Ten questions before you sign a cloud VMS contract.

The single most important question. A closed VSaaS (Video Surveillance as a Service - cloud CCTV; Verkada, Rhombus and Cisco Meraki MV are the well-known US examples) only works with that vendor's own cameras, and those cameras stop working if you cancel the subscription. The trade publication IPVM calls this pattern "Hostage as a Service".

An open VSaaS (TetherX, Eagle Eye / Brivo, Videoloft, Camcloud, Milestone Arcules) works with any camera that supports ONVIF (the camera interoperability standard) plus 200-700+ named manufacturers. Existing cameras stay. The installer keeps the choice of brand.

Then ask the question that tests "open" in practice: if our needs change in three years, what can we add or replace without starting over? A new building, a different camera brand, an access system or an analytics module should be an addition, not a new platform.

Ask it of the other systems on site too. With TetherX, alarm panels reporting SIA DC-09 or Contact ID, access control, and sensors wired through a compatible input/relay board arrive as events on the same timeline as the cameras, and one REST API passes those events to your own dashboards and reports.

Score: open = +2, hybrid (open but with a preferred brand) = +1, closed = 0.

NDAA Section 889 is a US trade rule that stops federal-adjacent buyers using cameras or recorders from Hikvision, Dahua, Huawei, Hytera and ZTE - plus any equipment built around Huawei HiSilicon chips. Maintenance contracts count. Foreign offices count. Canada made its federal ban official in 2025; the UK restricts these on government and Ministry of Defence sites; Australia ordered them removed from federal sites in 2023; the Netherlands, Taiwan and the EU's NIS2 directive all add similar restrictions.

For the VSaaS platform, ask: is the vendor on the SIA (Security Industry Association) NDAA-compliant list? For the cameras, ask which NDAA-compliant brands the platform supports - Hanwha Vision (South Korean), Axis (Swedish, Canon-owned), Avigilon (Canadian, Motorola), Pelco (American, Motorola), Bosch (German), i-PRO (Japanese), VIVOTEK (Taiwanese), Mobotix (German).

TetherX handles the migration by ringfencing - existing Hikvision or Dahua cameras stay behind a TetherBox so they never touch the public internet, then you replace them in phases over 12-36 months. Full detail: NDAA compliance and ringfencing.

According to IPVM's 2026 pricing-transparency analysis, only Videoloft and Rhombus publish full per-camera, per-retention price sheets. Eagle Eye / Brivo publishes tier ranges but specifics need a quote. Verkada publishes ranges only. Milestone Arcules, Spot AI, Cloudastructure, YourSix and TetherX are all quote-only through the channel.

Quote-only isn't automatically bad - vendors that sell only through the channel price each deal in context, and a qualified installer trained on the platform brings advantages a direct-from-vendor sale cannot. The vendor only knows the software; the installer knows the site, the cameras already in place, the network constraints, the cabling, the access-control hardware and the alarm panels (most of which the vendor does not supply), and is the single point of contact when something needs adjusting after go-live. The trade-off is comparing pricing across vendors is harder. Ask each vendor for a written quote at your camera count and retention that lists every line billed separately (licence-plate recognition, AI, longer retention, integration modules). Question 10 covers how that price changes as you grow.

Verkada has five (Command, Pass, Events, Mailroom, Air). Eagle Eye / Brivo three (Viewer, Smartphone Camera, CameraManager). Rhombus two. Milestone post-Arcules up to four. Netvue three.

And it compounds three ways. Per scope: Eagle Eye Viewer covers the cloud-recorded cameras only - any local-recorded camera at the same site lives on the on-site NVR app from whichever brand supplied it. Per product line within one vendor: video, access, intrusion, visitor and broadcast each get their own app (the five Verkada apps above). Per vendor across an estate: real customers rarely run one brand everywhere, so each adds another dashboard, login and notification stream.

End-user impact: wrong app installed, feature not found, patience gone. IPVM forum on home-use alerts: "Almost every residential customer concerned with mobile apps and notifications gravitates toward consumer companies like Vivint, Arlo, and Nest" - business CCTV lost the home and small-business market on the one feature buyers care about most. The bar is one app covering local + cloud recording, alarms, access, multi-site, with notifications that work as well as the consumer ones - the bar TetherX is built to.

The 2025-26 cloud-CCTV feature race is multi-site AI search across recorded footage by analytics tag (person / vehicle / animal / audio class) and, on some platforms, by free-text prompt. Mature AI search in production: Verkada, Rhombus (ChatGPT-powered, added 2025), Spot AI, Eagle Eye / Brivo, Coram AI, Hakimo, March Networks (Canadian; their AI Smart Search uses sampled snapshots, absorbing the VIVOTEK-branded business in April 2026), Genetec (added September 2025), Lumana, Conntour, VisionPlatform.ai. TetherX delivers person, vehicle and animal detection, 63-class audio analytics, natural language footage search, directional counting and Support-configured region rules; the platform keeps evolving with additional analytics through the year. Lighter AI today: Videoloft, Camcloud, Milestone Arcules (BriefCam integration still maturing), HikCentral, Bosch BVMS, Senstar Symphony, VIVOTEK VAST / VORTEX.

If the customer mostly searches old footage (loss prevention, working out what happened in an incident), AI is a must-have in 2026. If the workflow is live monitoring and alerts, AI is a nice-to-have.

Who sells it decides who owns the customer relationship. Sold only through the channel (installers and distributors): TetherX, Videoloft, Camcloud. Mostly through installers, some direct: Genetec (certified installers only), Milestone, Eagle Eye / Brivo, Hanwha, Axis. Mostly direct: Verkada (installers report "they will sell around you"), Rhombus, Spot AI, Coram AI, Cloudastructure. Direct and on Amazon: Netvue and other consumer cloud cameras.

For a deal an installer is leading, vendors who sell through installers protect both the customer relationship and the installer's recurring revenue. Direct-only vendors can cut the installer out of the next renewal.

A true PSaaS (Physical-Security-as-a-Service - cameras, software and 24/7 monitoring bundled in one subscription; YourSix, Cloudastructure, Eagle Eye / Brivo monitoring bundle, Verkada Command monitoring) includes the monitoring centre inside the subscription. If the installer already runs their own UL-listed monitoring centre, or has a relationship with an ARC (Alarm Receiving Centre - the 24/7 monitoring station; e.g. Immix, Sentinel, CONXTD, MASterMind, Bold Manitou, Stages, CHeKT and others), bundled monitoring competes with their recurring revenue.

TetherX leaves the monitoring layer to the installer - cameras, alarms and access are in the platform, monitoring is the installer's service to sell on top. Cleaner for installer-led deals.

One cloud console covering unlimited sites is the baseline promise of cloud CCTV. The details matter though: how long each site takes to set up, single sign-on across all sites, user and role hierarchy that fits an installer who manages other installers, search across sites, and export across sites with chain-of-custody.

On-prem VMS multi-site is genuinely painful - one firewall per site, one VPN tunnel per site, one port-forward setup per site, one firmware-upgrade visit per site. Cloud CCTV is built to avoid all of that.

Stress-test the demo with a 20-site estate in mind. Does the admin console still feel usable, or has it become a wall of buttons? Verkada and Rhombus admin consoles get cluttered fast above 50 sites.

"Hybrid" alone tells you nothing. Vendors use the word for very different designs, so ask each one where four things actually run: the recordings, the metadata, the analytics and the management. Then ask what still works on site when the internet drops, and what catches up when it returns.

The answers vary even among cloud platforms. Verkada says live-viewing links stop while its cameras are offline, and Rhombus says cameras that lose power and internet together stay non-recording until the internet returns. An on-site box, such as the TetherBox, the Eagle Eye Bridge or the Arcules Gateway, also meets the "no inbound ports" rule corporate IT teams typically require.

Where TetherX runs each part: the TetherBox records on site, with optional cloud recording set per camera. Included TetherBox AI runs on the edge, and supported camera and third-party analytics feed the same timeline; natural language footage search interprets requests in the cloud. You manage every site from TetherX Cloud. When the internet drops, recording carries on and catches up with the cloud when the link returns, even after weeks offline. On the site network, the TetherBox offline interface shows live view and the recordings stored on the box, and footage already in TetherX Cloud stays available remotely. Live streams and footage held only on site wait for the connection.

Do not take any vendor's answer on trust: pull the network cable during the evaluation (see the test below).

The on-prem VMS line buyers most often miss is the yearly maintenance plan - Milestone Care Plus, Genetec Advantage or Bosch SMA (Software Maintenance Agreement - the annual fee that keeps a perpetual licence receiving upgrades). At US reseller list prices in October 2026 it runs roughly 13-19% of the licence per year, so five years of Milestone Care Plus comes to 93% of the device licence again. Plus Windows Server hardware refresh, Microsoft SQL Server licences, separately-licensed analytics modules, leftover licences when a site shrinks, and engineer visits for every version upgrade.

The cloud-CCTV line buyers most often miss is storage tier escalation. Sites that keep video for a long time can cost 3-5x the headline per-camera price - especially Eagle Eye / Brivo's 911-ready storage tiers and Verkada's long-retention licences.

Build the 5-year cost with: (a) equipment (cameras + on-site box + storage), (b) subscription / licence years 1-5, (c) maintenance years 1-5, (d) bandwidth (cloud uploads count against the site's internet plan), (e) installer time (initial setup + reconfigurations + version-upgrade visits), (f) end-of-life or refresh assumptions for the hardware.

Then ask each vendor what the price becomes when you add a building, keep footage longer or enable a feature. A low first quote can describe a configuration you outgrow in a year. TetherX is an annual platform subscription by channel count, from £100/site/year, with multi-site management, alarms, access and TetherBox AI included; additional modules and retention can cost extra, and cloud recording is optional.

For single sites and multi-site estates that need remote access, cloud CCTV usually beats on-prem VMS. On-prem (Genetec Security Center, Bosch BVMS, Milestone XProtect Corporate) still fits a fully air-gapped or offline installation. See VMS vs VSaaS for the worked example.