10 metaverse dangers CIOs and IT leaders should address

In the 1992 novel Snow Crash, people tried to escape the bleakness of everyday life into what the author, Neal Stephenson, dubbed "the metaverse," a unified and truly immersive digital existence. That metaverse was no utopia, however, and danger and chaos lurked there just as it did in real life.

It's hard to imagine people mistaking any of today's metaverse platforms for the realistic one Stephenson depicted. Still, today's VR-based worlds do pose a number of risks. From security issues to the high environmental cost of blockchain and AI, business and tech leaders will need to confront a number of problems as they move forward on their metaverse strategy.

Metaverse dangers, not just benefits

Leaders at the University of Maryland Global Campus are among those dealing with metaverse issues.

Students enrolled for select fall classes at University of Maryland Global Campus will be the online school's first cohort studying within a "metacampus." UMGC's pilot program, done in partnership with VictoryXR and using Oculus Quest 2 virtual reality headsets, will offer a digital twin campus for both in-person and online students.

UMGC leaders anticipate its immersive program delivering benefits such as enabling students to view artistic masterpieces as if they were seeing the art in the actual museums where they hang, said Daniel Mintz, chair of the university's department of information technology and one of the faculty members heading its metaverse initiative.

But those benefits don't obviate the need to look at the real dangers.

To that point, UMGC is working to secure the new metacampus against the types of cyberthreats that bombard traditional enterprise IT today, Mintz said.

Metaverse pilots such as the one happening at UMGC are giving technologists and enterprise executives a glimpse not only at the potential benefits of the platform but a look at the downsides and dangers.

Although much of the current discussion around metaverse dangers is speculation, there's genuine concern about the darker side of the metaverse, said Kenny Ching, an assistant professor at WPI Business School.

Here are 10 of those potential metaverse dangers.

1. Increased data collection by third parties

Metaverse platforms are likely to increase the potential range and amount of personal data that third parties collect. That massive amount of data is a goldmine tech companies and marketers can potentially exploit.

The more data you put online, the bigger digital footprint you have, so you're going to run more risks.

Since organizations will be employing third parties to access and use the metaverse, leaders will have to understand what data those companies will collect about their workers, customers and partners as well as how third parties will store and use that data, Mintz said.

For example, as part of protecting the UMGC metacampus, leaders have to answer important questions about the level of responsibility in protecting students' information from companies looking to market and sell data, Mintz said.

2. Myriad privacy issues

Metaverse platforms require increased online reliance, which makes addressing data privacy question critical.

"The more data you put online, the bigger digital footprint you have, so you're going to run more risks," Ching said.

Moreover, industry watchers say that metaverse platforms will collect more of the newer types of data such as voice recordings, in addition to collecting conventional data such as individual names and addresses.

Organizations will have to consider how they're going to identify what data they collect and store, what level of protection it requires and how to secure it, said Jenai Marinkovic, founder of Tiro Security, a boutique cybersecurity firm. At the same time, leaders have limited legal guidance on some of those questions.

"We don't yet have clear definitions on what constitutes personal information in the metaverse," Marinkovic said.

3. More complex and challenging access and identity management

If you add complex passwords into … a VR experience, it tends to hurt the user experience.

Access and identity management seems to be both more complex and more challenging in the metaverse, Marinkovic said.

"Every vendor has its own way of handling access and identity management. They're not consistent, and if you add complex passwords into, say, a VR experience, it tends to hurt the user experience," said Marinkovic, who is also a member of ISACA's Emerging Trends Working Group.

4. Cybersecurity risks

Metaverse platforms pose many of the same cyber risks that current web applications pose. In addition, the extended reality hardware that many metaverse platforms rely on will create new vulnerabilities for corporate networks and ways for hackers to exploit data.

IT leaders will need to address difficult questions about whether organizations are adequately equipped to detect, contain and eliminate malicious code in their metaverse projects.

 "The whole world around malware is a big danger," Marinkovic said.

5. Coordinating incident response questions

A related challenge enterprise executives need to consider as they plan and launch metaverse initiatives is what incident response will encompass in the new digital frontier.

"We haven't modeled out the threats and our responses: What would a breach look like? How to communicate that? How do you respond?" Marinkovic said. "When you have a metaverse [presence], you need people inside and outside the [metaverse] world."

IT leaders will need to understand how their teams inside and outside a metaverse platform will collaborate to handle a metaverse incident response, she said.

"We don't yet have a way to have those teams work with each other," Marinkovic said.

6. Issues from high levels of anonymity

For some, a primary appeal of metaverse realities is the ability to take on an identity divorced from the reality of the physical, everyday life. That high level of anonymity presents opportunities for bad actors.

Research on this topic is in its early stages, and it's not clear what mechanisms organizations could use to keep anonymous avatars away from their metaverse worlds, Ching said.

Anonymity already enables scams and abuse on social media and the internet more generally. Metaverse platforms are likely to make that even more widespread.

"Widespread anonymity could trigger a range of potentially negative behaviors," Ching said.

Researchers are looking at a number of expected metaverse issues, he said.

7. Harassment and assault

Closely related to the issue of anonymity is the ways in which metaverse platforms may enable new forms of personal aggression. Harassment in virtual worlds and assaults have already been a growing problem.

Immersive experiences, particularly those supported by haptic technology, which transfers the experience of touch from the virtual world to the user, are raising questions about how to respect personal boundaries and how to anticipate circumstances where such incidents could arise, Marinkovic said.

Responses to those questions aren't always obvious, especially in more nuanced situations, she said. Case in point: She was once in a forum where users were testing haptic technology by shaking each other's hand, until one participant voiced discomfort with that level of touching.

8. Lower levels of user vigilance

Despite metaverse platforms potential dangers, some users may relax their guard in virtual situations.

At the same time metaverse risks are growing, users may not bring the same level of vigilance around cybersecurity threats in those immersive environments that they've been trained to bring to their work environments, Mintz said.

"They don't naturally think about security issues when using this kind of entertainment, so we have to think about what kind of security we can build into [metaverse initiatives] to counteract this," he said.

9. Possible reduced productivity

Some business and IT leaders are exploring metaverse platforms for possible efficiency gains, but they shouldn't take such gains for granted.

Research is also looking at whether people are really as productive when they're engaging with each other virtually, Ching said.

Some research shows that without physical interactions and the physical cues they enable, people could actually be less efficient than when they work closely together in real life, Chang said.

10. Widening of the digital divide

Metaverse platforms require access to and use of more technologies, such as VR headsets and even specialized bodywear containing haptic technology, which is a barrier to entry for anyone without the funds to pay for such technologies.

Metaverse initiatives could shut out lower-income people from associated experiences and opportunities, Mintz said. The physicality of the metaverse could also shut out people with certain disabilities, particularly if alternative avenues for access -- such as internet versions -- aren't available.

The need to proceed with caution

With metaverse initiatives ramping up, enterprise executives would do well to consider how to mitigate these risks.

"There is a safe way to do it, and it's the way we do it with other new technologies -- learning, training, starting with use cases that won't expose anything too risky," Marinkovic said.