How AI protects your favourite movies

Discover insights and exclusive interviews from the global Black Hat MEA community – in your inbox every week. 

This week we’re focused on…

The movies. 

Because in film, protecting creative content is as critical as creating it. A leaked script, pirated CGI sequence, or stolen pre-release clip can undermine years of work, damage revenue, and fracture trust with audiences.

That’s why cybersecurity for film and streaming productions has had to evolve – and for Black Hat MEA 2025 speaker Dan Meacham (VP, Cyber and Content Security at Legendary Entertainment), AI and machine learning have been central to that evolution for a while now. 

“We have been leveraging AI and machine learning for well over a decade to help identify, mitigate, and remediate cyber threats,” he told us. 

He broke his approach down into three pillars: user behaviour analytics, technology sentinels, and supply chain protection.

AI in user behaviour 

“Ten years ago, we relied heavily on machine learning to help profile individual user or identity behaviours,” Meacham said. “Imagine a visual effects editor working on movie A. This user is not an employee, but an external collaborator on the film project – meaning they are using their own equipment and may only be active in the production environment for a few weeks. Then they leave, and they’re called back when the movie picks up the call for 3D effects.

“The user behaviour analytics (UBA) data collected would help define the user’s profile – things like always logging in from a set of IP addresses located in Australia; using MacOS, logging in between these hours; has a threshold of data uploads and downloads that fit a predictable pattern.

“Fast forward five years and now we pick up activity again for this user. This time the user logs in from Brazil, using an Android device and accesses a file for movie B. The data anomalies would flag the access as suspicious because of the first time logging in from the new location.

“However, behind the scenes, the UBA and machine learning scripts kick in and run checks – like who else is logging in from this new location within the past 25 days, who else has accessed this file within the past 25 days, are there any communications or collaborative activities logged between Movie group A and Movie group B, does this user have any correspondence, emails, or call logs matching any group members…

“...all of these machine learning activities are processed in seconds, and they let an automated risk score drive a prescriptive response. That might be disabling the user account across all systems, and notifying the employee who invited the external collaborator that the account was disabled due to a security flag, and advising they should call (not email) the individual to verify the activity.

“Today,” Meacham added, “we now leverage AI to process the enhanced UBA analysis as well as integrate to a wider set of resources natively versus just the SOC.”

This kind of anomaly detection has become common across industries – research shows behavioural analytics is one of the fastest-growing uses of AI in cybersecurity. But in the film industry, with its reliance on short-term collaborators and external contractors, it’s essential.

Technology sentinel 

The second of Meacham’s three pillars focuses on the tech used in film and streaming production: 

“With the diverse technology stacks, we can leverage AI to help monitor shadow IT and dynamically profile threat rankings based on known vulnerabilities as well as the logical process flows of the data, measuring patterns and boundaries. 

“Platform integrated AI helps monitor new account setups captured in emails and correspondence. Cloud and network AI resources help determine the amount of engagement, localisation, and risk associated with the diverse technology stack.”

Here, AI’s value lies in its ability to track patterns across many fragmented systems – and to flag where small gaps in workflows become security holes. Unauthorised tools, hidden plugins, and unmanaged accounts are increasingly recognised as blind spots in security programmes across industries.

Protecting the entertainment supply chain 

And then there’s the supply chain – often the softest spot in creative production security.

“With so many partners having the movie and related content on their systems, securing assets can be overwhelming. Focusing on the standards, block and tackle, and collaborative integration of incident response teams help facilitate quick responses.

“We use AI to assist with forensic watermarking,” Meacham added. “Like a traditional watermark that will have the partner’s details burned into the images, forensic watermarking embeds inaudible sounds, steganographic pixels, and other methods that mark a clip to a specific crew member, date, time, location, and many other secrets. So when a leak is found online, the AI can quickly assess the validity, and direct to the workflow and partners involved.

“During COVID, we worked with one partner to develop a system that could take an image and seek out the original online. The service was so good that it was able to find the original post of an image, who had reposted the image, and measure an accuracy and relevance score.”

Let’s look at a real example of accuracy and relevance in action 

“During our pilot test, we took a known image posted on social media. A Dune fan in Japan posted a photo of the private invitation to see the Dune part 1 trailer in IMAX, as well as the first 10 minutes of the movie. 

“The system took this image and found the original post in a matter of minutes. The AI calculated the accuracy and relevancy scores and provided 50 other images of the postcard others received and posted online. Though it was not the same photo, it was the same postcard with the same text and images. Those findings had a moderate accuracy score.

“Next, we also received several other image hits. These were movie posters for Dune part 1. On the postcard, the AI was able to identify the silhouette of Paul and Jessica. There were several movie posters of Paul and Jessica as well as the other posters that had other cast members alongside them. The accuracy scores were around 11%, but the relevancy scores were near 60%.

“Now, five years later, AI has advanced and is getting better at tracking down these leaks and modifications of the original leaks to assist in automated groupings and takedowns.”

In the film industry, the ability to track the sources of leaks like this is incredibly important – the stakes here are huge. Pre-release content leaks can cost studios tens of millions. So AI-enabled watermarking and rapid leak attribution are becoming critical industry standards.

AI protects the movies you love to watch 

For Meacham and his team, AI is the backbone of resilience for the film and streaming industry.

Cinema audiences never see it at work. But it’s there all the time – quietly tracking anomalies, scanning for shadow IT, and chasing leaks across the globe.

It’s a reminder that as creative content grows in value, so do the risks. And the only way to stay ahead is to match imagination with intelligence – not just on screen, but in the systems that protect what audiences love.

Want to hear what else Dan Meacham told us about cybersecurity for streaming and movies? Read the full interview on the blog.