The shift to AV-over-IP delivered massive operational benefits. Dante, NDI, SMPTE 2110, and similar protocols replaced rigid analog and SDI infrastructure with flexible, scalable IP networks.
But in 2026, a new and dangerous problem has emerged. Frontier AI models are collapsing the time between vulnerability discovery and real-world exploitation.
This changes the risk equation for every connected system, but it hits AV-over-IP networks especially hard. Most AV endpoints are "set and forget" devices. Many manufacturers move slowly on security updates. And unlike modern IT infrastructure, AV gear was never designed with rapid patching or strong authentication in mind.
When you combine these realities with AI-accelerated attacks, you get a class of infrastructure that is quietly becoming one of the softer targets in enterprise environments.
This article explains why traditional security approaches are falling further behind, and what organizations can actually do about it.
The AI Threat Window Has Collapsed
In 2026, Anthropic developed a powerful frontier model called Claude Mythos. Because of its extraordinary ability to discover and exploit vulnerabilities, the company chose not to release it publicly. Instead, they launched Project Glasswing — a controlled initiative with major technology and security organizations including Cisco, CrowdStrike, Palo Alto Networks, and others — to use the model defensively before it could be turned against the world.
This decision highlights a new reality: frontier AI models are dramatically accelerating vulnerability research and exploit development. What once took skilled human teams weeks or months can now be accomplished much faster. Industry data shows the median time-to-exploit for many vulnerabilities has collapsed from weeks or months just a few years ago to days or even hours in 2025–2026, with some cases seeing exploitation before public disclosure. The window between discovery and weaponization is shrinking rapidly.
Source: Zero Day Clock / Industry vulnerability trend data (2026)
This change hits AV-over-IP networks particularly hard. Most AV manufacturers operate with far less security maturity than traditional networking and cybersecurity giants. Many move slowly on patching, publish few security advisories, and lack the dedicated vulnerability management programs that companies like Cisco and Fortinet have built over decades.
Why Most AV Manufacturers Are Unprepared
The AV industry as a whole lags significantly behind modern IT and networking vendors when it comes to security operations. Even larger AV manufacturers like Crestron publish relatively few security advisories and typically have slower firmware update cycles. Unlike Cisco, Fortinet, or Palo Alto Networks — which maintain large security research teams, active bug bounty programs, and rapid response capabilities — most AV vendors were built around reliability and interoperability rather than adversarial defense.
This structural gap becomes much more dangerous in the age of AI. Frontier models lower the barrier for attackers to analyze niche protocols (Dante, NDI, SMPTE 2110, etc.) and develop targeted exploits. At the same time, many AV endpoints remain "set and forget" devices running outdated firmware with weak or default credentials. The result is a widening asymmetry: attack capabilities are advancing rapidly while defensive posture on most AV networks remains relatively static.
Why Traditional IT Security Falls Short
Standard enterprise security stacks often create more problems than they solve in AV environments:
- Deep Packet Inspection (DPI): Frequently breaks real-time media flows or introduces unacceptable latency.
- Port-based Security: Ineffective because AV protocols use dynamic ports and heavy multicast.
- Endpoint Agents: Many AV devices cannot run traditional EDR agents.
- Lack of Behavioral Baselining: Static rules don't account for normal AV behavior patterns that change based on events, schedules, or productions.
When attacks can be developed and adapted in hours instead of weeks, reactive and signature-based defenses become even less effective. AV networks need approaches that focus on behavioral deviation rather than known-bad patterns.
Best Practices for Securing AV-over-IP Networks
Here's a practical 2026 security framework:
- Proper Network Segmentation — Use dedicated AV VLANs with strict Layer 3 boundaries. Consider micro-segmentation for critical production networks.
- Multicast Control — Implement IGMP snooping and Querier functionality. Limit multicast flooding with proper switch configuration.
- Zero-Trust Principles for AV — Verify every device and flow rather than trusting the network. Use device profiling and allow-listing.
- Regular Firmware & Credential Hygiene — Schedule firmware updates and enforce unique, strong credentials (or certificate-based authentication where possible).
- Incident Response Runbooks — Prepare specific playbooks for AV-specific incidents (e.g., rogue Dante device, multicast flood, sudden traffic spike).
- Behavioral Monitoring — Monitor network flows (NetFlow, IPFIX, sFlow) to establish a baseline of normal device behavior and alert on deviations.
Key Takeaways
- Frontier AI models are collapsing the time between vulnerability discovery and exploitation, and AV-over-IP networks are structurally exposed due to slow patching cycles and limited visibility.
- Traditional IT security tools (DPI, port-based controls, and endpoint agents) were not designed for real-time media protocols or the current speed of AI-driven attacks.
- The most effective defenses in 2026 combine strong network segmentation with behavioral monitoring of network flows (NetFlow, IPFIX, sFlow) rather than relying solely on signature-based or manufacturer-driven security.
- MSPs and organizations managing AV environments should treat these networks as high-value assets and build proactive, AV-aware visibility and incident response capabilities now.
- The gap between attacker capability and defensive readiness will continue to widen unless AV security is elevated from a secondary concern to a core part of network defense strategy.
Conclusion
AV-over-IP delivered real operational advantages, but the security model around it has not kept pace. As frontier AI models accelerate both vulnerability discovery and exploit development, the gap between attacker capability and defensive readiness is widening — particularly for AV networks that were never designed for this threat velocity.
The organizations that will thrive in this new environment are the ones that stop treating AV systems as "set and forget" infrastructure and start applying the same rigor to visibility and behavioral monitoring that they already use for traditional IT assets.
What you can do today:
- Audit your AV network segmentation and multicast controls
- Implement flow-based monitoring (NetFlow, IPFIX, or sFlow) to establish behavioral baselines for your Dante, NDI, and ST 2110 environments
- Build AV-specific incident response playbooks rather than relying solely on manufacturer updates
- Evaluate solutions that provide agentless, protocol-aware visibility without introducing latency or complexity to your media streams
The threat landscape is evolving faster than most AV manufacturers can respond. MSPs and AV professionals who build proactive, network-level defenses now will be far better positioned as AI-driven attacks become more common in 2026 and beyond.
FAQ
Can traditional SIEM tools effectively monitor AV-over-IP environments?
Traditional SIEMs can ingest flow data, but they often lack the AV-specific behavioral models needed to distinguish normal multicast activity from malicious behavior. Specialized flow analytics or AV-aware monitoring tools tend to deliver better results.
Does enabling NetFlow, IPFIX, or sFlow impact AV network performance?
When properly configured with sampling, modern flow exporters have minimal impact on performance. The visibility gained usually far outweighs any small overhead.
How should MSPs approach segmentation for Dante and other AV protocols?
Use dedicated AV VLANs with strict Layer 3 boundaries. For discovery protocols like mDNS, consider controlled mDNS reflection or dedicated AV controllers rather than allowing broad broadcast domains.
Why are AI-driven attacks particularly concerning for AV systems?
AI lowers the barrier for analyzing niche protocols and developing exploits quickly. Combined with slow firmware update cycles and limited visibility on many AV devices, this creates a widening gap that traditional reactive security approaches struggle to close.
What's the single most important step organizations can take right now?
Establish behavioral baselines for normal AV traffic using network flow data. This allows detection of anomalies (rogue devices, unusual multicast patterns, or sudden traffic spikes), without relying on deep packet inspection that can break real-time media.