Listen to this episode on:
Spotify
Apple Podcasts
YouTubeScreenly Changelog episode 20: Digital Signage Security, Cheap Hardware, and What the Screen Is Really For
A screen on the wall rarely looks like a security risk. It shows the lunch menu, a safety notice, and this quarter’s numbers. But every one of those screens runs on a connected device sitting on your network, and that is where digital signage security either holds up or quietly falls apart.
In this episode of the Screenly Changelog, Viktor Petersson and Daniel Mountcastle sit down with Mark McDermott, co-founder and former CEO of ScreenCloud, a digital signage platform built for workplaces. Mark and Viktor met around 2014 as outsiders to the industry. Both built their companies on the same bet: that cheap consumer hardware could replace the PC behind every screen.
The conversation looks at how that bet holds up a decade later, from the hidden cost of low-priced players to the fleet failures that shaped how both companies build today. Watch the full conversation above or read the highlights below.
Outsiders saw a software problem
Mark came to signage from web development. When he tried to put four office TVs to work, a reseller quoted him around £15,000. He built an app instead, first on the Chromecast and then on the Fire Stick, and one of the biggest names in the industry laughed him out of the room for it.
Viktor’s path was similar. Screenly began with a small signage network in Sweden that was still running Flash, and the Raspberry Pi made it clear that a $35 board could do the job of a $500 player.
The takeaway is straightforward. The industry treated screens as an installation project. Outsiders saw a software distribution problem.
Cheap hardware has a hidden price
Memory prices have changed the economics of signage hardware. The memory module on a Raspberry Pi now costs more than the entire board used to, and that pressure pushes buyers toward the bottom of the market.
Viktor brought an example: a T95 Android box from Amazon with 4GB of RAM and 64GB of storage. It took 30 seconds to compromise.
Mark has championed low-cost hardware for most of his career, but he is clear that there is a price that is too low. If a box with that spec lands under $100, the components don’t add up, and something else is paying for it. Spending up to $200 on a player that lasts five years, driving a panel that can last ten, is a sound investment.
A screen is part of your network
That something else is not hypothetical. A recent case involved Android players that monitored the HDMI state and, whenever the TV was off, sold their connection as a residential proxy.
Large enterprises have long isolated these devices on separate VLANs. Mark’s view is sharper: segmenting a device is an admission that it will never be fixed. A screen belongs in the same category as a laptop or a phone.
The real risk isn’t a hijacked display. That’s embarrassing, but it can be fixed. The bigger concern is a compromised player used as a quiet stepping stone into internal systems. With attackers using AI agents that probe everything at almost no cost, being small no longer offers protection.
Regulation is catching up with a market failure
The EU is now addressing this directly. Soft enforcement of new cybersecurity requirements for connected devices began on September 11, and hard enforcement follows in December next year. The rules sit alongside CE marking.
Liability falls on the vendor, including anyone who white-labels a device and sells it under their own name. For buyers, the guidance is practical. Anything purchased in the next 12 months should already be compliant, because it needs to last at least five years.
Viktor is not usually in favor of heavy-handed regulation. In this case, he sees a market that was never going to correct itself.
Fleets fail in ways no test lab predicts
Both companies have scars from running hardware at scale. In 2019, a cosmetic variable rename in a ScreenCloud Fire Stick update blacked out screens that had been paired for more than nine months. The fix then waited in Amazon’s approval queue over the Labor Day weekend.
At Screenly, Raspbian lacked the rollback guarantees a fleet of thousands needs. The move to Ubuntu Core couldn’t be done safely over the air, so we sent customers SD cards to reflash. Years later, the devices that never migrated went dark when their root certificate expired.
A fleet failure is never one thing. It is several small conditions lining up at once. That is why we are now rewriting our players in Rust, for memory safety and long-term reliability.
Supporting everything is not a strategy
Both companies started out trying to support every device customers asked for. Both have since moved to a tiered approach: their own hardware gets full remote management and long-term support, while existing devices are supported where it makes sense, with fewer guarantees.
The reason is fragmentation. There is no such thing as supporting Android, only supporting a specific configuration in a specific package. And when signage fails, it fails in public, with the IT lead who championed the product taking the heat.
The product is what ends up on the screen
The episode closes on a question the industry rarely asks: what is the product?
Mark’s answer is that it isn’t the hardware, the OS or the CMS. It is whatever ends up on the screen. Is it legible? Is it timely? Is it understood by someone walking past in three seconds?
Much of today’s screen content wasn’t designed for that. Dashboards are built for analysts at a desk, not for a wall across the room. Mark sees AI as the way to close that gap, by adapting content to each screen’s location and audience.
What we are taking forward
The central insight from this episode is that cheap hardware is rarely cheap. The cost shows up later, in security exposure, unpatched devices and failures nobody can physically reach.
For teams managing digital signage and distributed infrastructure, the implications are clear. Every player is part of your security boundary. Updates and rollbacks need to work for the full life of the device, not just the first year. And regulation now makes this the vendor’s responsibility, not just good practice.
Secure digital signage is what keeps the right content on every screen, year after year.
The full episode is available now.
Deploy secure, enterprise-ready digital signage
Experience the platform firsthand. Start your 14-day free trial of Screenly today.
