Communication software is software used to exchange messages, voice, video or files between people or systems. It includes email, chat, messaging, conferencing and collaboration tools, and often supports identity-based access controls, encryption and retention settings for the communications it carries.
What Communication Software Does
Communication software is the collaboration layer that lets people or systems exchange messages, voice, video, and files. Its value is not just transport, but the workflow around it: who can join, what can be shared, how long content persists, and whether the exchange is protected in transit and at rest.
Because it carries business conversations and shared content, communication software often becomes part of the organisation’s security boundary. The same platform can support routine collaboration, incident response, customer support, or system-to-system notifications, so its design choices affect both usability and control.
Security Implications of Communication Software
The security profile of communication software is shaped by its mix of identity, content, and retention features. Access control determines who can see channels, meetings, or shared files; encryption reduces exposure on the network; and retention settings affect how long sensitive communications remain available for review, discovery, or compromise.
These tools can also become a route into other systems. A compromised mailbox, chat workspace, or conferencing account may expose sensitive data, trusted contacts, internal links, or file-sharing invitations. Where the software supports plug-ins, bots, webhooks, or external integrations, the trust boundary widens and the consequences of a weak integration increase.
How Organisations Evaluate Exposure
Exposure assessment starts with inventory: which communication platforms are in use, which business units rely on them, what data moves through them, and which integrations or guest accounts extend access beyond the core tenant. Internet exposure matters too, especially for externally reachable meeting services, federated collaboration, or public file-sharing links.
Vendor documentation should be checked for security controls that matter in practice, including encryption behaviour, logging, administrative controls, retention options, and tenant isolation. For communication tools that are tightly integrated with identity and access management, organisations should also verify whether conditional access, MFA, and administrative separation are enforced consistently across chat, mail, conferencing, and mobile clients.
Control Choices and Design Trade-offs
Communication software is rarely secure by default once it is widely adopted, because convenience features often expand the attack surface. Guests, forwarding rules, external sharing, auto-join settings, and broad meeting permissions can all be legitimate business features, but each one changes the control model and should be treated as an explicit design decision.
Retention and encryption also require trade-offs. Shorter retention can reduce data exposure, but it may weaken investigation or legal hold capability. Stronger encryption protects content, but it can complicate e-discovery, monitoring, and some forms of content inspection. Good design keeps those trade-offs visible rather than leaving them to end users or ad hoc administrators.
Common Failure Patterns
Most failures are not caused by the messaging protocol itself, but by weak governance around the platform. Common patterns include overshared channels, unmanaged guests, exposed meeting links, stale integrations, weak account recovery, and long-lived access tokens or app permissions that outlive their business need.
These failure modes matter because communication platforms are trusted by default. Attackers often exploit that trust through impersonation, social engineering, malicious links, or compromised accounts that look normal to recipients. Once that trust is abused, the platform can be used to spread fraud, exfiltrate data, or stage follow-on access to adjacent systems.
Risk and Threat Considerations
Communication software concentrates sensitive conversations, identity signals, and shared files in one place, which makes it a high-value target for account compromise, impersonation, and data exposure. The main risk is not only leakage of message content, but misuse of the platform’s trust relationships to reach people, approvals, or connected services.
Failure mechanism: Weak access control, poor guest governance, exposed links, or stolen session material can let an attacker read, send, or forward communications as a trusted user, then pivot into related systems or workflows.
Impact: The result can include confidential data loss, fraudulent requests, compromised files, business email compromise patterns, and wider organisational trust erosion if communications can no longer be relied on.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-3 — Access Enforcement | Communication software depends on enforced channel, meeting, and file access decisions. |
| IA-2 — Identification and Authentication (Organizational Users) | User accounts and admins must be strongly authenticated to protect communications. | |
| AU-2 — Event Logging | Communication software needs audit records for access, sharing, and administrative actions. | |
| Recommendation — Enforce access decisions for chats, meetings, files, and integrations at the platform boundary. Require strong authentication for users and administrators of collaboration platforms. Log access, sharing, admin changes, and integration activity for later review. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Communication tools need controlled sharing, guests, and privilege boundaries. |
| Recommendation — Limit who can join, share, or administer communication platforms and connected services. | ||
| NIST SP 800-63 | AAL — Authenticator Assurance Levels | Identity strength matters when collaboration tools carry sensitive communications. |
| Recommendation — Set authentication strength to match the sensitivity and exposure of the communication platform. | ||
Practitioner Guidance
Why practitioners should care: Communication platforms are operationally indispensable, so their security settings tend to spread across the business faster than their governance changes do. Treat the platform as a core control surface, not just a productivity tool.
Governance implication: Ownership should clearly cover access policy, guest lifecycle, retention, auditability, and integration approval, so that collaboration features do not outpace admin oversight. The practical question is who is accountable when a channel, meeting, or shared file becomes a security incident.
Practitioner takeaway: The safest communication platform is one where convenience features are deliberately enabled, not assumed, and where trust boundaries are reviewed as carefully as the content being exchanged.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org