If you’re in a hurry
If you have CCTV, door entry or access control and you don’t know who is responsible for keeping it updated - or the company that installed it no longer exists, or the people you pay for monthly support haven’t been onsite since COVID - that’s a problem.
Security systems should sit on their own network, shouldn’t be exposed directly to the internet, and someone should be responsible, in writing, for keeping them updated.
If none of that makes sense, or your current provider shrugs when you ask about it, it’s time to look for some outside help.
The less short version
Last week security researchers at GreyNoise reported a fresh wave of attackers scanning for a Hikvision camera flaw that was first disclosed and patched back in 2021. Five years on there are still plenty of unpatched cameras out there to find.
That’s not a one-off. Earlier this year SonicWall reported more than 67 million attack attempts against UK networks in 2025 targeting what may well be the same long-standing Hikvision flaw. It was the most common serious intrusion attempt they saw across UK networks that year. And since the summer, Hikvision has published two more batches of security advisories: five camera vulnerabilities in July, then three more in September covering some Wi-Fi cameras, intercom door stations and its access control software. To Hikvision’s credit, they say none of the September issues are known to have been exploited, and fixes were available when they were announced.
This isn’t about Hikvision
Hikvision is in the headlines because it’s the biggest manufacturer in the world - more devices, more attention. The same principles apply to every brand, and especially to cheaper unbranded kit, a lot of which is a model from one of the bigger manufacturers wearing a different badge.
Keeping on top of security advisories is hard enough. Even when you do spot one, it’s no use if you don’t know whose software is inside your cameras and whether the advisory applies to you.
The real issue is how these systems tend to be looked after. Or rather, how they tend not to be.
Why security systems get forgotten
A CCTV or access control system gets installed, configured, tested and handed over. It works. Periodically someone checks the footage to see who reversed into the car in the car park, removes a user or replaces a lost fob - but nobody actually maintains it.
It’s not on the IT asset list because “the alarm people” installed it.
The installer’s job usually ends at handover.
You wanted to be able to review the CCTV on your mobile so remote viewing was set up years ago by opening a port on the router - which also means the recorder can be reached by anyone on the internet.
And you think you’re covered because you have a contract with the alarm company. But monitoring contracts cover alerts, not upkeep, and maintenance contracts vary a lot. Some include firmware updates; many only cover fixing things when they break. It’s worth checking which one you’ve got.
None of those is anyone being careless, exactly. It’s what happens when a system falls into the gap between trades. But a recorder that’s visible on the internet, with old firmware, a weak default password, and on the same internal network as everything else is a very convenient entry point.
A quick aside
This isn’t a dig at installers. We work with several and they do a good job of what they’re asked to do - and the good ones are the first to say where their expertise stops. Security systems now live on IT networks, and the question of who keeps them patched often isn’t asked by anyone, so it doesn’t get answered.
Questions to ask your installer (or whoever looks after your system)
- Who updates the firmware on our cameras, recorder and door entry, and when was it last done?
- Can the recorder be reached directly from the internet? If so, how?
- Is the system on its own network, or on the same network as our computers?
- Is our equipment still supported by the manufacturer, and when does that end?
If you get clear answers to all four, you’re in better shape than most. If not, read on.
What good looks like
Give security systems their own network. Cameras, recorders and door entry should sit on a separate network segment from your computers. I run things this way at home too - occasionally to my own cost - but it’s the single most effective step on this list.
Don’t forward ports to the recorder. If people need to view cameras remotely, use a VPN, or the manufacturer’s own app with a strong, unique password and two-factor authentication where it’s offered. A recorder login page open to the whole internet is exactly what those scans are looking for.
Change the defaults and know who has access. Each person who views footage should have their own login. Know which accounts the installer kept for maintenance, and remove any that belonged to people who’ve since left.
Decide who owns updates, and write it down. The installer, your IT provider or you - it doesn’t much matter who, as long as everyone agrees and someone actually checks every few months.
Keep a simple list. Make, model, firmware version, where it is and who to call. When the next advisory lands, you’ll be able to tell in five minutes whether it affects you.
Plan for end of life. If the manufacturer has stopped issuing firmware for your model, it won’t get any safer from here. It’s probably also out of support, so if anything does fail you’re unlikely to get a like-for-like replacement. Budget to replace it rather than waiting for it to fail.
And while you’re checking, look at how the system reports alarms. If it still dials out over an analogue phone line, it’s on borrowed time anyway.
For serviced offices and shared buildings
If you run a serviced office or managed workspace, everything above applies - with more people involved and more at stake.
Keep building systems away from tenants. The building’s cameras and access control should be kept well away from tenant networks. Tenants plug in whatever they like, and you don’t want a compromised laptop on the 3rd floor getting nice and friendly with your door controllers.
Keep tenants away from each other, too. One tenant’s laptop shouldn’t be able to see another tenant’s printer, let alone their files. And if one tenant’s laptop gets infected and the problem spreads to others, one of the first questions will be about the building’s network.
Know which contractors can get in remotely. CCTV, access control, lifts and building management systems often each have a different contractor with their own remote access. Keep a list, make sure each has their own login, and close access when a contract ends.
Tidy up when tenants leave. Fobs, access control users and any network access should go when the tenant does. It’s easy to let these pile up over the years.
It’s also worth remembering that CCTV footage of tenants and visitors is personal data. A compromised recorder isn’t just an IT problem.
For installers
If you’re an alarm or CCTV installer and the IT side of a job is the part you’d rather not deal with - network setup, segmentation, safe remote access, ongoing support - that’s exactly what we do as an integration partner. You install the system, we make sure it sits safely on the client’s network.
We don’t install security systems and we’re not looking to start. The client relationship stays with you; we’re the IT specialist you bring in so the whole job works.
Whichever side you’re on, Hayes IT can audit what’s connected to your network, find the devices nobody’s been looking after, and set things up properly. Get in touch and we’ll take it from there.