Learn how to secure your online meetings with NCSC’s practical tips on access control, privacy, and data protection for small and medium-sized organisations.
Table of Contents
What happened
The UK’s National Cyber Security Centre (NCSC) has released updated guidance titled How to Secure Your Online Meetings, designed to help organisations—particularly small and medium-sized enterprises (SMEs)—strengthen the security of their virtual collaboration tools. This guidance comes at a time when online meetings have become a core component of business operations, driven by hybrid and remote working models.
The NCSC’s advice addresses the full lifecycle of an online meeting, from selecting a secure platform to managing participants and protecting shared content. It emphasises the importance of choosing reputable services, securing administrative accounts with strong authentication, and applying privacy controls to prevent sensitive information from being exposed. The guidance also highlights the risks posed by unauthorised access, meeting hijacking, and data leakage, which can occur through weak passwords, publicly shared links, or misconfigured settings.
In addition, the NCSC warns about emerging threats linked to AI-powered meeting assistants and automated transcription tools, which may collect and process sensitive data. Organisations are urged to understand how these features work, what data they store, and whether they comply with data protection requirements. The guidance reflects the growing sophistication of cyber attacks targeting collaboration platforms, including phishing campaigns, credential theft, and exploitation of unpatched vulnerabilities.
By following these recommendations, businesses can reduce the likelihood of cyber incidents that could lead to reputational damage, regulatory penalties, and financial loss. The NCSC’s updated advice reinforces the principle that securing online meetings is not just a technical measure but a critical element of organisational resilience and trust.1.
Why it matters
Online meetings are now a cornerstone of business communication, enabling remote work, client engagement, and cross-border collaboration. However, this convenience comes with heightened cyber risk. Every virtual meeting platform represents a potential entry point for attackers, and the rapid adoption of these tools has often outpaced the implementation of robust security measures.
Threat actors are actively exploiting weaknesses such as poor authentication practices, publicly shared meeting links, and default configurations that prioritise ease of use over security. These vulnerabilities can lead to unauthorised access, allowing attackers to eavesdrop on confidential discussions, capture sensitive documents, or impersonate participants for social engineering attacks. In some cases, compromised meetings have been used as a stepping stone for broader network intrusions or ransomware deployment.
For small and medium-sized enterprises (SMEs), the stakes are particularly high. Unlike large corporations with dedicated security teams, SMEs often lack the resources to recover quickly from a breach. A single incident can result in severe reputational damage, loss of client trust, and significant financial costs associated with incident response, legal liabilities, and regulatory penalties under data protection laws such as the UK GDPR.
The NCSC underscores that securing online meetings is not merely a technical best practice—it is a fundamental aspect of organisational resilience and compliance. Failure to implement basic safeguards can undermine business continuity, expose sensitive client data, and erode competitive advantage. As hybrid working becomes the norm, organisations that neglect these measures risk becoming easy targets in an increasingly hostile cyber landscape.1.
Key recommendations
The NCSC guidance outlines practical steps for securing online meetings:
1. Choose a trusted service
- Use official app stores or the provider’s website for downloads.
- For business use, opt for paid plans that offer enterprise-grade security features, such as user management and compliance controls.
2. Secure your admin account
- Set a strong, unique password and enable two-step verification (2SV).
- Use passkeys where supported.
- Keep applications updated to patch vulnerabilities.
3. Control meeting access
- Restrict entry to authenticated users and invited guests.
- Require passcodes for external participants.
- Enable waiting rooms (lobbies) to verify attendees before admitting them.
- Avoid sharing meeting links or passwords in public forums.
4. Protect data and privacy
- Check your surroundings and use background blur or images for privacy.
- Understand where recordings, transcripts, and shared files are stored.
- Review privacy settings and limit data retention to what is necessary.
- Be cautious with AI meeting assistants—know what data they collect and how it’s used.
Indicators & detection ideas
- IOCs: None disclosed; this is preventive guidance.
- Detection: Monitor for unauthorised meeting access attempts, unexpected recording activity, and suspicious file-sharing behaviour.
Mitigations & next steps
- Implement NCSC’s Cyber Action Toolkit for broader organisational security.
- Train staff on secure meeting practices and phishing awareness.
- Regularly review vendor security updates and apply patches promptly.
- For organisations using managed IT services, ensure providers follow NCSC’s MSP security guidance.
By following these measures, SMEs can significantly reduce the risk of compromise during online meetings and maintain trust with clients and partners.
References
1 How to Secure Your Online Meetings — https://www.ncsc.gov.uk/guidance/how-to-secure-your-online-meetings (Accessed: 2026-03-19)
[2] NCSC Cloud Security Principles — https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/ncsc-cloud-security-principles-webex-meetings.pdf (Accessed: 2026-03-19)
