C
Cyrano Security
14 min read
For LPs, syndicators, and private multifamily buyers

The pro forma has a line for vacancy. It has a line for bad debt. It has no line for operational security. That is the thing this page fixes.

Every guide to investing in multifamily real estate teaches you cap rate, IRR, cash-on-cash, market selection, and financing structure. MRI Software, AssetBar, DOOR, Viking Capital, CRE Daily, BAM Capital, Crexi. Search the top results and not one of them introduces operational security as a measurable input in the underwriting model. Not because it does not matter, but because until a single edge device could pull a standardized event log off any DVR brand in the closet, there was nothing to measure.

This guide is for the LP, the syndicator, and the private buyer who want to price operational security the same way they price vacancy. The input is a 9 field event payload produced by a $450 HDMI tap on the recorder already on site. The output is one ratio, comparable across every asset in the portfolio: indexed incidents per 1000 resident-days.

See the underwriting variable in a live demo
4.9from 50+ properties
$450 HDMI tap, stays with the asset through close
9 field event payload, identical across 15+ DVR brands
Median 7 second capture-to-index latency on deployed units
One ratio the investor can drop into the pro forma next to vacancy

Why the top search results for this keyword miss the same thing

Search “investing in multifamily real estate” and the first page of results is a predictable set of investor-education publishers. MRI Software writes a blog post about benefits. AssetBar writes a blueprint. DOOR and Crexi both publish best-cities rankings. Viking Capital writes about the 2026 market cycle. BAM Capital writes about syndication. Rod Khleif writes about financing. Every one of them competes on the same eight topics: cap rate, cash-on-cash, IRR, financing (agency vs bridge vs DSCR), market selection, syndication vs direct, Class A vs Class B vs Class C, and hold-period strategy.

Not one of them introduces an operational-security variable into the pro forma. Not a single top 10 result. The gap is not editorial laziness, it is an empirical one. A pro forma variable needs a comparable number, produced cheaply, across a heterogeneous set of assets. Until recently, the only way to get operational-security data out of a multifamily property was to ask the on-site manager for the DVR password, hope it still worked, and watch a motion-scan timeline in a brand-specific UI. That is not an underwriting input. That is a forensics task.

The rest of this page is how that gap closes. What the edge device produces, what the 9 fields actually look like on disk, how the ratio rolls up across a mixed-brand portfolio, and what the resulting underwriting model looks like with the new line item in it.

The portfolio-roll-up problem, and the one-cable fix

A 30 building multifamily portfolio has, in our experience, about 6 different DVR brands across the properties. Each brand has its own admin UI, its own export format, and its own quirks about what the on-screen overlay looks like. Investors who try to roll up operational data by asking for a native export from each recorder end up with 6 reconciliation projects and 0 comparable numbers. The edge tap cuts the problem in half by writing one schema per event, regardless of what is on the other end of the HDMI cable.

Heterogeneous recorders. One schema. One dashboard.

Hikvision DS-7716
Dahua XVR
Lorex 4K
Reolink NVR
Uniview
Panasonic WJ-NX
Cyrano edge
Underwriting model
LP quarterly update
Agency loan file
GL carrier renewal

What a single indexed event looks like on disk

The 9 field payload is the unit of comparison. Every event on every property in the portfolio is written in this shape. A tailgate event at the Pool Gate on a 312 unit Texas Class B property looks the same as a tailgate event at the mailroom on a 64 unit Ohio Class C property, because the detector has already normalized out the recorder brand via the overlay mask. This is what lets the number roll up.

event_row.json

The underwriting model, before and after the new line item

Same property. Same T-12. Same rent roll. The only difference is whether the pro forma carries an operational-security block populated from 30 days of indexed event data. The left is how every template in every REIT, syndication, and private buyer spreadsheet ships today. The right is the same template with one new sub-object that the investor can benchmark against.

Standard template
{
  "pro_forma": {
    "rent_growth_pct": 3.0,
    "vacancy_pct": 5.5,
    "bad_debt_pct": 1.5,
    "op_ex_per_unit": 4800,
    "cap_rate_entry_pct": 5.6,
    "cap_rate_exit_pct": 6.0,
    "hold_years": 5,
    "target_irr_pct": 16.0,
    "operational_security": null
  }
}
With operational security block
{
  "pro_forma": {
    "rent_growth_pct": 3.0,
    "vacancy_pct": 5.5,
    "bad_debt_pct": 1.5,
    "op_ex_per_unit": 4800,
    "cap_rate_entry_pct": 5.6,
    "cap_rate_exit_pct": 6.0,
    "hold_years": 5,
    "target_irr_pct": 16.0,
    "operational_security": {
      "source": "on_device_hdmi_tap",
      "measurement_window_days": 30,
      "indexed_events_per_1000_resident_days": 3.1,
      "events_by_class": {
        "vehicle_dwell": 812,
        "loiter": 1493,
        "tamper": 41,
        "person_in_zone": 2204,
        "tailgate": 187,
        "package_pickup": 2260
      },
      "dvr_brand_observed": "Hikvision DS-7716NI-K4",
      "portfolio_comparable": true
    }
  }
}
Anchor fact

The 9 field payload is identical across every recorder brand Cyrano ships an overlay mask for

Every Cyrano unit writes the same nine fields per event. The detector ships overlay mask templates for Hikvision DS-7xxx, Dahua XVR and NVR, Lorex, Amcrest, Reolink NVR, Uniview, Swann, Night Owl, Q-See, ANNKE, EZVIZ, Bosch DIVAR, Honeywell Performance, and Panasonic WJ-NX. The overlay mask is what blanks the clock, the camera-name strip, and the channel bug so those pixels do not pollute the event log. After the mask runs, the output schema is the same across every property. That is the mechanism that turns a heterogeneous portfolio into a single underwriting dashboard.

That is also why the operational-security ratio is portfolio-rollable. If the schema were brand specific, the investor would be running a reconciliation project every quarter. Because it is uniform at the edge, the quarterly roll-up is a SQL query across tables with matching columns, not a data-engineering effort.

Overlay mask templates shipped with every unit
Hikvision DS-7716
Dahua XVR
Lorex
Amcrest
Reolink NVR
Uniview
Swann
Night Owl
Q-See
ANNKE
EZVIZ
Bosch DIVAR
Honeywell Performance
Panasonic WJ-NX
Hikvision DS-7608
Hikvision DS-7608
Panasonic WJ-NX
Honeywell Performance
Bosch DIVAR
EZVIZ
ANNKE
Q-See
Night Owl
Swann
Uniview
Reolink NVR
Amcrest
Lorex
Dahua XVR
Hikvision DS-7716

The 4 investor workflows the new line item unlocks

Once the ratio exists, the investor can do things that were not previously possible. None of these are exotic. They are the operational-security analogs of the things every multifamily investor already does with rent and with vacancy.

Benchmark during due diligence

Plug the unit into the HDMI output of the seller's DVR on the DD site visit. 30 days later, the investor has a measured incident rate to compare against their other holdings in the same market. The LOI reflects a number, not a speculation.

Model concessions by tile

Rank incident-density by tile.label. A single breezeway or pool gate carrying 40 percent of the property's incidents is now visible in the model, not just in the resident complaint log.

Compare across a portfolio

SQL query against 22 tables with the same columns. No brand-specific reconciliation. The ratio is directly comparable.

Defend the exit cap rate

Attach 36 months of indexed event history to the OM at disposition. The buyer evaluates your measured incident rate, not their worst-case assumption.

Quarterly LP report line

One ratio. Goes on the same slide as economic occupancy. LPs see operational discipline, not adjectives.

Carrier renewal leverage

GL renewal conversations with measured incident frequency beat renewal conversations without it. Loss history + indexed data out-performs loss history alone.

The DD walk, in 5 steps and under 2 minutes per closet

The point of interaction with the physical asset is smaller than most investors expect. The person on the DD site visit who handles the HDMI cable does not have to be an IT technician. The property manager keeps the DVR password, the recorder keeps running, and the edge device writes events from the moment it powers on.

What happens between the DD site visit and the LOI

1

Locate the DVR in the office closet

Every property we have seen has the recorder in one of three places: office closet, leasing office under the desk, maintenance shed. Less than 5 minutes to find.

2

Identify the HDMI cable to the wall monitor

The DVR is already driving a multiview to a monitor. The cable is standard HDMI. The edge device inserts inline between DVR and monitor.

3

Power the Cyrano unit and confirm tiles

Power over a wall outlet. Confirm the unit is reading the expected number of tiles, usually 16 or 25 for multifamily. Done in under 2 minutes.

4

Accrue events for 30 days across DD

Events are written continuously, 24/7, as the recorder renders the multiview. Average 7,000 indexed events on a 16 camera property in 30 days.

5

Export the pro forma block

Dashboard produces a JSON object, a CSV, a PDF, and a thumbnail gallery. JSON drops into the pro forma. CSV drops into the data room. PDF drops into the IC memo.

A terminal view: asking the dashboard for one property, then the portfolio

The data is not locked inside a proprietary UI. The investor or their analyst can query across properties in the same way they would query any warehouse. One property, one ratio. A portfolio, one ratio per row. This is the output of a real session against the production dashboard, redacted for confidentiality.

cyrano dashboard query

The investor pro forma, one block richer

Nothing about the financial model changes. Rent growth, vacancy, bad debt, op ex, cap rate assumptions, IRR target: all untouched. One new sub-object carries the measured operational-security data, shaped so that it can be compared against the other assets in the portfolio.

pro_forma_with_security_block.json

What changes, and what does not, in how the investor underwrites

A new underwriting variable is only useful if it changes behavior. The list below is concrete, drawn from investors who have run this in DD on properties between 40 and 400 units. The top items change. The bottom items, deliberately, do not.

What the operational-security block changes

  • Incident risk in the pro forma is measured, not assumed
  • Tile-level density informs concession and improvement budget
  • Portfolio comparison is a SQL query, not a reconciliation
  • LP quarterly update has one new verifiable KPI
  • Exit OM carries 36 months of indexed data, not a sentence
  • Underwriting software stack (Excel, Argus) stays the same
  • Cap rate methodology stays the same
  • Financing structure (agency, bridge, DSCR) stays the same
  • Market-selection process stays the same

Edge tap vs cloud VMS replacement, for multifamily investors

The other category of vendor in this space sells a cloud VMS that replaces both the recorder and the cameras. That is a different product for a different customer. This table is what the two approaches actually look like from the perspective of an investor underwriting a stabilized Class B asset.

FeatureCloud VMS replacementHDMI edge tap (Cyrano)
Capex to deploy on an existing property$30,000 to $80,000 + network upgrade$450 hardware, per property, one time
Install time during DD site visitMulti-day, requires a rewireUnder 2 minutes per closet
DVR admin credentials requiredFull replacement, new adminNone. HDMI output is read-only
Cross-brand data schemaOne brand, one format9 field payload across 15+ recorder brands
Fit for 90% of the Class B / C universeOnly strong for new constructionStrong for any property with an HDMI DVR
Transfers with the property at closeSeller keeps the SaaS accountUnit stays. Subscription transfers.

Representative numbers from a 30 day DD tap

From a 312 unit Class B multifamily asset in Texas, tap installed during DD on a Hikvision DS-7716NI-K4, 16 active tiles. Data taken from the dashboard session logs, not from a seller memorandum. This is what the investor had in hand two weeks before signing the LOI.

0Indexed events in 30 days
0Events per 1000 resident-days
0 secMedian capture-to-index latency
0Active tiles read from HDMI
The one ratio
0
Indexed incidents per 1000 resident-days on a 312 unit Class B Texas asset, 30 day window, measured during DD on the seller’s own recorder. The operational-security analog of economic occupancy. Directly comparable against every other asset in the investor’s portfolio because every tap writes the same 9 field schema.
20

At one Class C multifamily property in Fort Worth, Cyrano caught 20 incidents including a break-in attempt in the first month. Customer renewed after 30 days.

Fort Worth, TX property deployment

Our underwriting template hadn't changed in ten years. We added one JSON block for the operational security ratio last quarter. It's the first new line item in the pro forma since we started tracking per-unit op ex.
M
Multifamily syndication GP
22 properties across 4 Sun Belt states, $500M AUM

Put the new underwriting variable on your next DD checklist

15 minute walkthrough. We plug into the HDMI of a live multifamily recorder and show you the 9 field schema and the one ratio it rolls up to.

Book a call

Frequently asked questions

Why is there no operational-security variable in a standard multifamily underwriting model?

Because nobody could produce the number at a fair cost, in a comparable shape, across a heterogeneous portfolio. The T-12 covers rent and expenses. The rent roll covers occupancy. The PCA covers physical condition. The market report covers comps. Operational security has historically lived inside a DVR that only the on-site property manager can unlock, in a brand-specific UI that only exports motion-scan results by channel number. That is not a pro forma input. The first time the number becomes modellable is when the same edge device can plug into any DVR in the portfolio and write the same 9 field event payload to one dashboard.

What exactly is the new underwriting variable this page is introducing?

Indexed incidents per 1000 resident-days, derived from a 9 field event payload (tile.label, tile.index, tile.coords, property, layout_id, overlay_mask, event_class, iso8601_ts, latency_ms). Resident-days is unit count times occupancy times days observed. Indexed events are the rows the edge device writes after overlay masks strip the clock, camera-name strip, and channel bug from each tile. The ratio is the operational-security analog of economic occupancy. It fits cleanly alongside the financial metrics in any standard pro forma template.

Does the investor need to wait until after close to get this number?

No. The edge device can be plugged into the HDMI output of the seller's existing DVR during the due diligence window, inline on the cable already running to the wall monitor in the office closet. The DVR keeps running, the seller keeps recording, and no admin credentials change hands. A 30 day tap during DD produces roughly 7,000 indexed events on a 16 camera property, enough to chart incident density by tile.label, hour-of-day, and event_class before the investor signs the LOI.

Is this a replacement for a PCA or a third party security audit?

No, it sits next to them. A PCA measures the physical asset on one day. A security audit is a consultant walkthrough and report on one day. The 9 field indexed log is a time series of 20,000 to 30,000 event rows across 30 to 90 days. The three artifacts answer different questions: the PCA tells the investor what the asset is made of, the audit tells them what a consultant saw, the indexed log tells them what the property actually does. Investors underwriting seriously use all three.

My syndication has 22 assets across 4 states on 6 different DVR brands. How does the number roll up?

The 9 field payload is written identically whether the recorder is a Hikvision DS-7716NI-K4, a Dahua XVR, a Lorex, an Amcrest, a Reolink NVR, a Uniview, a Swann, a Night Owl, a Q-See, an ANNKE, an EZVIZ, a Bosch DIVAR, a Honeywell Performance, or a Panasonic WJ-NX. Each brand has its own overlay mask template that the detector uses to strip the clock and channel bug. The output is the same schema. So the portfolio roll-up is a simple SQL query across 22 tables with the same columns, not a reconciliation project across 6 export formats.

What is the actual cost per property and how does that scale in a 30 building portfolio?

Hardware is $450 per unit, one time, and the unit stays with the asset. Software is $200 per property per month, and it transfers with the property at close. A single unit covers up to 25 tiles on the DVR multiview, which is enough for most Class B and Class C multifamily properties on one edge device. A 30 building portfolio is $13,500 in hardware and $6,000 per month in software. At $72,000 a year for 30 buildings the investor is producing continuous indexed operational-security data for roughly 1.2 basis points on a portfolio with $500M of assets under management.

What class of investor benefits most from this, and which is the weakest fit?

Strongest fit: active syndicators and private buyers in the 5 to 200 unit Class B and Class C range who are using existing legacy recorders and who want operational data in their own underwriting model. Also strong for LP commitments where the GP wants to prove operational discipline to passive capital. Weakest fit: institutional Class A new construction where the VMS is already cloud-native with an open API. For those deployments the data exists upstream of the DVR and this particular tap is unnecessary. The majority of the multifamily universe is not Class A new construction.

How long does it take to plug in the edge device during a DD site visit?

Under 2 minutes per property. The unit sits inline on the HDMI cable that already runs from the DVR to the wall monitor in the office closet. The investor's inspector or property manager plugs the Cyrano unit between the DVR and the monitor, powers it, and indexing starts. No DVR admin credentials, no network reconfiguration, no cooperation from the incumbent property manager. The cable goes back to the recorder when the investor is done, or stays in place through closing if the LOI is signed.

What does the investor actually see day-30 after the tap is in place?

A CSV with one row per indexed event, 480x270 JPEG thumbnails for every event, a PDF summary, and a dashboard with four charts: events per 1000 resident-days, events-by-tile ranked, events-by-hour distribution, and events-by-class distribution (vehicle_dwell, loiter, tamper, person_in_zone, tailgate, package_pickup). Median capture-to-index latency on deployed units is 7 seconds. The investor has, for the first time, a dataset on operational security that is comparable to the datasets they already have on rent and on vacancy.

Is this edge-tap approach tenable inside a Fannie or Freddie loan package?

Agency lenders underwrite on T-12, rent roll, PCA, appraisal, and environmental. They do not require operational-security data. What they do value, and what they will note in the loan file, is evidence that the borrower is running a measurable operational program. A 90 day indexed incident log attached to the asset narrative has shown up in loan files as supporting material, not as a required deliverable. It does not replace any standard underwriting document. It sits alongside them.

Does the data survive a DVR replacement by a future property manager or new owner?

Yes. The edge device reads the HDMI output of whatever recorder is producing the multiview. If the DVR is swapped for a different brand during the hold, the unit picks up the new tiles under their labels and the event payload continues in the same schema. If a new owner replaces the recorder at close, the same is true. The only operational requirement is that the new DVR continue to drive a multiview to a monitor in the office closet, which is how 100 percent of the properties we have seen are wired.

How is this different from cloud VMS platforms marketed to multifamily?

Cloud VMS platforms want to replace the DVR and the cameras. That is a $30,000 to $80,000 capex decision per property plus network upgrades plus a new recurring SaaS subscription. The pitch is valid for new construction. For 90 percent of the multifamily universe where the recorder is already on-site and the cameras are already wired, the investor does not want a capex project during due diligence. They want a read-only $450 device that sits inline on a cable and writes comparable data across the portfolio. Different problem, different solution.

🛡️CyranoEdge AI Security for Apartments
© 2026 Cyrano. All rights reserved.

How did this page land for you?

React to reveal totals

Comments ()

Leave a comment to see what others are saying.

Public and anonymous. No signup.