CCTV Vendor Lock-In: How ONVIF and RTSP Give You a Fallback Plan

1. Why vendor lock-in happens in CCTV systems

Vendor lock-in in security cameras is not usually the result of a deliberate trap. It happens gradually, through a combination of proprietary protocols, bundled software, and cloud-dependent features that make it progressively harder to switch.

The first mechanism is proprietary communication protocols. Some camera manufacturers use their own discovery and streaming protocols instead of (or in addition to) industry standards. Their cameras work seamlessly with their own NVR or VMS software, but connecting those cameras to a third-party recorder can range from difficult to impossible. You discover this when you try to add a camera from Brand A to an NVR from Brand B, and the NVR simply cannot find the camera on the network.

The second mechanism is cloud-dependent analytics. Many modern camera systems bundle AI features like person detection, vehicle recognition, or package alerts through a cloud service tied to the hardware manufacturer. The cameras send video to the vendor's cloud, the cloud runs the analytics, and you get alerts through the vendor's app. If you stop paying the subscription or the vendor shuts down the service, those smart features disappear. Your cameras still record, but the intelligence layer is gone.

The third mechanism is proprietary storage formats. Some systems store footage in encrypted or proprietary formats that can only be played back through the vendor's software. If you need to export footage for law enforcement or insurance purposes, you are dependent on the vendor's export tools. If the vendor discontinues support for your hardware generation, accessing your own footage becomes a problem.

The cumulative effect is that replacing one component (a camera, an NVR, or the analytics layer) forces you to replace the entire system. This is the definition of lock-in: the cost of switching exceeds the cost of staying, even when staying is not the best option.

2. ONVIF and RTSP: your insurance policy

ONVIF (Open Network Video Interface Forum) and RTSP (Real Time Streaming Protocol) are the two standards that give you vendor independence. Understanding what each one does helps you make informed purchasing decisions and evaluate your existing hardware.

RTSP is a streaming protocol that allows any compatible client to request a video stream from any compatible camera. Think of it as a universal language for "send me your video feed." If a camera supports RTSP, you can connect it to virtually any NVR, VMS, or software platform that also supports RTSP. The stream URL typically follows a format like rtsp://camera-ip:554/stream1, though the exact path varies by manufacturer. RTSP support means your camera's video feed is not locked to one ecosystem.

ONVIFgoes further than RTSP. While RTSP handles video streaming, ONVIF is a comprehensive standard that covers device discovery (finding cameras on your network automatically), PTZ control (pan, tilt, zoom), event handling, and profile management. ONVIF has multiple profiles: Profile S covers streaming, Profile T adds H.265 and metadata streaming, and Profile G covers recording and storage. A camera that is "ONVIF conformant" can be discovered, configured, and controlled by any ONVIF-compatible NVR or VMS without needing the manufacturer's proprietary software.

Together, ONVIF and RTSP act as your insurance policy. Even if you are currently using a vendor's proprietary ecosystem (their cameras with their NVR and their analytics), having ONVIF and RTSP support on the cameras means you always have a path out. You can connect those cameras to a different NVR. You can point a third-party analytics platform at the RTSP streams. You can migrate incrementally instead of ripping and replacing everything at once.

One important caveat: not all "ONVIF compatible" claims are equal. Some manufacturers implement only a subset of the standard. Others implement it but disable it by default in their firmware, requiring you to enable it manually. Always verify that ONVIF is genuinely functional on your cameras, not just listed on a spec sheet.

3. How to evaluate whether your current system is vendor-locked

You can assess your current system's vendor independence with a few straightforward tests. This evaluation applies whether you manage a single-site residential setup or a portfolio of commercial properties.

Test 1: Can you access RTSP streams directly?Try connecting to one of your cameras using VLC Media Player or a tool like ONVIF Device Manager. If you can open a live stream using an RTSP URL, your cameras support open streaming. If you cannot find an RTSP URL in the camera's settings, or if every attempt to connect from a third-party tool fails, your cameras may be using a proprietary-only protocol.

Test 2: Can you discover cameras with ONVIF?Download the free ONVIF Device Manager tool and scan your network. If your cameras show up and you can view their capabilities, ONVIF is working. If they do not appear, check the camera's web interface to see if ONVIF needs to be enabled manually. If there is no ONVIF option at all, the camera does not support it.

Test 3: What happens if you disconnect from the internet?Unplug your router and check whether your cameras still record locally, whether you can still view live feeds on your LAN, and whether any analytics features continue to work. If everything stops working without internet, your system is cloud-dependent. This is a significant lock-in risk because the vendor controls your system's functionality through their servers.

Test 4: Can you export footage in a standard format?Try exporting a clip from your NVR and opening it in VLC or another standard media player. If the export only works in the vendor's proprietary player, your footage is locked in a proprietary format. Standard exports should produce MP4 or AVI files that any media player can open.

If your system fails two or more of these tests, you have meaningful vendor lock-in. That does not necessarily mean you need to replace everything today, but it should factor into your planning for upgrades and expansions.

4. Separating intelligence from camera hardware

One of the most effective strategies for avoiding lock-in is to keep your analytics layer independent from your camera hardware. In the security industry, this is sometimes described as separating the "brains" from the "eyes." Your cameras capture video (the eyes), and a separate system analyzes that video for threats and events (the brains). When these two layers are independent, you can upgrade either one without touching the other.

This separation can take several forms. At the software level, platforms like Milestone XProtect, Genetec Security Center, or open-source tools like Frigate NVR can connect to cameras from dozens of manufacturers via ONVIF and RTSP. The analytics run on a separate server or appliance. If you want to swap out cameras, the analytics platform keeps working. If you want to switch analytics providers, your cameras keep recording.

At the hardware level, edge AI devices offer another approach to this separation. These devices sit between your existing camera system and your monitoring workflow. They process the video feed locally and add intelligence without requiring you to change your cameras, your NVR, or your network architecture. Because they work with the video output your system already produces, they are inherently vendor-agnostic on the camera side.

Cyrano is one example of this approach. It connects to your existing DVR or NVR via HDMI, processes up to 25 camera feeds on the device, and sends alerts when it detects relevant activity. Because it works with the HDMI output that every DVR and NVR already provides, it does not matter what brand of cameras you use, what protocols they speak, or whether they support ONVIF. The intelligence layer is completely decoupled from the camera hardware.

The key principle is that your cameras should be replaceable commodities, and your analytics platform should not care which cameras are feeding it. When you achieve this separation, vendor lock-in becomes a much smaller concern because no single vendor controls your entire stack.

5. Future-proofing your security infrastructure

Future-proofing does not mean buying the most expensive equipment or chasing the latest technology. It means making decisions today that preserve your options tomorrow. Here are concrete steps you can take regardless of your current setup.

Buy cameras with confirmed ONVIF and RTSP support.Before purchasing any camera, verify that it supports ONVIF Profile S (at minimum) and provides accessible RTSP stream URLs. Check user forums and reviews, not just the manufacturer's spec sheet. Brands like Hikvision, Dahua, Axis, Hanwha, and Reolink generally provide strong ONVIF and RTSP support, though firmware versions can vary.

Use standard cabling infrastructure. Run Cat6 or Cat6a Ethernet cable to every camera location, even if your current cameras use coax. PoE (Power over Ethernet) cameras are the industry standard for new installations, and Ethernet cabling supports any IP camera from any manufacturer. If you are stuck with existing coax runs, PoC (Power over Coax) adapters and EoC (Ethernet over Coax) converters can bridge the gap without rewiring.

Keep your NVR/VMS platform-agnostic. If possible, use an NVR or VMS that supports cameras from multiple manufacturers. Proprietary NVRs that only work with the same brand of cameras create a single point of lock-in. Open-platform NVRs (whether commercial like Milestone or open-source like Frigate) give you the freedom to mix and match cameras based on performance and price rather than brand compatibility.

Treat analytics as a separate, swappable layer. Whether you use cloud analytics, on-premise software, or an edge AI device, choose solutions that work with standard video feeds rather than requiring specific camera hardware. This way, when better analytics tools emerge (and they will, given how fast computer vision is improving), you can adopt them without replacing your physical infrastructure.

Document your system architecture.Maintain a record of every camera's IP address, RTSP URL, ONVIF credentials, firmware version, and physical location. This documentation is invaluable when you need to migrate to a new platform, troubleshoot connectivity issues, or hand off system management to a new team member. Without it, even a well-designed open system becomes practically locked in because nobody knows how to access the components independently.

The common thread across all of these steps is maintaining independence at each layer of your security stack. When your cameras, your recording system, and your analytics platform can each be replaced independently, you are never more than one step away from a better option. That flexibility is worth more than any single feature from any single vendor.