We’re Tracking the Future of Security

Category: Video Surveillance & Imaging

Cameras, video management software (VMS), AI video analytics and imaging technologies used to monitor and secure physical spaces.

  • Asheville City Council Votes to End Flock Safety Camera Contract, Remove All 11 License-Plate Readers

    Asheville City Council Votes to End Flock Safety Camera Contract, Remove All 11 License-Plate Readers

    The Asheville, North Carolina City Council voted on Tuesday, August 25, 2026, to terminate the city’s contract with license-plate reader vendor Flock Safety and remove all 11 of its cameras from city streets, according to local reporting from WLOS.

    Mayor Esther Manheimer said the decision reflected growing concerns about how Flock manages the data its cameras collect and who can access it, framing the vote as an attempt to balance public-safety utility against privacy risk. Rondell Lance, president of the local Fraternal Order of Police chapter, opposed the removal, arguing the system had given investigators an efficient way to narrow suspect vehicles by characteristics rather than manually checking every potential match.

    Part of a Wider Pattern of Contract Reviews

    Asheville’s vote follows a period of intensifying scrutiny of automated license-plate reader networks nationally, after Flock Safety itself cut its default data-retention window to seven days earlier this month in response to similar pressure. Other jurisdictions, including communities in the Chicago suburbs, have faced comparable public fights over whether to keep, expand, or cancel Flock deployments amid concerns that plate-reader data could be accessed for purposes such as immigration enforcement or unauthorized personal tracking by officers.

    Asheville’s existing contract with rival vendor Axon includes provisions for stationary license-plate readers, though none are currently installed; city officials said any future deployment would require new privacy policies to be established first.

  • Securing the Video Surveillance Network: Camera and VMS Cybersecurity Hardening

    Securing the Video Surveillance Network: Camera and VMS Cybersecurity Hardening

    A video surveillance deployment is, from a network architecture standpoint, a fleet of embedded computers with microphones and lenses attached. Every IP camera runs firmware, exposes management interfaces, and communicates over the network with a video management system (VMS) that itself typically runs on general-purpose server infrastructure. That reality has made surveillance infrastructure an increasingly attractive target: camera botnets, credential-stuffing campaigns against exposed device management ports, and compromises of large fleets of network video recorders have all been documented by security researchers in recent years, with campaigns targeting tens of thousands of devices at a time through weak default credentials, unpatched authentication bypasses, and exposed peer-to-peer discovery services.

    Where the Attack Surface Actually Lives

    Camera and VMS security incidents tend to cluster around a small number of recurring weaknesses:

    • Default and weak credentials. Cameras and NVRs shipped with default administrative passwords, or deployed without forcing a credential change during commissioning, remain one of the most common initial-access vectors documented in mass-compromise campaigns.
    • Exposed management interfaces. Web-based camera configuration portals and VMS admin consoles left reachable from the public internet — whether through direct exposure or through port-forwarding and peer-to-peer relay services intended to simplify remote viewing — substantially expand the attack surface beyond what a properly segmented deployment would allow.
    • Unpatched firmware and software. Camera firmware and VMS platforms both accumulate disclosed vulnerabilities over their service life; devices that are difficult to patch at scale, or that are past vendor support, accumulate risk the longer they remain in service.
    • Flat network architecture. Surveillance devices placed on the same network segment as general IT infrastructure, without VLAN segmentation or firewall rules restricting camera-to-camera and camera-to-internet traffic, allow a single compromised device to become a pivot point into the broader network.

    Baseline Hardening Practices

    Network Segmentation

    Placing surveillance devices on a dedicated VLAN, with firewall rules limiting traffic to only the VMS server and required management systems, is widely regarded as the single highest-value control. Properly segmented deployments prevent a compromised camera from being used as a stepping stone to reach payroll systems, building automation, or other unrelated infrastructure.

    Credential and Access Management

    Forcing unique, strong credentials at commissioning, disabling unused default accounts, and integrating camera and VMS authentication with centralized identity management where supported all reduce the practical value of credential-based attacks. Multi-factor authentication on VMS administrative accounts is increasingly treated as a baseline expectation rather than an optional enhancement.

    Patch and Lifecycle Management

    Maintaining an inventory of camera models, firmware versions and support end-dates allows security teams to prioritize patching and plan replacement of end-of-life devices before they become the weakest link in the deployment. Vendor security advisories should be monitored on an ongoing basis, not just at initial deployment.

    Disabling Unnecessary Services

    Many cameras ship with peer-to-peer discovery, UPnP, and remote-access features enabled by default to simplify consumer setup. In enterprise deployments, these services are frequently unnecessary and expand the attack surface without a corresponding operational benefit; disabling them where not explicitly required is standard hardening guidance.

    FAQ

    Are IP cameras less secure than older analog systems?

    Not inherently — but IP cameras carry cybersecurity risks that analog systems did not, because they are addressable network devices. The security question is less about IP versus analog and more about whether the network deployment follows segmentation, credential and patch-management practices appropriate to a networked device fleet.

    Who is responsible for camera cybersecurity in most organizations?

    This varies significantly. In organizations where physical security and IT/cybersecurity functions remain siloed, camera and VMS hardening can fall into a gap between the two teams. Organizations further along in cyber-physical convergence typically assign shared or explicit ownership of surveillance-network security to avoid this gap.

    Conclusion

    Video surveillance infrastructure has moved from being a passive physical-security tool to being an active part of the enterprise attack surface. Treating cameras and VMS platforms with the same network segmentation, credential hygiene and patch discipline applied to other networked IT assets — rather than as a separate, lower-scrutiny category — is now a baseline expectation for any organization operating surveillance infrastructure at scale.

  • CISA Warns of Hardcoded Credentials in Johnson Controls TL280 Security Cameras

    CISA Warns of Hardcoded Credentials in Johnson Controls TL280 Security Cameras

    CISA published an Industrial Control Systems advisory on August 6, 2026 (ICSA-26-218-02) warning that Johnson Controls TL280 cameras running firmware versions prior to 5.63 contain hardcoded credentials that could allow an attacker to access sensitive information on the device.

    The vulnerability, tracked as CVE-2026-27871 and rated 4.1 on the CVSS v3 scale, stems from the use of a broken or risky cryptographic algorithm tied to authentication values embedded directly in the device firmware. Because the credentials are fixed at the firmware level rather than generated per device, an attacker who recovers them from one unit could potentially reuse them across other TL280 deployments running the same vulnerable firmware version.

    Johnson Controls, headquartered in Ireland, reports that TL280 units are deployed worldwide across Critical Manufacturing, Commercial Facilities, Government Services and Facilities, Transportation Systems, and Energy sectors — reflecting how widely IP camera platforms from major building-security vendors have been integrated into critical infrastructure environments. As of the advisory’s publication, CISA said it was not aware of public exploitation specifically targeting this vulnerability.

    Recommended Mitigations

    Johnson Controls’ primary recommended fix is to apply firmware update 5.63, which addresses the hardcoded credential weakness directly. CISA and the vendor also recommend layered compensating controls for cameras that cannot be updated immediately:

    • Restrict network access to affected cameras to trusted management VLANs only, and avoid exposing devices directly to the internet or untrusted network segments
    • Monitor device access logs for anomalous authentication activity
    • Rotate any shared or downstream credentials that may have been derived from or associated with the hardcoded values
    • Segment ICS/SCADA and physical-security device networks behind firewalls, isolated from general business networks
    • Use up-to-date VPNs for any required remote access rather than direct internet exposure

    The advisory is a reminder that video surveillance hardware sits at the intersection of physical and cyber risk: a credential weakness in a camera is not just a data-exposure issue but a potential foothold into the broader network segment the camera is connected to, particularly in environments where security devices are deployed on flat, unsegmented networks.

  • Siemens Patches Critical Remote Code Execution Flaw in Siveillance Video Management Servers

    Siemens Patches Critical Remote Code Execution Flaw in Siveillance Video Management Servers

    Command Injection Rated Critical

    CISA published ICS advisory ICSA-26-225-09 on August 13, 2026, describing a critical vulnerability in Siemens Siveillance Video, a video management platform deployed worldwide across the critical manufacturing, communications and commercial facilities sectors. Tracked as CVE-2026-3014 and rated CWE-78 (OS Command Injection), the flaw affects Siveillance Video V2023 R3 versions before 23.3.27, V2024 R1 versions before 24.1.16, and V2025 versions before 25.1.15, with a CVSS v3 base score of 9.1.

    According to the advisory, a user with edit permissions on the Management Server can exploit the flaw to execute arbitrary code in the context of the Management Server service, which could allow an attacker to take control of connected video management infrastructure.

    Updates Available for All Affected Branches

    Siemens has released fixed versions for each affected release branch: V23.3 HotfixRev27 or later, V24.1 HotfixRev16 or later, and the V25.1.15 update for the 2025 branch. CISA and Siemens recommend that operators update to the corrected versions as soon as practical and, in line with general ICS hardening guidance, restrict Management Server edit permissions to trusted administrators and segment video management infrastructure from untrusted networks.

    Sources

  • Flock Safety Cuts License-Plate Data Retention to Seven Days Amid Surveillance Backlash

    Flock Safety Cuts License-Plate Data Retention to Seven Days Amid Surveillance Backlash

    New Guardrails Announced Amid Growing Criticism

    Flock Safety, which operates a nationwide network of more than 119,000 automated license-plate-reader (ALPR) cameras used by law enforcement agencies, announced a set of privacy and accountability reforms on August 13, 2026, according to Fox Business. The changes come as the company faces mounting criticism from privacy advocates and elected officials over mass surveillance concerns and reports of officers misusing the technology, including cases documented by Wired in which police reportedly used Flock data to track romantic partners.

    Flock CEO Garrett Langley discussed the changes publicly, telling Fox Business’s “Varney & Co.” that the reforms were a direct response to backlash the company has faced over its car-tracking cameras. Some local officials have gone further than criticism: Knox County, Tennessee, Mayor Glenn Jacobs has called for a national moratorium on further deployment of Flock’s camera network, according to Fox Business.

    Shorter Retention, Mandatory Audit Controls

    The centerpiece of the announcement is a reduction in Flock’s standard data-retention window from 30 days to seven. The company said that roughly 90% of all searches conducted on its platform already occur within a week of data capture, arguing the shorter window would have limited practical effect on law enforcement’s ability to use the system while narrowing the amount of location data stored on Flock’s servers at any given time. For cases requiring longer retention, Flock is introducing an “Evidence Mode” feature that lets agencies preserve specific data for extended periods under state or local policy.

    Flock is also making its “Audit Assistance” feature — which flags abnormal search behavior and can lock a user out of the system in real time pending administrator review — mandatory for all law enforcement customers rather than optional; the company said roughly a third of agencies had turned the feature on voluntarily before the change. Separately, Flock is making the previously optional requirement to log a case code with every search mandatory going forward, with an override reserved for emergencies such as missing-child cases. “A search without a reason is a search that shouldn’t happen in the first place, and now Flock’s system automatically treats it that way,” the company told Fox Business.

    New Controls Over Cross-Agency Data Sharing

    The company is also giving individual agencies more granular control over which types of cases they will share camera search access for with other jurisdictions. In comments to Fox Business, Flock gave the example that “City A could allow City B to search its cameras for a stolen vehicle or violent crime while blocking searches related to immigration enforcement” — an option aimed at addressing concerns that Flock’s interconnected camera network could be used for purposes individual municipalities have not authorized.

    Civil liberties groups were not satisfied by the announcement. The American Civil Liberties Union said in a statement reported by Fox Business that the reforms “seem to be a thinly veiled PR attempt to counter communities’ genuine privacy concerns with its mass surveillance system with largely hollow security promises, rather than an earnest effort to address them.” Flock, for its part, has pointed to its own figures on the technology’s investigative use, telling Fox Business that its cameras were involved in roughly 1 million investigations last year and were tied to the location of about 10,000 missing people — figures that reflect the company’s own reporting and have not been independently verified.

    Sources

  • Video Fire Detection: AI Cameras as Early-Warning Systems

    Video Fire Detection: AI Cameras as Early-Warning Systems

    Video fire detection uses cameras and analytics to identify visual patterns associated with smoke or flame. The technology is especially attractive in large or open spaces where traditional ceiling-mounted detectors may be slow or difficult to install.

    Algorithms analyze movement, texture, color, growth patterns and other features that distinguish smoke or flame from normal scene activity. Modern AI models can improve classification and reduce nuisance alarms caused by fog, steam, reflections or moving objects.

    Typical applications include warehouses, waste facilities, tunnels, industrial yards, aircraft hangars, battery storage areas and outdoor process sites. In these environments, a camera may see developing smoke at a distance before heat or smoke reaches a conventional detector.

    Video detection also provides immediate context. Operators can verify the scene visually and understand the location and scale of an event. Recorded video can support investigation after the incident.

    The technology still has limitations. Camera placement, lighting, obstructions, weather and lens contamination affect performance. Video analytics should not be assumed to replace code-required detection systems unless the design and approvals explicitly support that use.

    The strongest approach is usually integration. Video fire detection can add early-warning capability to conventional smoke, heat, flame or gas detection, creating a richer and faster picture of developing fire conditions.

  • Video Surveillance Storage: How Much Storage Do You Really Need?

    Video Surveillance Storage: How Much Storage Do You Really Need?

    Storage is one of the largest cost components in a video surveillance system, yet it is often estimated with oversimplified assumptions. Real requirements depend on bitrate, frame rate, resolution, compression, scene complexity, recording mode, redundancy and retention policy.

    How the Technology Works

    The basic calculation is straightforward. A camera producing an average bitrate of 4 megabits per second generates roughly 43 gigabytes per day before overhead. Multiply that by the number of cameras and retention days, and storage grows quickly.

    Average bitrate is more useful than resolution alone. A 4K camera does not always use four times the storage of a lower-resolution camera because modern codecs, frame rate and scene activity have major effects. A quiet corridor may compress extremely well, while a tree-filled outdoor scene with rain and movement can require much more bandwidth.

    Operational Considerations

    Variable bitrate is common because it allocates more data to complex scenes and less to static ones. This improves efficiency but makes capacity planning dependent on realistic average and peak values. Integrators should use field measurements where possible rather than rely only on nominal manufacturer figures.

    Recording policy can reduce storage dramatically. Continuous recording is appropriate for many critical environments, but some cameras may use motion-based or event-based recording. Pre-event and post-event buffers preserve context while avoiding continuous high-bitrate storage in low-risk areas.

    Retention should be driven by operational need and regulation. Keeping every camera for 90 days because storage is available may be unnecessary. Different camera groups can have different retention periods. Critical entrances may need longer retention than low-risk internal spaces.

    Deployment and Risk

    Redundancy also consumes capacity. RAID, replication, failover recording and backup must be included in the design. Usable storage is always lower than raw disk capacity.

    Cloud storage introduces additional variables such as upload bandwidth, egress charges and subscription tiers. Hybrid systems may keep recent high-resolution video locally and archive selected evidence to the cloud.

    A good storage design includes a safety margin and monitoring. Actual bitrate should be reviewed after commissioning, and capacity alerts should warn administrators before retention drops below policy.

    Conclusion

    The objective is not to buy the largest array possible. It is to create a documented storage model that matches camera behavior, evidence requirements and resilience goals. Accurate calculation can save substantial cost while ensuring that critical video is available when an investigation begins.

  • Cloud VMS vs On-Premise VMS

    Cloud VMS vs On-Premise VMS

    Video management systems are increasingly available as cloud services, traditional on-premise platforms or hybrid combinations. The correct choice depends on scale, connectivity, cybersecurity policy, retention requirements and how much operational control the organization wants to keep locally.

    How the Technology Works

    An on-premise VMS places recording servers, databases and management software inside the organization’s infrastructure. This provides direct control over storage and network architecture. It can be attractive for high-bandwidth sites, long retention periods and facilities with strict data-residency requirements.

    Cloud VMS shifts more of the management layer to hosted infrastructure. Cameras may connect directly to the service or through local gateways. Software updates, remote access and multi-site administration are usually simpler because the platform is operated as a service.

    Operational Considerations

    Bandwidth is a key design issue. Sending full-resolution continuous video to the cloud can be expensive or impractical at large sites. Many cloud architectures therefore record locally and upload events, lower-resolution streams or selected footage. This hybrid model reduces WAN dependence while preserving centralized management.

    Cloud services can offer rapid deployment and predictable subscription costs, but recurring fees should be compared with the lifecycle cost of local servers, storage, operating systems, maintenance and upgrades. The cheapest model depends on camera count, bitrate and retention.

    Cybersecurity responsibility changes rather than disappears. A reputable cloud provider can operate strong infrastructure and patch services quickly, but the customer remains responsible for device credentials, user permissions, network configuration and governance. On-premise systems provide control but also place more maintenance responsibility on internal teams.

    Deployment and Risk

    Resilience should be designed explicitly. What happens if the internet connection fails? Can cameras continue recording? Can local operators still view critical video? A cloud-first system should define offline behavior before it is deployed in a critical environment.

    Hybrid VMS is becoming a common enterprise strategy. Local storage provides continuity and bandwidth efficiency, while cloud services provide centralized health monitoring, remote access, analytics and fleet management.

    Conclusion

    There is no universal winner. Single-site critical facilities may favor local control. Distributed organizations may benefit greatly from cloud management. The best architecture is based on operational requirements and risk, not on a blanket preference for either cloud or on-premise technology.

  • Multispectral Cameras for Security Applications

    Multispectral Cameras for Security Applications

    Visible-light cameras are excellent when there is enough illumination and contrast, but security environments are rarely ideal. Multispectral systems combine information from different parts of the electromagnetic spectrum to improve detection, classification and situational awareness.

    How the Technology Works

    The most common security combination is visible and thermal imaging. A visible sensor provides detail, color and identification information, while a thermal sensor detects heat differences that remain useful in darkness and many low-contrast conditions. When the two views are calibrated, operators can switch between them or display fused imagery.

    Near-infrared imaging is another tool. Many conventional surveillance cameras already use near-IR sensitivity for night mode. More specialized systems may combine visible, near-IR and short-wave infrared to reveal materials or conditions that are difficult to distinguish with ordinary color video.

    Operational Considerations

    Thermal imaging is particularly valuable for perimeter security because it does not depend on reflected visible light. A person can often be detected against a background at night without floodlights. Thermal cameras can also support temperature-based monitoring in industrial environments when radiometric measurement is available.

    No spectrum is perfect. Thermal cameras can lose contrast when the target and background reach similar temperatures. Heavy rain, certain atmospheric conditions and glass can affect performance. Visible cameras can provide details that thermal sensors cannot, such as clothing color or readable signage.

    Sensor fusion addresses these weaknesses. Radar can provide range and speed, thermal can provide robust detection, and visible video can provide verification. Multispectral cameras fit naturally into this layered architecture.

    Deployment and Risk

    Optics and alignment are important. Different wavelengths require different lens materials and focus characteristics. A dual-sensor device must be designed so that both views correspond accurately enough for operators and analytics.

    Multispectral systems are increasingly relevant in airports, energy facilities, borders, ports, data centers, industrial plants and remote infrastructure. They are especially useful where lighting cannot be guaranteed or where detection must continue through day-night transitions.

    Conclusion

    The right question is not whether multispectral is “better” than visible imaging. It is whether the additional spectrum solves a specific weakness in the target environment. When it does, multispectral sensing can dramatically improve resilience and reduce dependence on perfect lighting.

  • Low-Light Cameras: Sensor Size, Aperture and AI Enhancement

    Low-Light Cameras: Sensor Size, Aperture and AI Enhancement

    Low-light surveillance is often marketed with impressive nighttime images, but camera performance is governed by basic optics and sensor physics. Understanding sensor size, aperture, shutter speed, noise and illumination helps buyers distinguish real performance from aggressive image processing.

    How the Technology Works

    A larger image sensor can collect more light, especially when resolution is not increased excessively. Pixel size also matters. Two cameras with the same megapixel count may perform very differently if one uses a substantially larger sensor.

    Lens aperture controls how much light reaches the sensor. A lower f-number generally allows more light, but aperture, depth of field and lens quality must be balanced. A bright lens cannot compensate for poor focus or incorrect field of view.

    Operational Considerations

    Shutter speed is another trade-off. Slower exposure can make a static scene appear bright but creates motion blur. A camera that produces a beautiful nighttime still image may fail to capture a recognizable moving person or vehicle. Security testing should therefore include moving targets.

    Noise reduction can improve appearance but may remove detail. Heavy temporal noise reduction can produce ghosting around moving objects. AI enhancement can reconstruct edges and suppress noise more intelligently, but it still cannot recover information that the sensor never captured.

    Infrared illumination remains a practical solution. Integrated IR LEDs or separate illuminators can provide consistent nighttime performance without visible light. However, reflective surfaces, insects, fog and nearby objects can cause overexposure or backscatter.

    Deployment and Risk

    Visible white light can provide color information that infrared cannot. Some modern cameras combine large sensors, bright lenses and controlled supplemental lighting to maintain color at very low illumination. This can be useful when clothing or vehicle color is important to an investigation.

    Low-light specifications should be treated cautiously because manufacturers may measure minimum illumination under different conditions. The best comparison is a controlled field test using the intended lens, scene and target speed.

    Conclusion

    For security designers, the lesson is simple: lighting is part of the surveillance system. Camera selection, scene illumination, target movement and analytics requirements should be engineered together. AI can improve a good image, but it does not eliminate the need for enough photons at the sensor.