfoComm I had serious discussion with peers and manufacturers, held panels that touched on security issues, and spent time exploring security as a practice within our industry. While some are on the right track, and a few even excelling, overall, we’re very uneducated. At the same time, I began spending more time with security communities. IoT security is a rising field and just now hitting the mainstream of cybersecurity as an important focus. I got together with a few like-minded people, and we started this project. AV Trust is a way for us to accelerate the timeline for adopting security practices and, more importantly, exposing the AV industry to security professionals. We want to provide a path for creating a culture of security across all aspects of the industry, events to facilitate learning, standards that will help protect our customers, and a clear way for the security industry to work with us to root out issues before they become major, and widely reported, incidents.”

Paul: And why is this important?

Colin: “Commercial AV is everywhere. It’s in every conference room, huddle room, event space, restaurant, retail space; our technology permeates public life, corporations, universities, hospitals, and all levels of government. As we’ve grown and become a part of everyday life, there’s a new classification for what we are – Internet of Things (IoT). Security and IT professionals now have a way to classify what we do and create rules around us. While we don’t want to be linked with the $5 IP camera you get on [large online retailer], the unfortunate fact is that we are. We currently are treated with distrust and while we want to be online to gain all the benefit of constant remote alerting, monitoring, and management, we have not shown the adequate security maturity to earn that place. AV Trust is a collective that can help provide all aspects of the industry with credibility around security. Some devices just can’t be securely placed on a production network, but many can. At this moment, though, we don’t have that differentiation. We also have issues in how we relate to IT and security teams. We try to fly under the radar, use non-standard methods of control, and like to leave behind unmanaged switches and PCs as we create our systems. That needs to change. It exposes all of us to risk and we’ve seen from very public reporting on data breaches, the cost reputationally and financially can be devastating. This is also a body that can help stave off eventual regulations. We’ve seen the UK, EMEA, and California start putting stricter security measures on IoT devices. These are the right moves, but we are not currently at the table helping to lobby for logical changes and in our best interest. Groups like NSITSP have taken the largely unregulated, unlicensed industry of IT MSPs and started to be a part of writing state-level legislation regulating that industry. It’s my hope that the blend of customers, integrators, consultants, customers, and security professionals at AV Trust can start working towards those lofty goals. I don’t want to have security standards dictated to us, I want us to be part of creating them.”

---

AV Trust is the first group of like-minded individuals formed in the AV industry with the specific goal of cybersecurity. No more “best practices” that are generic and instantly outdated when they are published. No more claiming your products are secure without third-party testing and certification. No more sweeping the bugs under the rugs.
AV Trust is here, and it ain’t afraid of no bugs.