To invest in multifamily real estate is to run a portfolio on five rollup KPIs. Security has quietly been the missing sixth.

Because each property's DVR is a different brand, with a different export format, a different channel numbering convention, and a different timestamp layout. Property 1 is Hikvision, Property 2 is Dahua, Property 3 is LTS, Property 4 is Amcrest. Each box exports motion-scan CSVs in its own shape, each one is tied to a channel number that shifts when cameras get re-cabled, and none of them agree on what a 'loiter event' is. Your property management software can show you occupancy, rent, and work orders across all four properties because those data points were standardized a decade ago. Security was never standardized at the device layer, so it never rolled up, so your investor dashboard never had a tile for it.

Every DVR, regardless of brand, paints the human-readable camera name onto each tile of its HDMI multiview output as a small text strip. That is a visual convention shared by Hikvision, Dahua, LTS, Swann, Amcrest, Lorex, Night Owl, Q-See, Zmodo, and every other Class B and Class C recorder. Cyrano OCRs that strip once per layout at install time and stores the result as tile.label on the event record. tile.label is the stable key that lets the property manager say Mailroom Interior instead of Channel 4, and it is the stable key that lets an LP or a syndicator aggregate Mailroom Interior events across 12 properties even though the underlying channel numbers are different on every DVR.

tile.label, tile.index, tile.coords, property, layout_id, overlay_mask, event_class, iso8601_ts, latency_ms. tile.label is the OCR'd painted name. tile.index is the position in the multiview grid. tile.coords is the pixel bounding box of that tile on the HDMI frame. property is the portfolio key. layout_id identifies which multiview grid was being rendered at capture time, so tile positions are disambiguated when the property manager toggles between a 9-tile and a 16-tile view. overlay_mask is the set of rectangles masked out before classification (the clock, the camera-name strip, the channel bug). event_class is one of five labels: person_in_zone, loiter, vehicle_dwell, tamper, package_tamper. iso8601_ts is the classifier trigger time in a real offset. latency_ms is the capture-to-reviewable latency for that event, typically 5000 to 15000.

Because before HDMI-level capture, the only way to normalize across DVR brands was to integrate with each brand's ONVIF or proprietary API, which requires a physical network seat on the property LAN, the DVR's admin password, firmware updates to enable the API, and brand-specific code for each vendor. That is a months-long IT project per property, and most Class B and Class C properties run firmware from 2017 that never had those APIs enabled in the first place. HDMI is the one output every DVR brand has had for 15 years, with no password, no firmware dependency, and no network exposure. The HDMI frame is the portable layer. Everything upstream of the HDMI frame stays brand-proprietary, and the investor does not have to care.

Resident-days is units times occupancy times days in the measurement window. Indexed incidents is the count of normalized event_class rows in that window for that property. The ratio is dimensionless, directly comparable across properties of different size, and rolls up cleanly to a portfolio number. It is the operational-security analog of economic occupancy. On the same dashboard where you read a portfolio-weighted occupancy of 94.2 percent, you can now read a portfolio-weighted incident rate of 0.8 indexed incidents per 1000 resident-days, with the property-level breakout one click away. Nothing about that is possible until the event schema is the same across every DVR brand.

No. The event table is an additional column on whatever asset-management view you already run. The normalized row has a property key, so a sponsor who runs AppFolio or Yardi joins the incident count to the unit count by property and gets the ratio. A syndicator who runs a bespoke Excel waterfall pastes the same ratio into a new column next to occupancy and rent growth. The point is not to replace the financial KPIs. The point is to add the one operational KPI that was always the missing dimension in the multifamily investment thesis because no one could measure it across the portfolio.

Per property, the physical install is under 30 minutes. One Cyrano device plugs into the DVR's spare HDMI port via a splitter. No network changes on the property LAN, no DVR credentials, no contractor. From the portfolio side, the rollout is a schedule across properties rather than a single big-bang integration. After the first property is live, every additional property adds a row to the same event table without reshaping anything. You get portfolio coverage as you install, not at the end of a multi-quarter IT project. Typical 10 property portfolio is fully on the same dashboard within three to four weeks, constrained by travel time to the properties, not by the install itself.

The classifier runs on the edge device at the property. The HDMI frame is processed locally into the 9 field event row. Only the event row and the thumbnail leave the property, which are a small fraction of the raw video volume. The full continuous recording stays on the DVR, where it always was, under the same tenant privacy posture the property already runs. From an LP's perspective, the data that rolls up to the portfolio view is already aggregated and stripped to a timestamp, a tile name, and an event class, not raw identifiable video. From the property manager's perspective, the full recording is still on-premise for forensic lookup when one is needed.

Three things. First, at acquisition, you price security posture instead of guessing at it, by running a 30 day observation window on the existing DVR before closing and comparing the indexed incident rate to the portfolio baseline. Second, in the business plan, the pro forma gets a line item for expected incident rate improvement from the value-add capex, bounded by measured before-and-after numbers, not hope. Third, at disposition, you show the buyer a 24 month trendline of the indexed incident rate alongside the NOI trendline, which is a form of operational provenance that lets you negotiate on cap rate the way a well-kept T-12 does.

The new DVR paints a different tile-name strip, at a different pixel offset, in a different font. Cyrano re-OCRs the new layout on first frame and re-keys the tile.label. The event table is unchanged because tile.label is the key, not the DVR-specific channel number. To the portfolio dashboard, a DVR swap is invisible; to the property manager, the filter chips on the review screen still say Mailroom Interior and Loading Dock NE. That continuity across hardware changes is why tile.label is the right key for an investor who holds properties for five to seven years and will see two generations of recorder hardware in that window.