Updated September 16, 2026.
Cameras are the easy part of any video surveillance project. The harder decision is the software layer behind them — the system that decides what triggers an alert, how footage is stored and retrieved, and whether an investigator can actually find the 12 seconds that matter inside 30 days of recordings. This guide walks through the criteria that separate a workable platform from an expensive shelf ornament, drawing on published guidance from the Scientific Working Group on Digital Evidence (SWGDE) and the Security Industry Association (SIA).
The Software Is the Product Now
Image sensors and lenses have matured to the point where most business-grade cameras produce usable footage. What differentiates one system from another is the software layer: object classification, search, storage management, user access, and integrations with the rest of your security stack.
SWGDE's Recommendations and Guidelines for Using Video Security Systems frames the goal simply: a system exists to produce images that let investigators identify people and objects of interest. If the software makes that hard — because search is weak, footage is over-compressed, or metadata is missing — the whole investment underperforms regardless of camera quality.
Cloud, On-Prem, or Hybrid — Pick Your Fighter
There are three common deployment shapes:
- Cloud-native: footage and metadata live in the vendor's cloud. Access is browser- or app-based. No server room to maintain, but bandwidth and monthly costs matter.
- On-prem: everything sits on an NVR or server locally. Full control and no ongoing cloud fees, but you own the hardware failures.
- Hybrid: local recording paired with cloud metadata and remote access. This is a common middle ground for multi-site organizations.
Compare bandwidth, retrieval, recovery, access controls and the organization’s information-handling requirements. The SIA privacy code provides planning guidance; it does not establish a universal hosting restriction for healthcare or education. Have the responsible adviser identify the obligations that apply to your actual recordings and use.
AI and Analytics: What They Actually Do
SIA's Code of Practice notes that AI-powered analytics can "recognize humans, vehicles, objects and events" and generate alarms, which can reduce the human error that comes from watching monitors for long stretches. In practice, this shows up as object classification (person vs. vehicle vs. animal), license plate recognition, and event-based alerting that filters out routine motion.
Two caveats are worth naming up front. First, analytics vary widely in accuracy between vendors — request a demo on footage from a site similar to yours before believing marketing claims. Second, SIA emphasizes that analytics choices are a privacy issue: viewing zones, exclusion zones, and whether identification is happening at all should be decided during system design, not after installation. If you want a plain-English overview of how these systems work, see our guide to AI security systems.
Searching CCTV Footage Without Losing Your Weekend
The single biggest workflow improvement in modern video management software is search. Instead of scrubbing a timeline, an operator should be able to filter by object type, color, direction of travel, time window, or license plate and get to relevant clips in a handful of clicks.
Ask any vendor to demonstrate this on your footage or on a site similar to yours. A realistic test: pick an incident type you actually investigate (a delivery dispute, a slip-and-fall, a parking lot fender-bender) and time how long it takes to produce the clip using the vendor's search tools. That number is more useful than any spec sheet.
Storage: The Boring Question That Eats Budgets
Storage is where surprise invoices originate. Retention length, resolution, framerate, codec choice, and whether recording is continuous or event-triggered all move the number. SWGDE points out that camera count, storage capacity, and recording rate per camera are interdependent — adding cameras to an existing system often forces adjustments to storage or per-camera framerates.
Practical steps:
- Ask each vendor for a storage-per-camera-per-day figure at the resolution, framerate, and codec you plan to run.
- Consider event-based recording for lower-traffic areas to reduce the total daily write volume.
- Confirm whether the platform re-encodes or transcodes footage in ways that could affect its evidentiary value.
If a vendor cannot produce a specific storage estimate for your configuration, treat that as a warning sign.
Integrations: Does This Thing Play Nice With Others
Video rarely operates in isolation. Common integrations include access control (so a badge event and the matching clip are viewable together), alarm panels, point-of-sale systems, and intercoms. Before committing to a platform, list the systems you already run and confirm named integrations exist — not just "we have an open API."
Ask specifically:
- Is ONVIF supported for third-party cameras you may want to keep?
- Are integration modules included, or licensed separately?
- Is API access included in the base subscription, or is it an add-on?
Cybersecurity of the Security System
Cameras are internet-connected devices that often sit outside routine IT patching cycles. SIA's Code of Practice assigns clear responsibilities to manufacturers, integrators, and end users, and specifically calls out patching, vulnerability communication, forced changes to default login credentials, role-based access control, multi-factor authentication, and encryption as baseline expectations.
When evaluating a platform, confirm:
- How firmware updates are delivered and whether they can be automated
- Whether streams are encrypted in transit and at rest
- Whether SSO and MFA are supported for user accounts
- Whether the system produces audit logs of who viewed or exported what footage
- The vendor's process for disclosing and remediating CVEs
The end user, as SIA notes, remains the data controller and cannot outsource ultimate responsibility for how footage is secured and used.
Privacy and Notification Obligations
Video surveillance carries legal and ethical obligations that vary by jurisdiction and sector. SIA's Code of Practice highlights core principles worth building into policy from day one:
- Transparency: inform employees and visitors that cameras are in use, and provide a contact for questions or complaints.
- Purpose limitation: use surveillance for a specific, documented reason rather than collecting footage speculatively.
- Data minimization: capture only what is needed for the stated purpose.
- Storage limits: retain footage only as long as reasonably necessary or as required by law.
- Access controls: define who may view or export footage and under what circumstances.
Health care, education, retail marketing, and public-sector deployments each carry additional considerations — HIPAA and PHI implications in health care, FERPA in schools, and notice mandates in many public settings. A privacy impact assessment during system design is a straightforward way to surface these obligations before installation.
User Experience: The Feature Nobody Demos Well
The most capable platform is useless if the people who need it can't operate it under pressure. During evaluation, ask the vendor to sign in as a non-administrator — a shift supervisor or investigator — and complete a routine task: pull up a recent alert on a phone, export a clip for law enforcement, or share a time-bounded link with an insurance adjuster. If those tasks are cumbersome, adoption will be poor.
Total Cost: The Hidden Line Items
Camera hardware pricing is only part of the picture. When comparing platforms over a five-year horizon, include:
- Per-camera software licenses (usually annual)
- Cloud storage tiers tied to retention length
- Add-on features such as license plate recognition, people counting, or heat mapping
- Support and warranty renewals
- Installation, cabling, and network upgrades
- Costs to export data if you leave the platform
For a longer breakdown of how these numbers play out in practice, see our post on the business ROI of AI security cameras.
A Practical Selection Checklist
- Write down your three most common use cases in plain language — for example, "investigate after-hours entries," "review point-of-sale disputes," or "meet insurer retention requirements."
- Ask each vendor to demonstrate those exact scenarios using your footage or a comparable site.
- Request concrete numbers: storage per camera per day, license cost per camera per year, uptime commitments, and integration list.
- Talk to two current customers you find independently, not references the vendor selects.
- Read the contract with attention to auto-renewal terms, data export fees, and cancellation conditions.
Contact Monarch with the site requirements to discuss the next step.
FAQ
Do I need to replace my existing cameras to upgrade the software?
Not necessarily. Many modern video management platforms support ONVIF, which allows them to work with a wide range of IP cameras. Older analog systems and proprietary formats often need to be replaced. Ask the vendor for a site audit before assuming a full replacement is required.
How long should I retain footage?
Retention length depends on your industry, insurer requirements, and any applicable regulations. SIA's Code of Practice recommends storing footage only as long as reasonably necessary or as required by law. Check with your insurance carrier and legal counsel before setting a policy, since their requirements are often stricter than a vendor's defaults.
What's the difference between VMS, NVR, and cloud video?
A video management system (VMS) is the software layer that organizes cameras, users, and recordings. A network video recorder (NVR) is a physical device that records footage locally and often runs a lightweight VMS. Cloud video delivers the VMS as a hosted service with storage in the vendor's data center. Many hybrid systems combine local recording with cloud-based access and analytics.
Will the software work if the internet goes down?
On a well-designed hybrid system, cameras continue recording to local storage during an internet outage, and locally hosted analytics keep running. What typically stops working is remote access, cloud-only AI features, and mobile alerts. When connectivity returns, most platforms sync missing footage and metadata to the cloud. Ask each vendor to describe exactly what functions are lost during an outage and how footage is reconciled afterward.
What privacy notices are required?
Requirements vary by jurisdiction, but SIA's guidance recommends notifying employees and visitors that cameras are in use, describing what data is captured and how it will be used, and providing a point of contact for questions or complaints. Some sectors — such as health care, education, and public spaces — have additional statutory notice obligations. A privacy impact assessment during design is the most reliable way to identify what applies to your site.