Security estates are budgeted like a purchase and behave like a subscription. The installation is quoted, approved and delivered, and then the real spending starts, spread across storage, licensing, maintenance visits, firmware work and the staff time nobody costed. Organizations that lower the running cost of a security estate almost never do it by buying cheaper equipment. They do it by removing the four things that make an estate expensive to keep alive.
Where the money actually goes
The purchase price is the part everyone examines and the smallest part of the lifetime figure. What drives the ongoing cost is more mundane.
- Retention. Storage is a direct function of how many days you keep, at what resolution and frame rate, across how many devices. It is also the number most often set by accident, which is why it is the first place to look.
- Licensing. Per device, per site, per feature, per analytic, renewed annually. The cost is predictable; what makes it painful is discovering the model only at renewal.
- Maintenance and truck rolls. A camera that fails silently costs nothing until the day it is needed. Then it costs an incident. Scheduled maintenance is cheaper than the unscheduled kind, and both are cheaper than not knowing.
- Firmware and patching. Recurring, unavoidable, and the item most often absent from the operating budget entirely.
- Staff time. Pulling footage, managing accounts, answering requests. Rarely measured, frequently the largest line.
Retention is the lever, and it is a policy question
Halving retention halves the storage bill, and it is the one change that needs no new equipment. It also cannot be made on cost grounds alone, because the point of retention is that footage exists when someone asks for it.
Two federal texts frame this usefully. NIST SP 800-53 control AU-11 asks organizations to retain records for a period they define, consistent with a records retention policy, and specifically to support after the fact investigation. The Federal Trade Commission's Safeguards Rule at 16 CFR 314 comes at the same problem from the other side: it requires procedures for the secure disposal of customer information no later than two years after the last date it was used, unless there is a legitimate business or legal reason to keep it, and it requires the retention policy itself to be reviewed periodically to minimize unnecessary retention.
Read together, these say something practical. Keeping footage longer than you can justify is a cost and, where the footage contains regulated information, an exposure. Keeping it shorter than your disputes take to arrive is a false economy. The correct retention period is the one someone chose, wrote down and can defend, and most estates have never had that conversation.
What drives the number up
Four patterns account for most of the difference between two estates of the same size.
- Resolution specified everywhere rather than where it is needed. Identification at a chosen line needs detail. A car park overview does not. Estates that apply one specification to every camera pay for the highest requirement across the lowest value coverage.
- No camera health monitoring. Without it, failures are found by searching for footage that does not exist. The cost lands as a failed investigation rather than as a maintenance line, which is why it never appears in the budget review.
- Accounts that accumulate. Export rights granted for a project and never withdrawn are both a cost and a risk. NIST SP 800-53 control PE-6 pairs monitoring physical access with reviewing the logs at a defined frequency and coordinating what they show with incident response, which only works if someone owns the review.
- Devices that cannot be maintained at all. NIST IR 8259A sets out the baseline capabilities a networked device should have, among them the ability to identify the device, to change its configuration only through authorized entities, and to receive software updates. Equipment lacking those is cheap to buy and expensive to own, because every change becomes a site visit.
What a controlled run cost looks like
An estate whose running cost is under control has a recognizable shape, and none of it is about the hardware.
- Retention is a number with a rationale behind it, reviewed on a schedule rather than at renewal.
- Camera health is monitored, and a failure raises an alert rather than surfacing during an investigation.
- Licensing terms are known before the renewal quote arrives, and the renewal is not the first time anyone reads the model.
- Footage requests are answered the same day, by more than one person, which converts a dependency into a capability.
- Access is reviewed on a cadence, and the review has a named owner.
- Firmware is a scheduled activity with a budget line, not an emergency.
Two honest caveats belong here. First, none of this produces a saving you can attribute cleanly, because the largest returns are costs not incurred and disputes that closed quickly, and neither leaves a line in a ledger. The measurement problem is treated separately in measuring the value of video surveillance. Second, reducing run cost is not the same as reducing capability, but it is easy to do the second while claiming the first. Cutting retention, deferring firmware and dropping monitoring all lower the monthly figure and raise the chance that the system is not there when it is needed.
The prerequisite for any of it is knowing what you actually run: how many devices, in what condition, on what retention, under which licenses. Most estates cannot answer that from records. Request a free site security assessment to establish the baseline. For what drives the initial spend rather than the running cost, see how much video surveillance costs, and for the wider picture, the guide to video surveillance. What we install and support is on our video surveillance solutions page.
Sources
- National Institute of Standards and Technology, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations. Establishes control AU-11, requiring records to be retained for an organization defined period consistent with a records retention policy and to support after the fact investigation, and control PE-6, pairing monitoring of physical access with review of the logs at a defined frequency and coordination with incident response. nvlpubs.nist.gov. Accessed 18 August 2026.
- Electronic Code of Federal Regulations, 16 CFR 314, Standards for Safeguarding Customer Information. Establishes the requirement for procedures to securely dispose of customer information no later than two years after its last use, subject to legitimate business and legal exceptions, and the requirement to periodically review the data retention policy to minimize unnecessary retention. ecfr.gov. Accessed 18 August 2026.
- National Institute of Standards and Technology, NIST IR 8259A, IoT Device Cybersecurity Capability Core Baseline. Establishes the baseline device capabilities relied on here, including device identification, configuration changeable only by authorized entities, and software update. nvlpubs.nist.gov. Accessed 18 August 2026.