Secure signage is not a contradiction. It is a design.
A signage screen is a computer on your network, in a public place, showing your brand. Most platforms stream to it from the cloud and hope the connection holds. Cosmos was built the other way round: the content lives on the screen, the screen only ever calls out, and every link is its own key.
Pull the plug. See which screen keeps playing.
Both screens below are playing the same playlist. Flip the switch to cut the network. The typical cloud player waits for the stream. The Cosmos screen keeps going, because the content was already on its own storage.
Cosmos screen
Typical cloud player
Proven on the bench: an Android screen running the Cosmos app, with the network unplugged, kept playing pictures and video indefinitely. When the connection returns the screen asks whether anything changed and carries on. LG webOS and browser screens play from the server today and keep what their browser has cached; on-screen storage for those is in development.
Nine decisions that make the difference.
Content on the screen
With the Cosmos Android app, every picture, video and page is downloaded to the screen's own storage and served to the player locally. The network is for changes, not for playing.
Outbound only
Screens make HTTPS calls out to one address and accept nothing in. No open ports on your LAN, no inbound firewall rule, no VPN.
Tokenised play links
Each screen plays from its own token. Lose a screen and you revoke one link, not a password shared by the fleet.
Kiosk lock on Android
On screens we supply, the player is pinned: it cannot be closed, it relaunches itself, and the watchdog restarts it if anything goes wrong.
Multi-factor authentication and access levels
Every Cosmos login has multi-factor authentication with an authenticator app, no opt-out. Each person has their own login and a role: administrator or operator. Outside agencies get their own login, not yours.
The delete rule
Nothing is deleted while something still uses it. The button is red, it tells you what would break, and you type the word delete.
Australia, or your own network
Cosmos runs in an Australian data centre, or on a server on your own network where policy rules out any cloud. We name the provider and the location in writing before go-live.
Proof and audit
Reports show what played where and when. Publishing is a deliberate act, not an autosave.
Aligned to the Essential Eight
Built against the ACSC Essential Eight, targeting Maturity Level 1: mandatory multi-factor authentication, roles with an activity log, hardening and backups. Not yet independently assessed. Strategy by strategy below.
Nothing for a prankster to point at. Nowhere for a payload to go.
Once a screen is installed, nobody on the floor needs an IR remote again. Cosmos preferred screens are built without an IR receiver from the factory, so there is nothing for a remote from someone's pocket to talk to: no input switching, no power button, no menu. A screen you already own that has a receiver gets it locked out at commissioning. Exposed USB ports carry physical blockers, and the player ignores media that is not its own, so a stick pushed in to take over the content, or to deliver an unlawful payload, gets nowhere.
- No IR from the factory: Cosmos preferred screens are built without an IR receiver. A screen you already own that has one gets it locked out at commissioning
- USB blockers in every exposed port; the player ignores foreign media
- Kiosk lock: the player cannot be closed and relaunches itself
- Screen hours and the source a screen shows are set from the dashboard, not the glass
- A tokenised link per screen and, with the Android app, the content on the screen itself
| Someone tries to | What happens |
|---|---|
| Point a universal remote at it | Nothing. Cosmos preferred screens have no IR receiver from the factory. A screen you already own that has one gets it locked out at commissioning. |
| Switch it to another input | Nothing. Inputs are set from the dashboard, not the glass. |
| Push in a USB stick | The port is blocked. If a port is reached, the player ignores foreign media. |
| Hold the power button | The watchdog relaunches the player; the dashboard shows the gap. |
| Unplug the network cable, or kill the Wi-Fi | An Android screen with the Cosmos app keeps playing from its own store. |
| Find the screen's play link | It is tied to that one screen and revoked in one click. |
Aligned to the Essential Eight, strategy by strategy.
The Australian Cyber Security Centre's Essential Eight is the baseline Australian organisations are assessed against. Cosmos is built against it, targeting Maturity Level 1. It has not been independently assessed, and the Essential Eight assesses an organisation, not a product. Here is what each strategy means on a Cosmos fleet, and what you can ask us to show.
| Strategy | What Cosmos does |
|---|---|
| 1. Patch applications | Our rule: dependencies are reviewed monthly for known vulnerabilities and patched within 30 days of an advisory; critical, internet-facing issues within 48 hours. The player page updates over the same outbound channel the screens already use. |
| 2. Patch operating systems | Our rule: server hosts are patched monthly, critical vulnerabilities within 48 hours. Android screens take the Cosmos app from the Cosmos address, not from a stick. |
| 3. Multi-factor authentication | Mandatory for every user, with no opt-out at any role: an authenticator app, plus single-use recovery codes. A code works once. Admin resets are logged with who did it and when. |
| 4. Restrict administrative privileges | Named roles with listed powers, every request held to its own customer, and sign-ins, failed sign-ins, new and removed users and multi-factor changes in the activity log with who, the address and the time. |
| 5. Application control | On the screens, the kiosk lock is the application control: the player is the only app that runs, it relaunches if closed, foreign media is ignored and USB ports are blocked. On the platform side Cosmos is server-side, so workstation allow-listing stays with your IT policy. |
| 6. Restrict Microsoft Office macros | Not applicable by design. Cosmos never opens or renders Office documents; the library accepts pictures, video and web pages only. |
| 7. User application hardening | HTTPS with HSTS, clickjacking and MIME-sniffing protection, no server stack disclosure, cross-origin requests refused. Each screen plays from its own token. |
| 8. Regular backups | Recovery points of the application, the database and the media library at every release, tagged, with restores tested. Android screens hold their own content, so a restore never blanks them. |
Beyond Maturity Level 1
Failed sign-ins are logged with their address and rate-limited. Sessions end after 12 hours. Multi-factor secrets are encrypted at rest. Every customer's data is held apart on every request.
Evidence for your auditor
The security brief, the activity log of sign-ins and sensitive actions, last sign-in times for access reviews, and source control with release history.
Your assessment, our inputs
The Essential Eight assesses your organisation, not a product. Cosmos gives you controls and evidence for the fleet so the signage estate is never the gap in your own maturity assessment.
Request the security brief →What a typical signage screen exposes, and what Cosmos does.
| Question your IT team asks | Typical cloud signage | Cosmos Signage |
|---|---|---|
| Does the screen listen on our network? | Often: remote control ports, debug services | No. Outbound HTTPS only |
| What happens when the internet drops? | Black screen or "No signal" until it returns | With the Android app, keeps playing from the on-screen store |
| How is a screen authenticated? | Shared account or device password | Per-screen token, revocable in one click |
| Can someone close the player and browse? | Depends on the installer | Kiosk lock and watchdog on Android screens |
| Can a passer-by change the input with a remote, or plug in a stick? | Often: live IR receiver, open USB ports | No: no IR from the factory on Cosmos preferred screens, USB ports blocked |
| Who can publish? | Anyone with the login | Named people, multi-factor authentication, access levels |
| Can content be deleted by accident? | Usually, yes | Not while in use, and only after typing the word |
| Where is the data? | Varies, often offshore | An Australian data centre, or your own network |
| Can we prove what played? | Sometimes | Reports: PDF or CSV, any period |
What to allow. Nothing else.
Rolling Cosmos onto a corporate or health network takes one firewall line. Screens need outbound HTTPS to the Cosmos address, and time from your usual NTP source. That is the whole list.
- Outbound TCP 443 to one Cosmos address, given to you in writing
- No inbound rules, no port forwards, no VPN
- Screens can sit on a guest or IoT VLAN
- Revoke a screen's link from the dashboard if it goes missing
- Updates to the player ship through the same outbound channel
The ones IT asks first.
Does Cosmos need a VPN or an inbound firewall rule?
No. Screens only make outbound HTTPS requests. Nothing connects in to a screen.
How long will a screen play with no internet?
An Android screen running the Cosmos app: indefinitely. LG webOS and browser screens hold only what their browser has cached; on-screen storage for those is in development. On Android, everything the playlist needs is on the screen's storage. Schedules keep running on the screen's clock. Sync Groups keep time on the local network.
What if a screen is stolen?
Revoke its play link in the dashboard. The token stops working and the screen can show nothing new. The content on it is your public signage, not your data.
Can staff close the player and use the screen as a tablet?
Not on screens set up with the kiosk lock. The player is pinned, relaunches if closed, and a watchdog restarts it after a crash or a reboot.
Where is the dashboard hosted?
Your choice: an Australian data centre, or a server on your own network for organisations whose policy rules out any cloud. We confirm the provider and the location in writing before go-live.
Can we use our own identity provider?
Not yet: sign-in through your own identity provider is planned. Today a person signs in to Cosmos with a password and multi-factor authentication, or arrives already signed in through Command Nexus.
Want the security brief?
A two-page summary your IT team can file, plus the network diagram.