Securing the signal: Ways broadcasters are tackling cybersecurity and content protection in the IP era

By Shaun Lim

As broadcasters accelerate their transition to IP-based production and streaming delivery, the opportunities for cybercriminals and pirates to strike has increased significantly.

From unauthorised re-streaming of live sports to vulnerabilities in orchestration systems, the industry faces a complex and fast-evolving threat landscape, as the threat from piracy continues to grow more sophisticated and damaging.

In the APAC region, commercialised re-streaming remains the dominant threat to content service providers, and was identified as the leading single-source threat by a recent survey jointly conducted by decode TV and Friend MTS. 

Robin Boldon, Head of Product, Friend MTS, told APB+, “We’re seeing well-organised operations re-stream live sports and premium entertainment in near-real time, often bundled at low cost to undercut legitimate services.” 

Illegal streaming devices (ISDs) and pre-loaded set-top boxes (STBs) are also a major piracy vector across the region, particularly in South-east Asia, while leaks from distribution-partner networks and organised credential theft expose broadcasters operating across complex licensing chains.

Content delivery network (CDN) leeching adds another layer of financial damage. Pirates piggybacking on legitimate distribution infrastructure effectively force broadcasters to subsidise the very services stealing from them. 

“The cumulative impact is twofold,” Boldon explained. “Revenue erosion is the most obvious impact, but damage to audience trust is just as important. Viewers exposed to malware, identity theft or poor-quality streams via pirate services often associate that experience with the rights-holder’s brand.”

The scale of the challenge is sizable. According to Frost & Sullivan’s Frost Radar: Digital Media Content Security & Anti-Piracy Services, 2026, the content security and anti-piracy market was estimated at US$1.1 billion in 2025 and is expected to grow at a CAGR of 8.5% through 2032.

This projection, said Steve Russell, SVP Global Markets, Irdeto, reflects the sustained demand for advanced content protection driven by the continued growth of over-the-top (OTT) services, live sports streaming, and increasingly sophisticated piracy ecosystems.

“That growth may accelerate further in segments such as live content protection, forensic watermarking, and real-time anti-piracy enforcement, where the need for scalable, low-latency, and intelligence-driven solutions is rapidly increasing,” he added.

Watermarking, monitoring, and the limits of isolated tools

The core technologies broadcasters rely on — digital rights management (DRM), geo-blocking, forensic watermarking, monitoring, and takedown services — are effective, but only when deployed as a co-ordinated stack rather than in isolation. 

Boldon highlighted, “Watermarking in particular remains highly effective — but it must be tailored to the specific delivery method and combined with relevant high-performance monitoring for the specific territory and content type.

“One-size-fits-all approaches simply don’t deliver.”

For live events, speed is critical. Intelligence-led dynamic server blocking represents the most effective method for enforcing IP rights in real time, yet close to 60% of respondents in the decodeTV survey said securing court orders takes too long, and dynamic server blocking remains unevenly applied across intermediaries across APAC, said Boldon.

Irdeto’s approach reflects the shift towards end-to-end solutions. The company’s portfolio combines multi-DRM, forensic watermarking, real-time monitoring and takedown, app shielding, and piracy intelligence into a unified managed service. 

A key recent innovation is high-frequency key cycling, which significantly reduces peak licence request loads during large-scale live broadcasts, enabling operators to support millions of concurrent viewers more efficiently while maintaining a high level of security and service quality.

Platform fragmentation, said Irdeto’s Russell, remains one of the most significant barriers to effective protection. “Content spread over multiple services, platforms, regions, and devices all lead to an increase in attack surface. Pirates just need to find and exploit the weakest link,” he explained.

Securing IP infrastructure from the inside out

While content piracy dominates headlines, the security of broadcast infrastructure itself is an equally pressing concern — particularly as broadcasters migrate to IP-based production environments built on SMPTE ST 2110 and similar standards.

Chris Scheck, Head of Marketing Content at Lawo, outlines how the company’s HOME management platform has responded. The latest release, HOME version 5, introduces role-based access control (RBAC), or what Lawo describes as Triple-A: Authenticate, Authorise, and Audit.

The system encrypts communication between web browsers and the HOME backend, prevents credential snooping, and allows administrators to define precise user privileges across device configuration, signal routing, snapshot management, and more.

“User authentication is based on certificates that can either be generated by Lawo or managed by a broadcaster’s IT department, whichever is more convenient,” Scheck explained. The next step on Lawo’s roadmap is traffic encryption for HOME-native devices, which is a more complex undertaking given that broadcast infrastructures typically consist of hardware and software from multiple vendors and different eras.

On the question of industry-wide standards, Scheck advocated for learning from the IT industry rather than creating new proprietary frameworks. “What certainly wouldn’t help is a multitude of proprietary approaches developed by individual vendors, because that might lead to insurmountable compatibility issues and patchy security.” 

He pointed to the EBU R 143 recommendation as a clear roadmap for cybersecurity implementation in broadcast and AV environments and emphasised that the human element remains equally important. “Never sharing login credentials, never clicking on links in dubious emails, and never trusting storage media you receive from someone else go a long way.”

Collaboration, regulation & the role of AI

In isolation, no single organisation or technology can address security threats effectively. Collaboration between rightsholders, broadcasters, technology providers, regulators, and law enforcement is now arguably the single biggest determinant of success in revenue protection.

The decodeTV survey identified improved cooperation between rightsholders and law enforcement as the top priority, with data-sharing across production and distribution chains a close second. Friend MTS’ Boldon noted that coordinated frameworks, such as AVIA’s content protection work, and shared intelligence can shift the balance against criminal networks that operate freely across platforms and jurisdictions. 

“Regulators have a particular role to play in streamlining blocking processes — vague wording around how quickly distributors must act remains a real obstacle to timely enforcement,” he argued.

On agentic AI, the picture is double-edged. Pirates are already experimenting with AI to scale operations, evade watermarks, and target potential customers, and respondents of the decode TV survey identify the trend as a major emerging threat. Yet AI is equally powerful on the defensive side, augmenting monitoring, detecting anomalies, and scaling investigations across volumes of data no human team could manage alone, said Boldon.

“We expect the most resilient broadcasters to be those that combine extensive data and smart technology with deep industry collaboration,” he added.

The convergence of IP infrastructure, streaming delivery, and increasingly sophisticated adversaries means that cybersecurity and content protection can no longer be treated as separate concerns.

While the industry is moving towards securing all solutions — hardware or software, from any vendor — within a unified, interoperable framework, the pace of that movement is likely to determine how much manoeuvrability content pirates and cybercriminals continue to enjoy in the meantime.