Security and Privacy for VR in non-entertainment sectors: a practice-based study of the challenges, strategies and gaps

The adoption of Extended Reality (XR) for non-entertainment use cases, such as healthcare, industry or education, raises new security and privacy (S&P) concerns. Despite an emerging focus on these aspects in the literature, we lack insights into how S&P threats for XR are perceived and accounted for by relevant stakeholders, such as those who are responsible for the design, development and rollout of these experiences. In this work-in-progress, we investigate the S&P concerns expressed by development teams and organisations using Virtual Reality (VR) in non-entertainment sectors, as well as the strategies adopted to mitigate these. We performed semi-structured interviews with 7 industry practitioners involved in the conception or development of non-entertainment VR experiences. By analysing this data against a classification of VR S&P threats from the literature, we identify gaps in the practitioners’ awareness of existing threats and in their defence strategies. We found that while most participants were concerned about S&P threats, there was an overall lack of awareness about VR-specific challenges. Our current findings and the intended follow-up work aim to inform future efforts towards providing usable and practical solutions for S&P in XR, based on systematic S&P threat modelling.