TPN President Terri Davies and cyber insurance specialist Toby Clowes explore the growing threat of cyberattacks and the practical steps businesses can take to protect sensitive content and strengthen security across the supply chain
TPN President Terri Davies presented the ‘Fix It or Risk It’ campaign, followed by a panel discussion moderated by Shobha Conway, Head of Business Development and Operations at Union Visual Effects, and featuring Toby Clowes, Deputy Managing Director – Management Risks – Head of Cyber at Tysers. Together, they explored the growing threat of cyberattacks and the practical steps businesses can take to protect sensitive content and strengthen security across the supply chain.
Cybersecurity was the focus of INsight’26’s Fix It or Risk It session, which examined how everyday security lapses can expose post-production and VFX businesses to serious financial, reputational and operational risks — and why many of the most effective preventative measures are both practical and low-cost.
Terri Davies, President of the Trusted Partner Network (TPN), opened the session by introducing the organisation’s free Fix It or Risk It campaign. Drawing on her experience in post-production, studio operations and content security, Davies highlighted how easily routine oversights can leave companies vulnerable. Shared passwords, missing multi-factor authentication (MFA), unpatched software and unmanaged access can all create opportunities for attackers, potentially exposing valuable pre-release content.
The scale of the cybersecurity challenge
Data from more than 1,000 third-party vendor assessments conducted through TPN found non-compliance in 46% of key security areas, with 70% of identified security gaps left unremediated. Davies argued that the challenge is not simply a lack of knowledge or resources: many of the most common vulnerabilities can be addressed without substantial expenditure or time. Too often, security measures are postponed because they do not feel urgent — until an incident occurs.
The Fix It or Risk It campaign aims to make it easier for organisations to take action. Its free public website provides practical guidance, policy templates, staff training and questions to ask suppliers, with resources designed to help businesses prioritise improvements according to their needs. The campaign is open to anyone working with content, without requiring TPN membership or a formal assessment.
Davies encouraged companies to start with achievable steps, including enabling MFA, eliminating shared accounts and passwords, keeping software updated and reviewing access permissions. Addressing these basic vulnerabilities, she argued, could make a significant difference to security across the industry.
AI and the growing threat of cyberattacks
The subsequent panel, moderated by Shobha Conway and featuring cyber insurance specialist Toby Clowes, explored the growing threat landscape and the wider implications for the screen industries.
Clowes reported a 30% year-on-year increase in cyber incidents across his insurance portfolio so far, warning that artificial intelligence is making it easier for criminals to identify and exploit vulnerabilities at scale. As these capabilities develop, businesses need to strengthen their defences rather than assume that existing measures will remain sufficient.
Both speakers emphasised that cybersecurity cannot be considered solely the responsibility of large studios or dedicated IT teams. Smaller vendors may have access to sensitive content and systems, meaning weaknesses at one point in a supply chain can expose other organisations to risk. Companies therefore need to understand who their suppliers are, assess the security of subcontractors and establish clear lines of responsibility for responding to incidents.
Building security into everyday operations
The discussion also highlighted the burden of repeated security assessments across the industry. While frameworks such as TPN can support more consistent standards and improve assurance, fragmented processes and duplicated checks continue to create challenges for vendors and clients alike.
Davies discussed the need to move towards continuous assurance, embedding security into everyday operations rather than treating it as a one-off compliance exercise. This requires organisations to keep reviewing their security practices as threats evolve, rather than implementing a measure once and assuming the risk has been addressed permanently.
The panel also stressed the importance of preparing for incidents, maintaining appropriate endpoint protection and response procedures, and sharing information and lessons learned through trusted industry networks. Clowes pointed to information-sharing as an important part of effective cyber defence, allowing businesses to learn from incidents and respond to emerging threats.
Protecting content — and the people behind it
The consequences of a breach can extend beyond financial loss or reputational damage. As Neil Hatton noted in introducing the panel, compromised information relating to sensitive or contentious productions can also put individuals’ safety at risk. Cybersecurity is therefore relevant to businesses across the screen industries, regardless of their size or the scale of their productions.
The session’s message was clear: improving cybersecurity does not always require major investment, but it does require consistent action. By addressing basic vulnerabilities, reviewing supplier relationships and making security an ongoing operational priority, businesses across the screen industries can reduce risk and better protect the content and people in their care.
