A production company protects unreleased content: access control on shared storage, per-recipient watermarking and time-limited freelancer accounts
A film and television production company of about 140 staff with 350 to 450 freelancers a year, working for studios and streamers, a leader in its segment.
- Scale
- ~1.2 PB of shared storage, 40 active projects, ~420 freelancer accounts a year, 3 post-production suites, 2 cloud review portals
- Engagement
- A 5-week assessment and design, a 3-month rollout across two active productions, and a client re-review
The challenge
The company's studio customers send a content security questionnaire before every project and expect controls that follow the industry's content-security best practices, of the kind the Motion Picture Association describes and the Trusted Partner Network assesses. The company's real practice was weaker: one large file share where most staff could open most projects, freelancers on personal laptops with accounts that were never switched off, screeners sent as plain files by link, and no way to tell which person's copy had leaked if one did. A single leak of an unreleased episode would end a studio relationship.
What our team delivered
- A gap assessment against the content-security best practices that studios use, covering physical areas, storage, network, accounts, transfers, vendors and incident response, with each gap rated and tied to a fix. The company's own studio customers, not us, decide whether it passes their review
- Access control on the shared storage rebuilt around the project: a group per project and role, read-only by default for editorial and VFX vendors, write access only for the people who need it, no access for finance or sales, and an automated removal of every member when a project is marked wrapped. The old company-wide share was closed after a 60-day read-only observation period showed who actually needed what
- Freelancer and vendor accounts that expire. Each account has a named sponsor on staff, a start and an end date tied to the engagement, multi-factor authentication, and access only through company-managed virtual workstations or a managed laptop, so footage stays on the storage. Clipboard, USB and file download are off by default in the virtual desktop; an exception needs the sponsor and the head of post-production
- Forensic watermarking for anything that leaves the building for review: every screener, dailies link and cut gets a visible overlay and an invisible, per-recipient watermark that survives re-encoding and screen capture, so a leaked file can be traced to a recipient and a time. Review portals use expiring, single-recipient links with sign-in, and view-only streaming where the studio asks for it
- Secure transfer for large deliveries: accelerated transfer or SFTP to a studio-approved endpoint with checksums and logs, and no consumer file-sharing services on managed devices. Outbound email to personal webmail with media attachments is blocked, and data loss prevention rules flag filenames and project codes
- Logging and alerts on the storage and the review portal: bulk reads, off-hours access, access from a new country, mass downloads and access to a wrapped project, sent to one monitored queue with a defined response. A quarterly access review by project leads replaced the one-time sign-off
- Vendor review for the 22 post-production, localization and VFX vendors that handle unreleased content, with a short questionnaire, contract clauses for security and breach notice, and a requirement to use the studio's own assessed vendors where the studio names them
- A leak response runbook: who is told, how a watermark is read, how to preserve evidence, how to send takedown notices and when counsel and the studio are called, rehearsed once with a fake leak
Result
Footage now sits behind project-based access that ends when the project does, and 63 freelancer accounts that had never been disabled are gone. In a leak drill, a test screener was traced to the right recipient in under an hour. The company's next studio questionnaire was answered with evidence instead of promises. This is an illustrative engagement and a modeled outcome, not a guarantee against a leak, and passing a studio's assessment is the studio's decision.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 4 more
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Clayton Secure program
One monthly program that bundles monitoring, patching, backups, email protection and security awareness for your whole team. Priced per team member.
Onboarding starts within 10 business days
$150 per team member, per month
Email security with AI detection and DLP
Inbound and outbound protection: phishing, malware and impersonation caught by AI detection, with data loss prevention for what leaves.
Live within 7 business days
$7 per mailbox, per month
Compromised-mailbox monitoring and alerts
We watch each mailbox for signs of takeover, such as odd logins, forwarding rules and mass sending, and alert you fast.
Live within 5 business days
$4 per mailbox, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Super Intelligence data flow
Every request is classified by sensitivity, so confidential data stays on models inside your walls while routine work can use the best frontier AI.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
The evidence pack and who asks for what
Twelve artefacts a firm can show about its AI use, and the party that most often asks for each: an insurer at renewal, an auditor or client questionnaire, or a regulator. A typical pattern only; the exact list depends on the policy, framework and sector.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.