Zoom is a cloud-based video conferencing and collaboration platform. It provides meetings, chat, webinars and screen sharing, with host controls for waiting rooms, recording, participant management and access restrictions to control who can join and what they can do.
What Zoom does in security terms
Zoom is not just a meeting application, it is a collaboration platform that exposes a set of security-relevant controls around who can enter, what participants can do, and how sessions are managed. Those controls matter because the security model is built around real-time access decisions, not only content delivery.
That means the term belongs as much to access governance as to communications software. The practical question is how an organisation shapes join paths, host authority, recording behaviour, and participant permissions so the platform supports the intended trust boundary rather than widening it.
Access control, host authority, and session boundaries
Zoom meetings rely on host-side authority to admit or exclude participants, restrict sharing, and manage session features. Waiting rooms, passcodes, meeting locks, and participant controls are security mechanisms because they determine whether the conversation remains confined to the intended audience and whether attendees can alter the session state.
These controls are most effective when they are treated as part of the organisation’s broader access model. If meeting links are forwarded, hosts are absent, or default settings are too permissive, the platform can shift from controlled collaboration to ad hoc public access.
Data handling, recordings, and collaboration artefacts
Zoom often carries more than live voice and video. Chats, files, transcripts, recordings, and screen shares can all become persistent collaboration artefacts, which turns a meeting from a transient event into stored information with its own lifecycle, retention, and exposure profile. That is why recording controls and sharing permissions are not cosmetic settings.
Security teams should think about where those artefacts land, who can retrieve them later, and whether the organisation’s normal data handling expectations still hold once the meeting ends. In practice, the risk is not only unauthorised attendance, but also inadvertent retention or redistribution of sensitive discussion material.
Operational trust and collaboration hygiene
Because Zoom is used for both internal and external collaboration, its trust model depends on disciplined meeting design. User identity, link distribution, meeting configuration, and host behaviour all shape whether a session is open enough to be usable without becoming easy to abuse. Small configuration choices can materially change exposure.
For that reason, Zoom should be evaluated as a shared workflow surface rather than a single feature. The security outcome depends on whether the organisation consistently uses the platform’s controls to separate routine collaboration from higher-trust sessions such as executive meetings, regulated discussions, or customer-facing calls.
Risk and Threat Considerations
Zoom’s main security risk is not the existence of video conferencing itself, but the combination of link-based entry, rapid participant joining, and persistent artefacts. Misconfiguration can expose confidential meetings, while poor host discipline can allow unwanted participation, disruption, or later access to recordings and shared content.
Failure mechanism: Weak meeting controls, link leakage, or permissive defaults can let an unauthorised person join, observe, or interfere with a session, then reuse the meeting’s stored outputs if recording or chat access is also too open.
Impact: The result can be disclosure of sensitive business information, reputational damage, and operational disruption, especially when meetings are used for strategy, incident response, customer data, or regulated discussions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication and Access Control | Zoom sessions depend on join and host-access controls to restrict participation. |
| Recommendation — Enforce meeting access controls and participant permissions to limit who can join and do. | ||
| NIST SP 800-53 Rev 5 | AC-3 — Access Enforcement | Meeting controls enforce who can enter, share, record, and manage the session. |
| AU-2 — Event Logging | Meeting activity, joins, and control changes are security-relevant events worth recording. | |
| Recommendation — Apply access enforcement rules to meeting features, sharing, and recording rights. Log meeting and admin events so suspicious access or changes can be reviewed. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Zoom governance depends on controlling user access paths and session permissions. |
| Recommendation — Manage access paths and remove unnecessary meeting permissions and sharing rights. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Meeting admission, participant rights, and recording access are access-control decisions. |
| Recommendation — Define and enforce access rules for meetings, recordings, and collaboration artefacts. | ||
Practitioner Guidance
Why practitioners should care: Zoom settings are part of access control in practice, not just convenience preferences. Security owners should define which meetings require stronger admission controls, tighter participant permissions, and stricter recording rules, then align those defaults to the sensitivity of the discussion.
What to watch for: The most common warning signs are broadly shared links, unattended meetings, overly permissive screen sharing, and recordings that are easier to access than the live session was to join. Those are usually the points where platform convenience starts to outrun governance.
Related resources from NHI Mgmt Group
- How should security teams govern Zoom automation without losing control of access?
- What should teams measure to know whether Zoom automation is under control?
- How should teams govern collaboration app integrations in Zoom or similar platforms?
- How should security teams govern AI agent access to Zoom meeting data in enterprise environments?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org