AR, VR and extended reality: uses and security
In short: Extended reality (XR) covers augmented reality (AR), virtual reality (VR) and mixed reality (MR). Businesses use it for training, remote support and design. Headsets collect very personal data such as room scans and eye movements, so they need device management, network controls and clear privacy rules.
AR, VR and MR
Extended reality (XR) is the umbrella term. Virtual reality (VR) replaces your view with a computer-generated world. Augmented reality (AR) adds digital information on top of the real world, for example arrows on a phone camera view or labels in smart glasses. Mixed reality (MR) goes further, so virtual objects appear anchored to real surfaces and react to them. Many current headsets can switch between VR and MR using outward-facing cameras, a feature often called passthrough.
How organisations use XR
| Use | Example | Benefit |
|---|---|---|
| Training | Practising emergency procedures or equipment handling in VR | Safe, repeatable practice |
| Remote assistance | An expert sees what a field engineer sees and draws instructions in their view | Fewer site visits |
| Maintenance | AR shows step-by-step instructions over a machine | Fewer mistakes |
| Design and planning | Walking through a building model before construction | Problems found early |
| Healthcare and education | Anatomy visualisation, virtual labs | Better understanding of 3D structures |
XR is demanding on networks. Streamed or cloud-rendered XR needs high bandwidth and, above all, low and steady latency, because delays between head movement and image update can cause discomfort. This links XR to newer Wi-Fi, 5G and edge computing.
Security and privacy risks
- Sensitive sensor data. Room scans can reveal a home or secure office layout. Eye and motion data can be very identifying and may allow inferences about health or interests.
- Screen and camera leakage. A headset used in a lab or plant might capture confidential screens, whiteboards or documents.
- Account and app risks. Headsets are computers with app stores and cloud accounts. Weak accounts, sideloaded apps and old firmware create the same risks as on phones.
- Perceptual manipulation. If an attacker can change what the user sees, such as a false overlay in an industrial AR app, they can cause wrong or unsafe actions.
- Social engineering in virtual spaces. Avatars and voices can be faked, so identity in shared virtual meetings needs verification like any other channel.
Securing XR at work
- Enrol headsets in mobile device management (MDM) to enforce passcodes, updates and approved apps.
- Use organisation accounts with multi-factor authentication, not personal ones.
- Put headsets on a dedicated or managed Wi-Fi segment with suitable firewall rules.
- Review what data each app collects, where it is stored and for how long, and do a privacy impact assessment where required.
- Define where headsets may be used, for example not in areas with classified information, and how passthrough recording is controlled.
- Wipe devices before reuse and retirement, as they hold accounts and spatial maps.
Tip: treat a headset like a smartphone strapped to someone’s face with extra cameras. Most of the controls you already use for mobile devices apply.
Practice
What is the difference between AR and VR?
Why is eye-tracking data a privacy concern?
Name two controls for corporate XR headsets.
Key takeaways
- XR covers AR, VR and MR, which differ in how they mix real and virtual views.
- Training, remote support, maintenance and design are leading business uses.
- XR needs high bandwidth and low, stable latency from the network.
- Headsets collect very sensitive data such as room maps and eye movements.
- Manage headsets like mobile devices, with MDM, MFA, segmentation and privacy reviews.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.