Zoom turns meetings into an AI security stack

Zoom owned the fortnight because its activity had a single line through it: meetings are becoming an AI security stack. On 21 Oct, The Verge reported Zoom’s new tool for detecting deepfake risks during video calls. On 22 Oct, Zoom was reported to be working with financial firms on Proof of Human badges to combat fraud and deep fakes. On 23 Oct, Zoom used Zoomtopia 2026 to introduce AI agents and new security controls. On 24 Oct, it announced the acquisition of Onyx to add open-source enterprise knowledge search to Zoom AI Services.

That is not a normal feature bundle. It connects identity, content retrieval, meeting risk and agentic workflow. The direction is clear from the developer surface as well. On 17 Oct, Zoom created Video SDK UI toolkit repositories for Android and iOS, plus an AI services quickstart. On 20 Oct, it released meetingsdk-ios v7.2.1 and created meetingsdk-ios and zoom-plugin-codex repositories. On 22 Oct, it released meetingsdk-web v6.5.0, created meetingsdk-web and meetingsdk-web-sample, and saw stars across top repositories rise from 95 to 1,069. On 23 Oct, it added seven repositories tied to the Video SDK, including React, Vue.js, JavaScript, Angular, Moodle TinyMCE and RTMS audio transcription samples.

The counterweight was operational. Four CVEs naming Zoom were published on 13 Oct, including two improper certificate validation issues scored 7.4 and two improper authorisation or buffer-related issues scored 8.1 and 8. Zoom also logged a run of minor service degradations, including Zoom Clips on 15 Oct for about 1,178 minutes, Chat Compose and SMS Summarisation with AI Companion on 18 Oct for about 46 minutes, two issues on 20 Oct including a UK website incident of about 598 minutes, a Zoom Learning webpage incident on 22 Oct for about 101 minutes, a US meetings services incident on 23 Oct, and a multi-service degradation on 24 Oct for about 46 minutes. The company is pushing the category towards AI-mediated work, but the proof now includes uptime, certificate handling and fraud resistance as much as video quality.

Vimeo’s fortnight was the clearest post-deal repositioning in the group. On 17 Oct, Bending Spoons completed its $1.38bn acquisition of Vimeo. Around the same window, Vimeo removed limits on public videos, with Business Wire coverage appearing on 14 Oct and again noted on 17 Oct, allowing users to share an unlimited number of public videos for free.

The move widens the top of the funnel at the exact moment the ownership story is changing. On 20 Oct, IMDb reported that Vimeo’s short film grant programme prize had risen from $150,000 to $300,000, and Mashable reported layoffs after the acquisition. On 22 Oct, the prize increase was again reported, while The National Law Review noted that 12,000 customers had migrated from Vimeo to Gumlet following the acquisition. Those are very different signals, but together they show a company trying to keep creators close while the commercial base digests a change of control.

The developer and service traces were mixed rather than dramatic. On 18 Oct, weekly downloads for @vimeo/player fell from 1,396,450 to 749,766, while @vimeo/vimeo fell from 52,966 to 26,786. On 24 Oct, @vimeo/vimeo rose from 28,179 to 36,900, and Vimeo’s psalm repository released 7.0.0-rc9 with support for conditional taint sinks. On 22 Oct, Vimeo introduced an omnipay-vindicia repository, pointing to payment integration work. On 26 Oct, Vimeo had a minor incident in which newly uploaded videos may not play in embeds because of incorrect privacy settings, lasting about 72 minutes. The public story is creator generosity. The operating story is integration, retention and continuity.

Riverside made the most explicit packaging move. On 13 Oct, it changed its Free tier copy to add “Try 2 hours of multi-track recordings”, “Riverside watermark on all your things” and “Video calls. As long as you want”, while removing the previous Free tier entries for 2 hours of multi-track recordings, Riverside watermark and video calls. The same change added unlimited transcriptions to Pro and removed 1 studio from Pro.

Ten days later, on 23 Oct, Riverside added two blog pages aimed at alternatives to Livestorm and a Streamyard versus Restream comparison. It also introduced 73 product pages tied to features and workshops for its university videos section, while removing 3 blog pages and 29 product pages. The sequence matters. Pricing copy moved first, then comparison and education surfaces expanded. That is the shape of a company tuning acquisition and activation at the same time.

Loom’s change was smaller but strategically legible. On 24 Oct, its site replaced the call-to-action “See all use cases” with “Explore now”. More importantly, it replaced the heading “Meet the all-new Loom for Mac” with “Show it in Loom, ship with any agent”. The product is being described less as a recorder and more as an artefact in agent-assisted work. In this category, language shifts before positioning hardens.

Descript’s fortnight was quieter than Zoom’s, but not empty. On 15 Oct, it released ffmpeg 7.1.2 with a fix for fragmented mp4 seeking issues. On 17 Oct, it launched ttf-parser and tiny-skia repositories. On 26 Oct, it added a resvg repository. These are low-level media and rendering signals rather than splashy launch signals.

The more visible public surface contracted. On 23 Oct, Descript removed four product pages related to newsletter and onboarding unsubscribe options, a search feature and an unsubscribe list page. On 24 Oct, it removed five specific product pages, including bradyyourtutor, espdaniella, sam-despo, this-is-tech-today and tour. On 18 Oct, weekly downloads fell across @descript/web-audio-js, @descript/immer and @descript/kali by roughly 65 to 68 percent.

Advertising stayed active despite the pruning. Descript had 25 new Google ad creatives recorded on 17 Oct, with 40 creatives running, followed by smaller batches on 18, 22, 23, 24 and 26 Oct. The useful read is not that Descript paused. It did not. It maintained paid surface area while removing pages and continuing infrastructure work underneath.

The best signal this fortnight was timing. Zoom’s AI and security narrative landed from 21 Oct to 24 Oct, while its GitHub activity had already accelerated from 17 Oct through 23 Oct. The same week also carried a cluster of status incidents and the publication of four CVEs. Read only the announcements and Zoom looks like it is moving up the stack. Read the sequence and the strategic bet is more demanding: it has to sell intelligence, identity and reliability as one enterprise promise.

Vimeo’s sequence was just as revealing. The public video limit removal appeared on 14 Oct and was still being reported on 17 Oct, the acquisition completed on 17 Oct, layoffs were reported on 20 Oct, the grant increase was reported on 20 and 22 Oct, and the 12,000-customer Gumlet migration report appeared on 22 Oct. That is a post-acquisition reset playing out across product generosity, creator signalling and customer migration risk in less than ten days.

Paid media added background noise, but even that noise had shape. Zoom, Vimeo and Descript each showed 40 Google creatives running during the period, with repeated new creative batches across the fortnight. The category is not waiting for one launch moment. It is testing copy, moving developer surfaces, adjusting packaging and managing service trust in parallel.