Issue link: https://digital.copcomm.com/i/1547041
SECURITY www.postmagazine.com 21 POST SEPT/OCT 2026 ost production no longer moves in one direction. Camera orig- inals, VFX plates, audio stems, color grades and localization assets are all in play at once. AI tools are accelerating that shift, with work running in parallel across facilities, cloud platforms, free- lancers and vendors. That flexibility is essential, but it means content changes hands, systems and networks many times before delivery. Each handoff is a moment where securi- ty can hold or a gap can open. That's the idea behind "Fix It or Risk It," a free, industry-wide campaign that provides practical guidance and tools to help teams close common security gaps — because every security incident has an origin story. It starts with an ordinary decision: a shared password, an account that stayed active after someone left a project, a critical software update post- poned during a delivery, a review link left open or sensitive information pasted into an unmanaged AI tool. None of these moments look like a breach. They look like getting the job done. Security has to work at production speed Post teams solve problems fast. A missing file, broken conform or late VFX shot can't wait. Security needs the same practical mindset. The goal isn't to add friction. It's to recognize where small choices can create unnec- essary exposure and build better habits around them. Start with access. Who can get to the project right now? Who actually needs to? Access should change as the pro- duction changes. Someone who needed a system during editorial may not need it during final delivery. Review accounts and permissions on a regular schedule. Multi-factor authentication should be standard, especially for email, cloud storage, remote access and systems holding sensitive assets. Strong, unique passwords matter too. A password man- ager makes that realistic in a way that expecting people to remember dozens of credentials never will. Look at the spaces between systems AI tools are part of many post workflows, creating a new kind of gap. A transcript pasted into a public chatbot, a still uploaded to generate a reference, or a script fed into a summarizer — they leave your control the moment they're submit- ted. The fix isn't to ban the tools. It's to decide, in advance, which are approved for production material and make sure people know before deadline pressure decides for them. Risk often appears between tools: a file moves between platforms, a temporary transfer method becomes permanent, a freelancer gets broader access than required or a vendor re- ceives an entire folder when they only need three shots. Before sharing assets, ask: Does this person need download access? Should the link expire? Can access be limited to named users? Is anything else visi- ble? Those checks take seconds. Fixing the consequences of an exposed asset doesn't. Production systems can be complex, and nobody wants an update to interrupt an edit, render or mix. But postponing critical patches leaves known vulnerabili- ties open, and they're the ones attackers look for first. It starts with an inventory: you can't patch a system nobody remembers is running. Know what you have, who owns it and how it's kept current, including the render node, transfer appliance and legacy box used for archive work. Your vendors are part of the workflow A project can involve multiple technol- ogy providers and specialist contribu- tors, so security expectations need to travel with the content. Before sending assets to another organization, under- stand how they'll be received, stored, accessed, and returned or deleted. Confirm who has access and whether subcontractors are involved. Ask for it in writing before the first file moves and put deletion confirmation on the same checklist as final delivery. This isn't about treating vendors as a problem. It's about making security part of normal production planning alongside delivery specifications, schedules and technical requirements. Make the next fix manageable Security can become overwhelming when everything is presented as ur- gent. Fix It or Risk It takes a different approach: identify what can realistically be improved now, then keep going. Free guidance and tools help teams identi- fy practical next steps, from fixing one exposed link to building a longer-term security roadmap. Fix it this week: enable MFA on critical accounts, remove unnecessary access or close an exposed sharing link. Fix it this month: clear access from finished projects. Write down what to do in the first hour of an incident: who's called, who kills access, who contacts the client. Fix it this quarter: identify where your security gaps are and create a roadmap to keep working against them. Progress means making security part of the normal operating rhythm, rather than waiting for a transforma- tion project. Post production will keep getting more connected. Cloud workflows, remote collaboration, AI-assisted tools and distributed teams will create new possibilities — and new moments where content can be exposed. Readiness is built in everyday decisions: who gets access, how assets are shared, when systems are patched and what happens when a project ends. Every breach has an origin story. The best time to change it is before anyone has a reason to tell it. Find free guidance and tools at fixitorriskit.org. EVERY HANDOFF REPRESENTS A DECISION BY TERRI DAVIES PRESIDENT TRUSTED PARTNER NETWORK HTTPS:// TRUSTEDPARTNER NETWORK.ORG EVERY SECURITY BREACH HAS AN ORIGIN STORY P