Securing the media industry

The media industry faces many of the same threats faced by other industries, but the impact of a cyberattack could be far more damaging due to its potential high visibility. Many smaller and legacy media businesses are struggling to survive, meaning digital transformations are lagging and data security is at risk. It’s time to make changes.

The media industry is diverse, encompassing global and local newspapers, television networks, radio stations, online video and music streaming platforms, and publishing houses. Seismic shifts in how people consume media over the last decade have disrupted major players. In response to changing consumer demands, many have adopted digital workflows, expanded their online presence, and moved to cloud-based operations. This has introduced new security challenges, which many companies are struggling to meet.

Media companies are prime targets

Today’s media organizations, especially news operations, are prime targets for cybercriminals and nation-state actors. Well-publicized, landmark attacks over the last 13 years highlight the issues: the 2012 infiltration of The New York Times by Chinese state-sponsored actors intent on finding the sources behind reporting on [then premier] Wen Jiabao’s wealth; the 2014 Sony Pictures hack and subsequent leaking of data attributed to North Korea; the 2017 Russian state attack on French TV station TV5Monde, which resulted in multiple television channels going dark; and multiple separate ransomware attacks that caused substantial disruption to newspaper operations, including those of the Los Angeles Times, The Guardian, and The Philadelphia Inquirer. 

Reporting from Zscaler’s ThreatLabz showed ransomware attacks against media outlets increased by 32% in 2024, perhaps driven by a perception the industry may be willing to pay ransoms to avoid disruption. AI-powered threats add further complexity: Deepfakes and disinformation designed to look like authentic content from media companies mean erosion of consumer trust.

A lack of confidence in avoiding a major cyber incident

Data from Tata Consultancy Services Media and Information Services Report shows a lack of confidence among media executives about avoiding a major cyber incident. Disruptive attacks against production networks and leaking of emails and sensitive business data were highest on the list of concerns. Media risk executives also identified ecosystem partners as a key driver of risk management activity, likely due to the industry’s reliance on external partners.

The survey data also highlighted another worrying trend: across all industries, CISOs ranked Implementing models like zero trust or perimeterless security as the fourth greatest priority, after Enhancing security governance and risk management, Establishing a more robust cybersecurity strategy, and Security talent acquisition and development. 

The media industry ranked zero trust adoption tenth, perhaps due to the fact no other industry ranked as low in its adoption of cloud platforms–44% of media companies reported being ‘fully or mostly’ cloud-based, in comparison to 65% of respondents across all industries. Either way, attaching such a low priority to a proven strategy for significantly reducing the likelihood of a damaging attack is worrying.

Zero trust an effective mitigating control

Zero trust is being promoted by governments and standards bodies around the world as a best practice for cybersecurity, and has been identified in multiple cyber attack investigations as an effective mitigating control.

Firewall-based "castle-and-moat" defenses worked at one point, but are no longer fit for the purpose of defending today’s decentralized networks and distributed workforces. The boundary has dissolved in a world where employees, contractors, and third-party partners require access from various locations and devices.

Zero trust architectures move beyond traditional defenses by enforcing continuous verification and strict access controls. Instead of assuming that users or devices inside the network are safe, zero trust requires authentication at every step. This approach minimizes the risk of unauthorized access and ensures that sensitive data, intellectual property, and valuable media content remain protected from cyberattacks.

Security without unnecessary friction

Adopting zero Trust does not mean sacrificing speed or agility; it enables organizations to innovate safely, ensuring that journalists, broadcasters, content creators, and every other employee in media companies can operate securely without unnecessary friction. By taking a proactive stance, media companies can better manage risks while maintaining seamless operations.

By integrating AI-powered threat detection with zero trust principles, media organizations can further strengthen their security posture while maintaining the integrity of their content.

For most media companies, especially those organizations still reliant on legacy systems that were not designed with zero trust in mind, integration is a gradual process–a journey, not a destination–and though cybersecurity professionals understand the importance of zero trust, business leaders may need clearer explanations of its benefits. Media industry CISOs will need to win hearts and minds to get support for the change.

Only by adopting a zero trust strategy can media companies protect their assets, ensure the authenticity of their content, and build a more resilient future in the digital age.