VMS in 2026: Architecture, ONVIF, Vendor Matrix, Custom vs Off-the-Shelf

Why Fora Soft wrote this playbook

Fora Soft has shipped 50+ VMS / surveillance projects since 2005. VALT is our flagship custom VMS — legal e-discovery platform serving 650+ US legal organisations with chain-of-custody recording, multi-camera court-ready evidence packages, and integration to existing case-management systems. EyeBuild ships its own VMS for solar AI surveillance on construction sites. Live Eye Surveillance, NetCamStudio, Mindbox and the Doorbell App round out the portfolio.

If you are evaluating Genetec vs Milestone vs Avigilon, considering custom VMS for a vertical product, or scaling a fleet past 1k cameras and the off-the-shelf is straining, this guide gives you the architecture, ONVIF reality, vendor comparison, and build-vs-buy framework.

What a VMS does (and where it stops)

A Video Management System is the software that turns a fleet of cameras into a usable surveillance product. It ingests video streams, records and stores them, surfaces them through an operator interface, runs (or integrates) analytics, dispatches alerts, and integrates with adjacent systems — access control, alarm, building management, CRM, case management.

Where VMS stops. A VMS is not a camera SDK (vendor SDKs talk to specific cameras), not an analytics platform (analytics often live in dedicated AI boxes or vendor-bundled), and not an incident-response system (PagerDuty, ServiceNow handle workflow). The VMS is the operator’s window into the camera reality; downstream workflow lives elsewhere.

The 6 layers of a modern VMS

ONVIF profiles explained

ONVIF (Open Network Video Interface Forum) is the multi-vendor IP camera standard. The standard splits capabilities into Profiles — conformance certifications that guarantee a camera supports a defined feature set. The profiles you care about:

Profile T is the 2026 baseline. Without it, your VMS cannot ingest analytics events from cameras with on-board AI — you would have to re-run inference on the VMS side, doubling compute cost. Verify Profile T support before buying any AI-capable camera.

Vendor matrix — Genetec, Milestone, Avigilon, Hanwha, custom

Build vs buy decision framework

Buy when: generic security use case, <500 cameras, you do not need to brand the VMS as your product, integrator-led deployment with off-the-shelf vendor support.

Build when: the VMS is part of your product (you sell it), vertical-specific workflow (legal e-discovery, construction PMs, retail loss-prevention, sports analytics), >5k camera fleet with off-the-shelf cost ballooning, or you have hardware integration requirements (custom PTZ + analytics + access control in one box).

Hybrid: off-the-shelf VMS for baseline + custom modules for the vertical-specific 20 %. Common pattern for organisations adding Genetec or Milestone for general security plus a custom layer for their unique use case.

Custom VMS — when it’s the right call

Vertical-specific workflows. Off-the-shelf VMS optimises for “security operator on shift.” Legal e-discovery needs case-tagged recordings, court-ready evidence packages, chain-of-custody log per access. Construction PMs need site / project / phase organisation, not flat camera lists. Retail loss-prevention needs POS-integrated event correlation. Each is a vertical that off-the-shelf cannot do well.

Custom analytics requirements. Bundled vendor analytics cover generic person/vehicle. Vertical-specific events (PPE compliance with specific equipment, sports player tracking with team logos, construction equipment behaviour) need custom models, which need a custom VMS to display them.

Compliance / data residency. HIPAA-grade healthcare surveillance, GDPR EU-only data residency with customer-managed keys, FedRAMP US public sector — the off-the-shelf vendors offer these but at enterprise tier with high pricing premium.

Hardware integration. If you ship custom cameras (EyeBuild pattern), the VMS that ingests them is also custom — off-the-shelf does not understand your PTZ command set or solar-power state.

Cost at fleet scale. Genetec and Milestone licensing scales per-camera. At 10k+ cameras, the licence bill alone justifies custom — we have built custom VMS for clients where licence savings paid back the build cost in <18 months.

Cost model at different fleet sizes

Off-the-shelf includes per-camera licence + support + hosting (often customer’s on-prem). Custom Y1 includes design, build, deployment; Y2+ is maintenance + hosting. Crossover happens around 1k cameras, accelerates above 5k.

Mini case — VALT serves 650+ legal organisations

VALT is a custom VMS for legal e-discovery serving 650+ US legal organisations. Workflow: deposition recording, courtroom video, witness interview capture, with chain-of-custody guarantees and court-admissible evidence packages.

Why off-the-shelf failed. Genetec and Milestone are organised around “cameras observed by operators on shift.” Legal workflow is organised around “cases, sessions, witnesses, exhibits.” Off-the-shelf could record but could not generate the evidence packages or maintain the chain-of-custody required by US courts.

What we built. Custom case-organised UI; recording with cryptographic timestamps; per-frame tamper-evident hashing; export-to-court packaging; integration with case-management systems used by US legal industry; FedRAMP-style audit trail on every access. Architecture: ONVIF Profile T ingest from courtroom cameras + custom recording layer with WORM (write-once, read-many) storage + custom evidence-packaging service + operator UI organised by case.

Outcome. 650+ legal organisations active. Several court rulings have explicitly relied on VALT recordings as evidence. Same VMS would not exist as a product if we had tried to extend Genetec. Book a 30-min call if you have a similar vertical-specific workflow.

Migration playbook — from off-the-shelf to custom

Phase 1 (weeks 1–4): scoping + architecture. Document workflow gaps in current off-the-shelf. Architecture for custom VMS. Camera-fleet audit (which cameras have ONVIF Profile T, which need replacement).

Phase 2 (weeks 5–14): build core. Ingest, recording, operator UI minimum-viable. Run in parallel with off-the-shelf for <10 % of fleet (canary).

Phase 3 (weeks 15–20): vertical-specific features. The 20 % that motivates the migration — case organisation, chain-of-custody, evidence packaging, etc. Cutover to 25–50 % of fleet.

Phase 4 (weeks 21–28): integration + cutover. Connect adjacent systems (access control, case mgmt, ERP). Ramp to 100 % fleet. Off-the-shelf retained for 60-day rollback insurance.

A decision framework — pick path in five questions

Q1. Is the VMS your product or your tool? Tool: off-the-shelf almost always. Product: custom unless <500-camera serving <100 customers.

Q2. What is the workflow specialisation? Generic security: off-the-shelf. Legal / construction / retail / sports / industrial: custom likely justifies.

Q3. Fleet size in 24 months? <500: buy. 500–5k: hybrid often best. >5k: custom dominates on cost.

Q4. Compliance posture? Standard: off-the-shelf. HIPAA / FedRAMP / EU strict residency: custom or off-the-shelf enterprise tier.

Q5. Hardware integration depth? Off-the-shelf cameras: any path. Custom hardware ingest: custom VMS required.

Pitfalls to avoid

1. Buying cameras before the VMS. Verify ONVIF Profile T support; verify the cameras work with your chosen VMS in a 1-week pilot. Returns are painful.

2. Underestimating storage costs. 1080p H.264 at 4 Mbps continuous = ~43 TB/year per camera. 1k-camera fleet = 43 PB/year raw. Budget compression, retention policies, tiered storage from day 1.

3. Hikvision / Dahua in restricted markets. US federal market FCC ban; EU privacy concerns. Default to Axis, Hanwha, Avigilon for enterprise sales.

4. Operator UI as afterthought. Operators bypass bad UI within weeks — using the cameras directly, exporting clips manually, missing alerts. UI design for VMS is harder than people think.

5. Vendor lock-in via proprietary recording format. Some VMS record in proprietary container that only their player can read. Migration becomes nearly impossible. Insist on standard formats (MP4, MKV) or export tools.

KPIs to measure

Quality KPIs. Camera connection success rate (target: 99.5 %). Recording completeness (target: 100 % of mandated retention windows). Operator query response time (target: <3 s for live, <5 s for recorded search).

Business KPIs. Operator time-on-task. Mean time to resolve incident. Cost per camera per month. Customer churn (for VMS-as-product).

Reliability KPIs. Storage tier failover success. Recording loss rate (target: 0). Recovery drill success rate (target: 100 % quarterly).

FAQ

What to Read Next

Ready to pick the right VMS?

Six layers, ONVIF Profile T baseline, vendor matrix decided by your fleet size and vertical. Off-the-shelf wins for <500-camera generic security; custom wins for vertical-specific workflows and >5k-camera fleets where licence cost dominates. VALT’s 650+ legal organisations prove the custom case for vertical specialisation.

Hikvision and Dahua are restricted in US federal and EU privacy-sensitive markets — default to Axis, Hanwha, Avigilon for enterprise sales. Storage costs explode at scale — tiered storage and retention policies are not optional. Operator UI is the difference between a VMS that gets used and one that gets bypassed within weeks.