Are Indian Businesses Ready to Put Security on the Cloud?
Ask a room of Indian facility heads whether they would put their CCTV footage on the cloud, and you will get three answers. A few are already there and would not go back. Most are curious but stuck on a specific objection. And a hard core will tell you it is out of the question. All three positions are defensible, which is precisely why this question is worth taking seriously rather than answering with a brochure.
Cloud video management and cloud access control have moved well past the early-adopter phase in India. What has not happened is a clean consensus about when they are the right choice. The honest answer is that it depends on the shape of the estate, and that a good integrator should be able to talk you out of cloud as readily as into it.
The objections, taken seriously
Most published material on cloud security treats buyer hesitancy as ignorance to be overcome. It usually is not. Here are the five objections we hear most often in India, and what we think each one is actually worth.
1. Where does the footage physically sit?
This is a legitimate question, not a reflex. For a BFSI client, a government contractor, or the Indian subsidiary of a company with its own group data policy, the physical location of recorded video is a procurement condition, not a preference. It deserves a specific answer naming the region, not a reassurance. Where a platform cannot host in-country, that is a real constraint and should be treated as one.
2. Upstream bandwidth at smaller sites
A well-connected office in Gurgaon or Bengaluru is not the problem. A branch in a tier-3 town on a modest broadband link, where the upstream is a fraction of the downstream, absolutely is. Anyone who tells you bandwidth is a solved problem across India has not commissioned enough sites outside the metros.
3. Capex habits
Plenty of Indian organisations are structured to approve a one-time purchase far more easily than a recurring subscription. That is an internal finance reality, and it genuinely disadvantages cloud on a like-for-like comparison, whatever the five-year total works out to. It is worth modelling the full period honestly rather than pretending the objection is irrational.
4. Who can actually see our footage?
A fair question, and one that on-premise systems tend to answer badly too. The difference is that a cloud platform can produce an access log showing exactly who viewed which stream and when. Most on-premise recorders in Indian offices are on a shared password taped inside the rack door. Cloud is not automatically more private, but it is usually more auditable.
5. IT does not want another dependency
Understandable. But the counterweight is that an unpatched recorder sitting on the corporate network is itself a dependency, and a worse-maintained one. This objection usually resolves into a conversation about network segmentation rather than about cloud.
Where cloud genuinely wins
- Estates spread over many sites. The advantage compounds with site count. At one site, cloud is a preference. At forty, central administration stops being a convenience and becomes the only workable model.
- Businesses whose sites open and close. Retail, quick commerce, warehousing. Provisioning a site in a day and recovering the hardware when the lease ends is a structural fit that on-premise cannot match.
- Sites with no local IT. Nobody has to visit to check whether a recorder is still writing. The platform reports its own health.
- Central policy control. One change to a credential policy applies everywhere, rather than being repeated across sites with the inevitable drift.
- No recorder in an unairconditioned cupboard. A meaningful share of the failed CCTV systems we are asked to take over failed thermally, not electronically.
- Evidence retrieval across sites. Pulling the same fifteen-minute window from nine locations is a browser task rather than nine phone calls.
Where on-premise or hybrid is still the better answer
This is the part usually left out, so let us be direct about it. A single large campus with several hundred cameras and its own IT team has little to gain from moving all of that video off site and a great deal of bandwidth to pay for. A manufacturing plant with high camera counts, long retention requirements and a constrained link is a poor candidate. An organisation whose regulator or parent company has taken an explicit position on data location may simply not have the option. In each of these cases, a unified on-premise platform, or a hybrid design that records at the edge and sends only metadata and selected clips upward, is the better engineering answer.
| On-premise | Cloud | Hybrid | |
|---|---|---|---|
| Cost shape | Capex heavy, refresh cycle every 5-7 years | Opex, predictable per camera or per door | Mixed; edge hardware capex, platform opex |
| Multi-site admin | Per-site, or a VPN mesh someone has to maintain | One console, any browser | One console, local recording |
| Bandwidth demand | Minimal upstream | Sustained upstream, sized to camera count | Low; metadata and clips on demand |
| Data residency | Fully determined by you | Determined by platform region; confirm before you commit | Primary footage stays on site |
| Upgrade path | Planned projects, occasional forklift replacement | Continuous, no action required | Platform continuous, edge on a cycle |
| Failure mode | Recorder fails, that site is blind and nobody notices for weeks | Link fails, live view lost; buffering depends on device | Link fails, recording continues locally |
The bandwidth question, with actual arithmetic
Bandwidth is where most cloud conversations in India either succeed or collapse, and it is usually discussed without numbers. So here are some, clearly labelled as an indicative worked example rather than a quotation.
Assumptions: 30 cameras, 4MP, H.265, moderate scene activity, encoding at roughly 2 Mbps each. Continuous upload of all streams.
30 x 2 Mbps = 60 Mbps sustained upstream, every hour the site is open. That is not a normal Indian branch-office uplink. On a typical asymmetric broadband connection it is simply not available, and on a leased line it is an expensive monthly commitment for a 30-camera site.
Now change one design decision. Record at the edge, upload only metadata, thumbnails and event-triggered clips. Assume 5% of footage is ever pushed up, plus a continuous low-bitrate metadata channel. The sustained requirement drops to roughly 3-5 Mbps, with short bursts when an operator pulls a clip. That is an ordinary broadband link.
This is why the interesting question is almost never cloud or not. It is what goes up, and when. Get that decision right and cloud becomes viable at sites where a naive full-stream design would never have worked. This also happens to be a network design problem before it is a security one, which is why we treat the passive and network layer as part of the same scope as the surveillance design rather than someone else's problem.
What Indian law actually asks of you
Two instruments matter here, and both are frequently misquoted in sales conversations.
The Digital Personal Data Protection Act, 2023 treats recorded footage of identifiable individuals as personal data. In practice that means notice and a lawful basis for recording, purpose limitation so footage collected for site security is not casually repurposed, retention that is defined rather than indefinite, and a workable process for responding when a data principal asks what you hold about them. Note that indefinite retention is the default behaviour of most legacy recorders, and that it is the harder position to defend.
The CERT-In directions of 2022 are the other half. They require certain categories of logs to be maintained for 180 days and enabled within Indian jurisdiction, and cyber incidents to be reported within six hours of being noticed. Where a security platform is network-connected, it falls inside that conversation. Cloud platforms tend to make the log-retention requirement easier to meet, because logging is a platform function rather than something a busy site engineer has to remember to configure.
None of this makes cloud compulsory or forbidden. It makes auditability a design requirement, which is a useful lens regardless of where the recording sits. The same logic applies to access control records, which are often more sensitive than video because they tie a named individual to a time and a door.
Where Foxnet sits
We deploy across all three models. Eagle Eye Networks for cloud video and Brivo for cloud access control, where the estate suits it. Genetec Security Center, unifying Omnicast video and Synergis access control on one platform, where a client needs a unified on-premise or hybrid deployment at enterprise scale. We announced the Genetec partnership late last year for exactly this reason.
Carrying more than one platform is commercially inconvenient. It means more certification, more training and more internal complexity than picking one and selling it to everybody. We think it is the only way to give a recommendation that survives contact with the site, and it is the same reason we design command and control centres around whichever platform the estate actually needs rather than the one we would prefer to sell.
The question we get asked is whether cloud is ready for India. I think the more useful question is whether a particular site is ready for cloud, and that is answerable in an afternoon with a survey and an honest look at the uplink. We have talked clients out of cloud on sites where it would have been the wrong call. That conversation is worth more to us than the subscription would have been.
— Pulkit Verma, Co-Founder, Foxnet Securitas
The short version
Indian businesses are readier than the sceptics think and less ready than the vendors claim. If you run many sites, if those sites change, or if you have no IT presence at the edge, cloud is very likely the right answer and the objections are usually solvable. If you run one large campus with high camera counts and a constrained link, it probably is not, and nobody should be trying to convince you otherwise. Most real estates sit somewhere in between, which is why hybrid keeps winning arguments that neither pure model can.
About Foxnet Securitas
Foxnet Securitas Pvt. Ltd. is one of India's fastest growing system integrators, designing, deploying and maintaining integrated security and workplace technology for enterprise clients. Foxnet delivers CCTV surveillance, access control, fire alarm systems, visitor management, command and control centres, video conferencing, professional audio, public address and IT infrastructure, with field teams across 15+ Indian cities serving fintech and BFSI, healthcare, manufacturing, government, IT and ITES, retail and logistics.