Managed IT · cyber · security
CCTV used to belong to facilities. Today every camera is a network device, and decisions about where footage lives and how it is reached sit with IT and security as much as with the building manager. One recent enquiry made the point: a luxury hotel wanted cameras, but would not accept anything that sent footage outside the building because of who stays there.
That hotel needs an on-premise design. Most of our clients, with offices, schools and multiple sites, are better served by cloud. This guide sets out the benefits of each from an IT and security point of view, and the controls to insist on either way.
Why cloud CCTV suits most organisations
- One console for every site. Branches, offices and warehouses sit in one platform with one set of users and permissions, rather than a recorder and a login per building.
- No inbound ports. Cloud-managed cameras connect outwards to the platform, so there is nothing to port-forward and no VPN to maintain for remote viewing. Exposed recorders are one of the commonest ways CCTV is compromised.
- Patching is not your problem. Firmware and platform updates are pushed automatically, so cameras do not sit on old code for years.
- Single sign-on and MFA. Users sign in with their work identity, so when someone leaves, their camera access goes with their account. That fits the joiner and leaver process you already run.
- Audit trail by default. Who viewed, searched and exported what, and when, is logged and reviewable.
- Health monitoring. Offline or tampered cameras raise alerts instead of being found the day footage is needed.
- Faster investigations. Search across every site by person, vehicle or time instead of pulling footage off individual recorders.
- Fewer boxes to secure. With footage kept on the cameras and optionally backed up to the cloud, there is no on-site recorder to fail, fill up or walk out of the door.
- Converged physical security. Cameras, door access, intercom and environmental sensors on one platform, managed with the same permissions.
What to weigh against it
- A licence per camera, which covers the platform, support and updates.
- A dependency on internet connectivity for management and remote viewing.
- Thumbnails and system data reach the supplier’s platform even when footage stays on the camera, so check what is held and where.
- Supplier risk: you are relying on their security engineering as well as yours.
Why on-premise still has its place
- Data never leaves the site. For sensitive locations and high-profile occupants, that is the requirement.
- It can be air-gapped. A camera network with no route to the internet removes the external attack surface.
- Independence from the internet and from a supplier’s platform.
- No per-camera subscription, and storage sized locally to the retention you need.
What to weigh against it
- Patching, credentials and monitoring are your team’s job, indefinitely.
- The recorder is a single point of failure, and a physical target.
- Multi-site visibility needs a central system and secure links to build and run.
- Any remote access you add becomes your largest risk if it is not designed properly.
| Cloud-managed | On-premise | |
|---|---|---|
| Attack surface | Your accounts and the supplier’s platform | Your network, the recorder and any remote access you add |
| Patching | Supplier pushes updates | Your team schedules and applies them |
| Identity | SSO and MFA typically built in | Local accounts unless integrated |
| Inbound firewall rules | Typically none | None if isolated; VPN if remote access is needed |
| Multi-site | One console | Per-site recorders or a central server |
| Data location | Cameras and/or cloud | On site only |
How cameras become a network risk
The NCSC warns that a single exposed connected device can give an attacker a way into the wider corporate network, and names default passwords, unpatched devices and weak configuration as what attackers look for. The record bears that out:
- The Mirai botnet of 2016 used 62 factory logins to take over around 600,000 devices at its peak, mostly IP cameras and recorders.
- A Hikvision command-injection flaw (CVE-2021-36260) was still unpatched on around 80,000 internet-facing devices a year after the fix, more than 2,000 of them in the UK.
- A flaw in the ThroughTek Kalay P2P library, used for remote viewing in many recorders and cameras, allowed live viewing of affected devices.
- NPSA’s CAPSS guidance describes malware spreading through control-room PCs that could see the camera system.
- In November 2022 the UK government told departments to stop deploying surveillance equipment from companies subject to China’s National Intelligence Law on sensitive sites and not to connect it to core networks.
Cloud services are not immune: the risks move to identity and supplier access. In two consumer cases, the FTC found Ring had let employees view customer videos and was slow to stop credential-stuffing attacks, and a Wyze fault in 2024 briefly showed some users other people’s camera images. Enterprise platforms address this with published controls. Verkada, for example, documents SSO, MFA, encryption, audit logs that include its own support staff, and support access that is off by default and time-limited when granted.
Controls to insist on, whichever you choose
For any CCTV system
- Cameras on their own VLAN or physical network, firewalled from business IT and guest Wi-Fi.
- Named accounts with least privilege; no shared logins; default credentials changed or disabled.
- Logging of sign-ins, views and exports, reviewed by someone independent of the operators.
- A retention period set to the purpose, not the system default.
- Equipment replaced when it leaves support.
Extra for cloud
- SSO with your own identity provider and MFA enforced.
- Role-based access by site and camera.
- Supplier support access off unless granted, and logged.
- Clear answers on encryption, data location and what leaves the camera.
Extra for on-premise
- No port forwarding, UPnP or manufacturer P2P services.
- Remote access, if any, only by VPN with MFA.
- Encrypted recorder storage, the recorder in a locked room, and a patching schedule someone owns.
These follow NPSA’s CAPSS guidance, NCSC advice on enterprise connected devices and CISA’s mitigations for IP cameras.
Data protection
UK GDPR applies the same way to both. The ICO expects a DPIA for higher-risk surveillance, retention no longer than necessary, access restricted to authorised people, encryption and audit trails, and the ability to locate and redact footage for subject access requests. With cloud, the supplier is your processor, so you need a written contract and security assurances.
Our view
For organisations with more than one site, or without the IT capacity to patch and monitor recorders, cloud-managed CCTV is usually the more secure choice in practice, and it is what we install most often. For sites where the footage itself is the risk, an isolated on-premise system is the right answer. We will tell you honestly which fits. Talk to us about your estate, see our building security and cyber security services, or read the group’s guide for hotels and high-profile sites.
Questions
Is cloud CCTV secure enough for a corporate network?
Do cloud cameras need firewall ports opening?
Should CCTV be on its own VLAN?
Can CCTV sign-in use Microsoft Entra ID or Okta?
When is on-premise the better choice?
Who is responsible for the footage under UK GDPR?
Sources
Checked 18 October 2026.
- NCSC: organisational use of enterprise connected devices
- NPSA: Cyber Assurance of Physical Security Systems (CAPSS) guidance
- CISA: advisory and mitigations for IP cameras
- CISA: Hikvision CVE-2021-36260
- BleepingComputer: 80,000 Hikvision cameras still exposed (2022)
- CISA: ThroughTek Kalay P2P advisory
- USENIX: Understanding the Mirai botnet
- UK Parliament: surveillance equipment at sensitive sites (Nov 2022)
- FTC: Ring (2023)
- Verkada: security controls
- Verkada: hybrid cloud architecture
- ICO: accountability for video surveillance (controllers and processors)
- ICO: guidance on video surveillance