Screen sharing turns whatever is on your display into something other people can see, record and sometimes control, so one careless share can leak a customer list, and one approved control request can hand a stranger your computer. Most screen sharing incidents are not technical exploits. They are accidental exposure (the wrong window, a password manager, a chat notification popping up mid-presentation) and social engineering, where a caller posing as IT support persuades someone to share their screen and then grant remote control. This guide covers both: the risks in plain terms, how to share safely, how to recognise and stop a remote control scam, and the administrator settings that limit sharing and control in Cisco Webex, Google Meet, Microsoft Teams and Zoom. Platforms are listed alphabetically; order is not a ranking. It is written for practitioners who set collaboration policy and for anyone who presents on calls. For the wider platform picture, see the Unified Communications Security Guide.
Key takeaways
- Share a window or tab, not your whole screen. Every major platform lets you share a single application or browser tab; doing so removes most accidental exposure in one step.
- Silence notifications before you present. Chat previews, email alerts and one-time codes appear on screen and in recordings. Turn on Do Not Disturb or focus mode first.
- Nobody legitimate asks for control out of the blue. Unsolicited calls or chats from "IT support" asking you to share your screen and then approve remote control are a known ransomware entry route.
- Administrators can remove whole risk classes. Limit who can present, keep external participants from giving or requesting control, and block remote support tools the organisation does not use.
- Screen sharing is a data channel. Treat it in data loss prevention, recording and retention policy like any other route by which data leaves the organisation.
Screen sharing risks at a glance
| Risk | How it happens | Who is affected | Primary control |
|---|---|---|---|
| Accidental exposure | Sharing the entire desktop and switching to the wrong window, tab or file | Every presenter | Share a single window or tab |
| Notification leaks | Chat, email, SMS mirroring or MFA prompts appear over the shared content | Every presenter, worst in recorded sessions | Do Not Disturb when sharing |
| Recording capture | A brief exposure is preserved in a recording, transcript or AI summary and shared widely | Organisation | Recording policy and retention |
| Remote control scams | Caller or chat posing as help desk persuades user to share and grant control | Staff, especially those flooded with spam email first | Verification procedure, external control blocked |
| Unwanted presenters | Uninvited or external attendees share offensive or malicious content | Meeting hosts | Restrict who can present |
| Shoulder-surfing at scale | Attendees screenshot or record shared content outside platform controls | Organisation | Share the minimum; watermarking for sensitive sessions |
MITRE ATT&CK records the attacker behaviours involved: T1566.004 Spearphishing Voice for the help desk call, T1219.002 Remote Desktop Software for the remote session, and T1113 Screen Capture for collecting what is on screen.
Sharing safely: what presenters should do
- Prepare the screen: close email, chat, password managers, admin consoles and documents you do not intend to show. Use a separate browser window or profile for the session.
- Silence notifications: on Windows 11 and 10, Settings, System, Notifications offers automatic Do Not Disturb rules including When duplicating the display and When using an app in full-screen mode. On a Mac or phone, use a Focus mode. Remember that phone notifications mirrored to the desktop count.
- Choose the narrowest share: in Google Meet, Present now offers A tab, A window or Your entire screen, and Google recommends sharing a specific tab or a new window. Teams, Webex and Zoom all offer application or window sharing alongside desktop sharing.
- Check the indicator: platforms show what is being shared. Zoom, for example, draws a green border around the shared area with a "You are screen sharing" message and a Stop Share button.
- Stop sharing before switching: pause or stop the share before opening anything else, rather than relying on speed.
- Review recordings: if something sensitive appeared, tell the host before the recording is circulated and ask for it to be trimmed or deleted.
- Secrets on screen: API keys, tokens and passwords shown in a terminal or configuration file during a demo should be treated as exposed and rotated, especially if the session was recorded. See the Secrets Management Guide.
Remote control scams: how they work and how to stop them
The most damaging screen sharing abuse starts with a call, not a vulnerability. Microsoft Threat Intelligence reported in May 2024 that Storm-1811, a group known for deploying Black Basta ransomware, flooded targets' inboxes with subscription spam, then phoned them posing as IT or help desk staff offering to fix it. From late May 2024 the group also contacted targets through Microsoft Teams from tenants with names such as "Help Desk" and "IT Support". Victims were talked into opening Quick Assist, entering a code, approving screen sharing and then granting remote control. The attackers then installed remote monitoring and management tools and other malware, moved laterally and deployed ransomware. See the Email Bombing and Help Desk Impersonation over Teams Guide and the Black Basta Threat Actor Profile.
| Warning sign | Why it matters | What to do |
|---|---|---|
| Unsolicited call, chat or pop-up about a computer problem | The FTC states that legitimate tech companies do not contact you about computer problems out of the blue, and real security pop-ups never ask you to call a number | Hang up or close the chat; contact IT through a known channel |
| A sudden flood of spam email followed by a "helpful" call | The pattern Microsoft documented for Storm-1811 | Report the flood; do not accept help you did not ask for |
| Chat from an "External" account using an IT-style name | Microsoft advises checking the External tag in Teams | Do not reply; report through the official process |
| Request to install or open a remote support tool | Remote access gives full control of the device | Only accept sessions you started with your known IT team |
| Request to approve a sign-in or read out a code | Turns a screen share into account takeover | Never approve sign-in requests or share codes over chat or phone |
- If you already granted control: stop sharing and remote control immediately (every platform has a Stop control or Stop share button), disconnect from the network, and report to IT. Change passwords from a different, trusted device, and tell your bank if payment details were entered. Individuals in the US can report at ReportFraud.ftc.gov.
- For organisations: publish one way that IT will contact staff, give the help desk a verification procedure for outbound support, and follow Microsoft's recommendation to block or uninstall Quick Assist and other remote tools that are not used. See the Recognising Tech Support Scams Guide and the RMM Tool Security Guide.
Platform controls for administrators
Each platform documents controls over who can share, what can be shared and who can take control. The table summarises the main settings from each vendor's documentation.
| Control | Cisco Webex | Google Meet | Microsoft Teams | Zoom |
|---|---|---|---|---|
| Where administrators set it | Control Hub, Services, Meeting, Settings, Sharing (organisation) and meeting settings templates (groups and users) | Admin console, Apps, Google Workspace, Google Meet, Meet video settings (organisational unit or group) | Teams admin centre, Meetings, Meeting policies, Content sharing (per-user policy) | Zoom web portal settings at account, group or user level, with locking |
| Restrict who can share | Host can turn sharing off for participants; Enable sharing master toggle for the organisation | Host controls, Share their screen toggle | Who can present: Everyone (default), People in my org and guests, or Only organizers and co-organizers | Who can share? Host only or All participants; Who can start sharing when someone else is sharing? |
| Limit what can be shared | Separate Application sharing, Desktop sharing, Camera sharing, File sharing and Whiteboard sharing toggles | Presenters choose a tab, a window or the entire screen | Screen sharing: Entire screen (default), Single application, or Not enabled | Share options include the entire desktop, specific apps or a resizable portion of the screen |
| Limit external participants | Separate policies for internal and external meetings through templates | Meeting access: Open, Trusted or Restricted | External participants can give or request control (default Off); Participants can share content in external meetings hosted by Any org or Trusted orgs and guests | Restrict external users from using remote control and remote support in a meeting |
Availability notes: Cisco Webex sharing and remote control restrictions apply to Webex Meetings client 42.3 or later and Webex App 43.6 or later, and some toggles depend on the Webex Suite meeting platform. Google Meet access types and host controls vary by Workspace edition; Restricted access is not available to consumer accounts. Microsoft Teams external content sharing restriction to trusted organisations requires Teams Premium. Zoom in-meeting host tools for share apply to the current session only, with defaults set in the web portal.
Remote control settings
Where a platform offers remote control inside meetings, it should be off by default for external parties and restricted to support staff internally.
- Cisco Webex: Control Hub offers a Turn on remote control master toggle and Desktop remote control; hosts can turn off remote control so attendees cannot request it. Unanswered requests expire after 30 seconds, and an Automatically accept all requests option exists, which should not be used outside controlled training.
- Microsoft Teams: Participants can give or request control (default On) and External participants can give or request control (default Off), set with Set-CsTeamsMeetingPolicy -AllowParticipantGiveRequestControl and -AllowExternalParticipantGiveRequestControl. External control works only when both organisations allow it.
- Zoom: the Remote control toggle under In Meeting (Basic) on the Meeting tab, lockable at account or group level, plus the external restriction above. Sharers can stop control at any time with Stop remote control.
In Google Meet, the documented controls that matter most for this risk are the host's Share their screen toggle and Restricted or Trusted meeting access, which keep uninvited people from presenting at all. Deep configuration for each platform is in the Cisco Webex Security, Google Workspace Security Guide, Microsoft Teams Security Guide and Zoom Workplace Security pages.
Rolling out a screen sharing policy
- Baseline: export current meeting policies on each platform in use and record defaults, especially who can present, desktop sharing and external control.
- Quick wins first: turn external give or request control off everywhere, and restrict who can present in large or public meetings to organisers and co-organisers.
- Pilot stricter sharing: apply single-application sharing to a pilot group of high-risk roles (finance, HR, administrators, customer data handlers) through a separate policy or template. Collect feedback for two to four weeks.
- Expand by role: roll the stricter policy to further groups; keep desktop sharing for trainers and support staff who need it.
- Remote support tooling: designate one approved remote support tool, block others through application control, and require that support sessions start from a ticket. See the Remote Support and Screen Sharing Tools buyer's guide.
- Rollback: because these are per-user or per-group policies, revert a group to the previous policy if a business process breaks, and record the exception with an owner and expiry.
| Organisation | Recommended starting point |
|---|---|
| Small organisation, one platform | External control off, notifications guidance, share-a-window habit, one known IT contact route |
| Mid-size, mixed platforms | Above plus restricted presenters for large meetings, role-based single-application sharing, blocked unused remote tools |
| Large or regulated | Above plus DLP and recording governance, outbound help desk verification, monitoring of remote tool launches and policy changes |
Detection, DLP and measurement
- Monitor: remote support tool installation and launch on endpoints (Quick Assist and third-party tools); first-contact chats from external tenants; changes to meeting policies in each platform's audit log; remote control sessions involving external participants.
- DLP: where the product supports it, endpoint DLP can restrict screen capture or sharing while sensitive content is open, and recording governance controls what is retained. See the Endpoint DLP Guide.
- Metrics: percentage of users on a policy with external control disabled (target 100%); number of unapproved remote support tools detected per month; time to contain a reported remote control scam; share of high-risk roles on single-application sharing; percentage of staff who report rather than engage in phishing-call simulations.
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | SC-15 Collaborative Computing Devices and Applications; AC-17 Remote Access | Controls on collaborative applications and on remote sessions |
| NIST CSF 2.0 | PR.AT-01 | Awareness so staff recognise social engineering |
| MITRE ATT&CK | T1566.004, T1219.002, T1113 | Voice phishing, remote desktop software, screen capture |
Common failure patterns
- Desktop sharing as the default habit: presenters share everything because it is the first option, then expose email, chats or admin consoles when they switch windows.
- Notifications left on in recorded sessions: a one-time code or private message appears once and is preserved in the recording, transcript and AI summary.
- No single trusted IT contact route: staff cannot tell a real help desk call from a fake one, so the Storm-1811 pattern works.
- Remote tools nobody uses left installed: built-in or legacy remote support tools give attackers a trusted, signed way in.
- External control left on: policies that let external participants request control turn every external meeting into a possible takeover attempt.
- Secrets shown in demos not rotated: keys visible on screen during a recorded demo are treated as harmless because "only colleagues saw it".
Practitioner checklist
- Turn off external participants giving or requesting control on every platform in use.
- Restrict who can present in large, public and external meetings.
- Apply single-application or window sharing to high-risk roles.
- Publish one official way IT contacts staff, and tell staff to refuse unsolicited remote control requests.
- Block or uninstall remote support tools the organisation does not use; designate one approved tool.
- Teach presenters to share a window or tab and turn on Do Not Disturb before sharing.
- Rotate any secret shown on screen in a recorded session.
- Alert on remote tool launches, external first-contact chats and meeting policy changes.
- Include screen sharing and recordings in DLP and retention policy.
Standards and references
- Microsoft Learn: Manage who can present and request control in Teams meetings
- Microsoft Learn: Configure desktop sharing in Microsoft Teams
- Zoom: Requesting or giving remote control
- Cisco Webex: Collaboration restrictions for Webex Meetings in Control Hub
- Google Workspace: Tips to control meeting access and participation
- Microsoft Threat Intelligence: Threat actors misusing Quick Assist in social engineering attacks
- FTC: How to spot, avoid and report tech support scams
- NIST: SP 800-53 Rev. 5 (SC-15, AC-17)
Related NHI Mgmt Group resources: Unified Communications Security Guide · Vishing and Help Desk Social Engineering Awareness Guide · Remote Support and Screen Sharing Tools · AI Meeting Assistant Security