Ten questions before you sign a cloud VMS contract.

The single most important question. A closed VSaaS (Video Surveillance as a Service - cloud CCTV; Verkada, Rhombus and Cisco Meraki MV are the well-known US examples) only works with that vendor's own cameras, and those cameras stop working if you cancel the subscription. The trade publication IPVM calls this pattern "Hostage as a Service".

An open VSaaS (TetherX, Eagle Eye / Brivo, Videoloft, Camcloud, Milestone Arcules) works with any camera that supports ONVIF (the camera interoperability standard) plus 200-700+ named manufacturers. Existing cameras stay. The installer keeps the choice of brand.

Score: open = +2, hybrid (open but with a preferred brand) = +1, closed = 0.

NDAA Section 889 is a US trade rule that stops federal-adjacent buyers using cameras or recorders from Hikvision, Dahua, Huawei, Hytera and ZTE - plus any equipment built around Huawei HiSilicon chips. Maintenance contracts count. Foreign offices count. Canada made its federal ban official in 2025; the UK restricts these on government and Ministry of Defence sites; Australia ordered them removed from federal sites in 2023; the Netherlands, Taiwan and the EU's NIS2 directive all add similar restrictions.

For the VSaaS platform, ask: is the vendor on the SIA (Security Industry Association) NDAA-compliant list? For the cameras, ask which NDAA-compliant brands the platform supports - Hanwha Vision (South Korean), Axis (Swedish, Canon-owned), Avigilon (Canadian, Motorola), Pelco (American, Motorola), Bosch (German), i-PRO (Japanese), VIVOTEK (Taiwanese), Mobotix (German).

TetherX handles the migration by ringfencing - existing Hikvision or Dahua cameras stay behind a TetherBox so they never touch the public Internet, then you replace them in phases over 12-36 months. Full detail: NDAA compliance and ringfencing.

According to IPVM's 2026 pricing-transparency analysis, only Videoloft and Rhombus publish full per-camera, per-retention price sheets. Eagle Eye / Brivo publishes tier ranges but specifics need a quote. Verkada publishes ranges only. Milestone Arcules, Spot AI, Cloudastructure, YourSix and TetherX are all quote-only through installers.

Quote-only isn't automatically bad - vendors that sell only through installers price each deal in context, and a qualified installer trained on the platform brings advantages a direct-from-vendor sale cannot. The vendor only knows the software; the installer knows the site, the cameras already in place, the network constraints, the cabling, the access-control hardware and the alarm panels (most of which the vendor does not supply), and is the single point of contact when something needs adjusting after go-live. The trade-off is comparing pricing across vendors is harder. Ask for: the per-camera per-month cost at your target retention and resolution; the total 5-year cost including hardware, licences, subscription and any maintenance fees; what gets billed extra (LPR licence-plate recognition, AI, longer storage retention, optional integration modules).

Verkada has five (Command, Pass, Events, Mailroom, Air). Eagle Eye / Brivo three (Viewer, Smartphone Camera, CameraManager). Rhombus two. Milestone post-Arcules up to four. Netvue three.

And it compounds three ways. Per scope: Eagle Eye Viewer covers the cloud-recorded cameras only - any local-recorded camera at the same site lives on the on-site NVR app from whichever brand supplied it. Per product line within one vendor: video, access, intrusion, visitor and broadcast each get their own app (the five Verkada apps above). Per vendor across an estate: real customers rarely run one brand everywhere, so each adds another dashboard, login and notification stream.

End-user impact: wrong app installed, feature not found, patience gone. IPVM forum on home-use alerts: "Almost every residential customer concerned with mobile apps and notifications gravitates toward consumer companies like Vivint, Arlo, and Nest" - business CCTV lost the home and small-business market on the one feature buyers care about most. The bar is one app covering local + cloud recording, alarms, access, multi-site, with notifications that work as well as the consumer ones - the bar TetherX is built to.

The 2025-26 cloud-CCTV feature race is multi-site AI search across recorded footage by analytics tag (person / vehicle / animal / audio class) and, on some platforms, by free-text prompt. Mature AI search in production: Verkada, Rhombus (ChatGPT-powered, added 2025), Spot AI, Eagle Eye / Brivo, Coram AI, Hakimo, March Networks (Canadian; their AI Smart Search uses sampled snapshots, absorbing the VIVOTEK-branded business in April 2026), Genetec (added September 2025), Lumana, Conntour, VisionPlatform.ai. TetherX delivers person, vehicle and animal detection plus 63-class audio analytics, searchable across multi-site footage in seconds; the platform keeps evolving with additional analytics through the year. Lighter AI today: Videoloft, Camcloud, Milestone Arcules (BriefCam integration still maturing), HikCentral, Bosch BVMS, Senstar Symphony, VIVOTEK VAST / VORTEX.

If the customer mostly searches old footage (loss prevention, working out what happened in an incident), AI is a must-have in 2026. If the workflow is live monitoring and alerts, AI is a nice-to-have.

Who sells it decides who owns the customer relationship. Sold only through installers: TetherX, Videoloft, Camcloud. Mostly through installers, some direct: Genetec (certified installers only), Milestone, Eagle Eye / Brivo, Hanwha, Axis. Mostly direct: Verkada (installers report "they will sell around you"), Rhombus, Spot AI, Coram AI, Cloudastructure. Direct and on Amazon: Netvue and other consumer cloud cameras.

For a deal an installer is leading, vendors who sell through installers protect both the customer relationship and the installer's recurring revenue. Direct-only vendors can cut the installer out of the next renewal.

A true PSaaS (Physical-Security-as-a-Service - cameras, software and 24/7 monitoring bundled in one subscription; YourSix, Cloudastructure, Eagle Eye / Brivo monitoring bundle, Verkada Command monitoring) includes the monitoring centre inside the subscription. If the installer already runs their own UL-listed monitoring centre, or has a relationship with an ARC (Alarm Receiving Centre - the 24/7 monitoring station; e.g. Immix, Sentinel, CONXTD, MASterMind, Bold Patriot Manitou, Stages and others), bundled monitoring competes with their recurring revenue.

TetherX leaves the monitoring layer to the installer - cameras, alarms and access are in the platform, monitoring is the installer's service to sell on top. Cleaner for installer-led deals.

One cloud console covering unlimited sites is the baseline promise of cloud CCTV. The details matter though: how long each site takes to set up, single sign-on across all sites, user and role hierarchy that fits an installer who manages other installers, search across sites, and export across sites with chain-of-custody.

On-prem VMS multi-site is genuinely painful - one firewall per site, one VPN tunnel per site, one port-forward setup per site, one firmware-upgrade visit per site. Cloud CCTV is built to avoid all of that.

Stress-test the demo with a 20-site estate in mind. Does the admin console still feel usable, or has it become a wall of buttons? Verkada and Rhombus admin consoles get cluttered fast above 50 sites.

Pure cloud CCTV (Verkada, Rhombus in direct mode) fails badly when the customer's Internet drops. Cameras with built-in SD cards keep recording locally and sync once the link returns, but live remote viewing is gone.

A hybrid architecture - an on-site appliance plus the cloud - keeps recording to the local box no matter what the Internet is doing, and uploads to the cloud whenever it can. TetherX uses the TetherBox as that on-site box; Eagle Eye uses the Eagle Eye Bridge; Milestone Arcules uses the Arcules Gateway. The same setup also satisfies the "no inbound ports" rule corporate IT teams typically require.

TetherX takes this further: the TetherBox ships with a basic offline interface for use when the cloud link is down - enough to access live cameras and recorded footage on-site without Internet. On-site live view is streamed through the local streaming feature (cameras to viewer over the LAN, no cloud round-trip). The system keeps recording for weeks or months of sustained outage and syncs everything back to the cloud once connectivity is restored. Most hybrid-VSaaS rivals lose all access to footage and live when the link drops.

For retail, hospitality and multi-site commercial estates - where some site somewhere has an Internet outage most weeks - hybrid wins. For a single, well-connected corporate office, pure cloud is fine.

The on-prem VMS line buyers most often miss is the annual maintenance fee - sometimes called Software Assurance, Care Plus, or SMA (Software Maintenance Agreement - the annual support fee that keeps a perpetual licence updated). It typically runs 18-25% of the licence per year, so over five years you pay the licence again (and then some). Plus Windows Server hardware refresh, Microsoft SQL Server licences, separately-licensed analytics modules, leftover licences when a site shrinks, and engineer visits for every version upgrade.

The cloud-CCTV line buyers most often miss is storage tier escalation. Sites that keep video for a long time can cost 3-5x the headline per-camera price - especially Eagle Eye / Brivo's 911-ready storage tiers and Verkada's long-retention licences.

Build the 5-year cost with: (a) equipment (cameras + on-site box + storage), (b) subscription / licence years 1-5, (c) maintenance years 1-5, (d) bandwidth (cloud uploads count against the site's Internet plan), (e) installer time (initial setup + reconfigurations + version-upgrade visits), (f) end-of-life or refresh assumptions for the hardware.

For sites of 1-500 cameras, cloud CCTV usually beats on-prem VMS. For a single site over 1,000 cameras, on-prem (Genetec Security Center, Bosch BVMS, Milestone XProtect Corporate) often still wins. See VMS vs VSaaS for the worked example.