The Physical Security Buying Guide: How to Choose Video Surveillance and Access Control

Physical security became an IT purchase while nobody was watching. Modern video surveillance and access control are cloud platforms that happen to have cameras and door readers attached: they ride your network, authenticate against your directory, store data under your compliance policies, and bill like the SaaS on your books. Yet at many companies the buying process still dates from the DVR era, when this was an alarm-company purchase handled by facilities and finished in an afternoon.

That gap between what the product became and how it gets bought is where the expensive mistakes live. This guide is the evaluation we run when we advise on the category, written out so you can run it with an advisor or entirely on your own.

The platform decision comes before the camera decision

The DVR-era habit is to buy hardware: count the doors, count the camera positions, collect a quote. Do that today and you have made the most important decision in the purchase by accident, because the cameras and readers you buy commit you to the software platform that manages them, and the platform is what you will actually live with for the next decade.

Decide the platform deliberately, and the hardware follows. This matters because of how the category is sold: most integrators carry the one or two platforms they are certified on, which means each conversation you have presents one ecosystem, priced and specified with real expertise, but never compared with the others. That is not a defect in the integrator. It is simply the structure of the market, and it means the comparison work belongs to you. Nobody you talk to is positioned to do it for you from inside a single ecosystem.

Pick the architecture from your constraints, not the demo

Three architectures dominate, and each is the right answer for somebody.

• Cloud video (VSaaS). Recording lives in, or is managed through, the cloud. One dashboard across all sites, automatic updates, no recorder hardware. The trade is a recurring subscription and a permanent appetite for upload bandwidth.
• Hybrid. Cameras record locally, the cloud provides management and remote access. Keeps bandwidth consumption modest and video on premises, at the cost of some hardware to own and maintain.
• On-premises. Everything local. Still the right fit for some compliance regimes, air-gapped facilities, and sites where the internet service simply cannot carry video.

The correct choice falls out of your constraints: how many sites, what the circuits at each can actually carry, what your policies require about where footage lives, and who you have to maintain hardware. Write those constraints down first and the architecture usually picks itself. Walk into demos without them and the most polished interface picks it for you.

Retention math sets the bill

Storage is the quiet multiplier in every video quote. Resolution, frame rate, camera count, and retention days multiply into a storage and bandwidth number, and every factor you round up doubles something downstream.

The discipline is to set retention per camera class instead of as one blanket policy. The camera on the cash-handling room and the camera on the loading dock may genuinely need long retention at full resolution. The one watching the parking lot fence line probably does not. A single company-wide number chosen for the most sensitive camera, applied to every camera, is the most common way these systems end up costing multiples of what they needed to.

Retention is also where requirements hide. If insurance, a regulator, or your legal team has an actual number in mind, get it in writing before the specification is drawn, because retrofitting longer retention after the storage is sized is an expensive conversation.

Your network is part of the purchase

Dozens of cameras are a real workload, and they arrive on the same infrastructure that carries your voice, your payments, and your day. Three questions belong in every evaluation, answered per site with specifics.

First, bandwidth: what does the proposed camera plan consume on this site's actual uplink, and what happens to everything else sharing it. Second, power: cameras and readers draw Power over Ethernet, and switches have budgets; the network closet either can or cannot power the plan, and finding out during installation is the wrong time. Third, failure: what does the system do when the internet drops. Does recording continue locally, does door access keep working, and what syncs when the connection returns.

If the answers require upgrading circuits or switching, that is not a reason to abandon the project. It is a cost line that belongs in the comparison now rather than a surprise that lands mid-deployment. Put your network team in the evaluation from the first meeting; this purchase is partly theirs whether or not it is labeled that way.

Access control is an identity purchase

Video gets the attention, but access control is where the purchase touches security posture directly. The modern test is simple: does the platform sync natively with your identity provider. When it does, offboarding becomes one motion, a departed employee loses the badge the same moment they lose email, and the audit trail lives in one place. When it does not, badge deactivation becomes a manual step on a checklist, and manual steps on checklists get missed.

Ask for the integration specifics, not the integration slide: which directory products sync natively, whether the sync is real time or scheduled, and whether video and door events link, so that a badge swipe can pull up the footage of the person who swiped. Then ask what happens to your existing readers and wiring. Reuse of the physical layer is frequently possible and frequently worth a large fraction of the install cost, and the finalists should state precisely what they keep and what they replace.

Ask who actually installs

Two systems with identical hardware can have completely different lives, because installation workmanship, cable quality, camera aim, and commissioning discipline drive long-term reliability more than the spec sheet does. Yet the installing party is often a detail buried in the proposal.

Make it a criterion. Ask each finalist who physically performs the work: their own technicians, certified partner integrators, or subcontractors, and who is accountable when a camera goes dark in month eight. Ask to see a recent local installation. None of these are gotcha questions; suppliers with strong installation operations are glad to be asked, because it is a place they win.

Price the exit before you sign

Every platform is easiest to leave before you join it, so the exit terms belong in the evaluation, not in the eventual dispute.

Three questions do most of the work. What happens at subscription lapse: does recording stop, do doors fail open or locked, do the cameras still function at all. What is the supported life of the hardware generation you are buying, and what does the forced refresh cost when it ends. And can you export your footage and your access logs in a usable format, because your video is your data and the answer should be yes in writing.

This is also the moment of maximum pricing leverage, and it does not return. Multi-year license pricing, renewal caps, and hardware refresh terms are all negotiable at purchase while alternatives still exist, and difficult afterward. The renewal playbook applies to this category with full force; the difference is that here the switching cost includes hardware on your walls, which is exactly why the terms are worth securing on day one.

Compare quotes on five-year all-in math

Physical security quotes resist comparison by design of the category, not by anyone's bad intent: one proposal is heavy on owned hardware, another is heavy on subscription, a third buries installation in a lump sum. At a single point in time they are different shapes of spend and cannot be ranked.

Normalize them to one number: everything you will pay over five years, per camera and per door, including hardware, licenses, installation, support, and any network upgrades the plan requires. Five years is long enough to expose the subscription math and short enough to be honest about hardware life. Multi-site rollouts should also be priced as rollouts: volume pricing on hardware and licenses, and phasing that aligns spend with lease timelines instead of buying every site on day one.

Red flags worth slowing down for

• A quote arrives before anyone has walked the site or asked about your network.
• Retention and resolution are unspecified in the proposal, which means the storage math has not been done.
• Nobody can say what happens to recording and door access when the internet fails or the subscription lapses.
• The proposal is one lump sum that cannot be broken into hardware, licenses, installation, and support.
• The platform requires replacing everything, and the proposal does not say why reuse was ruled out.
• Exit terms, data export, and hardware refresh costs are conversations for later.

Where an advisor fits

All of the above is runnable on your own, and this guide exists to make that practical. What an advisor adds is the comparison work the market's structure makes hard to get otherwise: we help you write the specification in operational terms, sites, camera classes, retention, doors, and integrations, then run the physical security platforms across the whole market against it. You get 3 to 5 recommended suppliers with our reasoning on each, quotes normalized into comparable five-year totals, and license and exit terms benchmarked against what companies like yours actually sign. It costs you nothing, we have no stake in which supplier wins, and you sign directly with the one you choose.

If aging recorders, a new facility, or an insurance requirement has put this purchase on your list, a thirty-minute conversation before the first site walk will save you from buying a decade-long platform by accident.