Smart Glasses Security Risks: What CISOs and Enterprises Need to Know

Meta’s push to make smart glasses smarter has caused governments, judicial systems, and enterprises to push back on the technology. Organizations are now scrambling to evaluate device policies as wearables introduce vulnerabilities that traditional mobile device management tools cannot easily track.

Privacy and Regulatory Concerns in New York and Texas

Government and judicial systems are raising immediate alarms over the discreet nature of data collection on modern smart glasses. New York State’s Unified Court System has expressed concern regarding how easily the devices capture sensitive audio and visual records. Meanwhile, regulatory liabilities are expanding at the state level. Meghan Hollis, senior principal analyst at Gartner, noted that smart glasses could trigger violations in states such as Texas, which enforces a Biometric Identifier Act prohibiting the capture of biometric identifiers like facial recognition without express permission.

Enterprise Security Risks and the Limitations of Mobile Device Management

Corporate environments remain largely unequipped to handle the security threats posed by employee or visitor wearables. Erich Kron, CISO advisor at cybersecurity company KnowBe4, explained that sensitive information displayed on whiteboards, computer screens, or discussed in conference rooms can be captured continuously. Although Meta includes a small LED light to signal active recording, users have already found workarounds to remove the indicator. We don’t really have an MDM for that, Kron said, referring to mobile device management software.

Insider Threats and Unauthorized Interview Assistance

The technology is also complicating internal hiring procedures and offboarding security. Doug Swope, CISO at identity management company Daon, pointed out that job candidates could use smart glasses during interviews to generate answers and fake technical expertise. On the other end of the employment lifecycle, companies face steep hurdles with departing staff. What do you do if you have an employee that you’re terminating or someone disgruntled on their way out? That’s going to be something that’s extremely hard for us to internally tackle, Kron said.

Corporate Policy Bans and Future Compliance Exceptions

Because data loss prevention technologies cannot detect or block the invisible data egress from smart glasses, many companies are opting for total prohibitions. The easiest thing for most CISOs and CSOs to do is just say, ‘We don’t allow them. Period,’ Kron said. Daon has already implemented a corporate ban enforced through mandatory privacy training, while Gartner’s Hollis suggests organizations establish baseline bans while carving out policy exceptions for ADA compliance, live meeting transcriptions, or manufacturing quality checks.