Why this matters

If you are evaluating a Video Management System (the platform that ingests, records, and manages camera streams, abbreviated VMS), Milestone XProtect will be on almost every shortlist, and for a specific reason: it is the reference example of the open, on-premises VMS family. Understanding it well teaches you how that whole family behaves — its cost shape, its integration model, and the standards-versus-SDK boundary that decides what "open" actually buys you. Milestone is a standalone company inside the Canon group, reported roughly USD 340 million in 2025 revenue, and reinvests near a third of it in analytics, responsible AI, and cloud — so its roadmap will shape the market you are buying into. Read this profile to judge whether XProtect fits your deployment, and to calibrate every other vendor against a known reference point.

Where XProtect sits: the open, on-prem reference

In the VMS vendor landscape we argued that the durable way to read this market is by deployment family first — enterprise on-prem, cloud-native video-surveillance-as-a-service, open hybrid, and custom-built — because the family fixes your cost shape and your lock-in long before the brand does. Milestone XProtect is the cleanest example of the enterprise on-prem family: software you license and run on your own servers, inside your own network, at a scale that reaches from a single building to a federated national estate.

But XProtect carries a second label that matters as much as the first: it is an open platform. Where a closed system records cameras the vendor blesses and runs only the analytics the vendor ships, XProtect is built to be extended — by any conformant camera, by third-party analytics, by access-control and alarm systems, and by software your own team writes. That openness is the thing to understand first, because it is both the product's core value and the reason it is heavier to adopt than a sealed cloud box. Think of XProtect less as an appliance and more as an operating system for video: powerful precisely because so much plugs into it.

The four editions, honestly

XProtect is not one product but a ladder of four editions that share a codebase and grow in scale and features as you climb. Picking the right rung is the first real decision, and over-buying is as common as under-buying.

XProtect Express+ is the entry paid edition, aimed at a single small site — a shop, a parking lot, an office — and supports up to 48 cameras on one server. XProtect Professional+ is the mid-market rung: it removes the single-server limit, so you can run recording servers across multiple sites and view everything from one place. XProtect Expert adds the high-security and large-installation features, supports an unrestricted number of cameras and servers, and — importantly — can take part in federation (more on that below). XProtect Corporate is the enterprise flagship: every feature, unrestricted scale, and the full federation and centralized-management toolkit for the largest, most distributed deployments.

One honest note that trips up buyers: the free tier is gone. XProtect Essential+, long offered free for up to eight cameras, was discontinued with the XProtect 2025 R2 release. If your plan assumed a no-cost Milestone for a tiny site or a proof of concept, that plan needs revisiting — the entry point is now Express+, and it is a paid licence.

Ladder of four XProtect editions from Express+ to Corporate, showing camera and site scale, federation, and best-fit buyer. Figure 1. The XProtect edition ladder. Scale and features grow as you climb; Essential+ (free, up to 8 cameras) was retired in the 2025 R2 release, so the paid entry point is now Express+.

Edition Deployment model Open SDK? Scale Best fit
Express+ Your server, single site Yes — MIP SDK Up to 48 cameras, one server Single small site: shop, office, lot
Professional+ Your servers, multi-site Yes — MIP SDK Multiple sites and servers Mid-market, several locations
Expert Your servers, multi-site Yes — MIP SDK Unrestricted; joins federation Large, high-security installations
Corporate Your servers, federated Yes — full MIP SDK Unrestricted; full federation Enterprise, city, national estates

Table 1. The XProtect editions across the dimensions a buyer weighs. Every edition ships the open developer kit — the difference is scale, federation, and the high-end feature set, not openness. Essential+ (free, 8 cameras) was discontinued in 2025 R2.

How XProtect is built: a distributed system, not one box

To understand both XProtect's scale and its weight, you need a plain picture of how it is assembled. It is a distributed system of cooperating services, not a single application, and that design is exactly what lets one deployment grow from dozens of cameras to tens of thousands.

At the center is the Management Server: the brain that holds the system configuration in a Microsoft SQL Server database, authenticates users, enforces permissions, and runs the rule engine that decides what happens when an event fires. Around it sit one or more Recording Servers — the workhorses that actually pull each camera's stream over the network and write it to disk. Separating the brain from the workhorses is the key move: when you need to record more cameras, you add recording servers rather than replacing the system. Operators watch live and recorded video through the Smart Client, a desktop application built for day-to-day monitoring; administrators configure everything through the Management Client; and a Mobile Server delivers video to phones and to the browser-based web client.

The practical consequence is that XProtect's capacity is a function of how you size and split these servers — chiefly the recording servers and the SQL database — which is why a serious XProtect project always includes a capacity plan. We walk through that arithmetic in scaling a VMS: capacity planning; the headline is that storage and recording throughput, not the licence, are what actually size the hardware. A camera streaming continuously is a steady write load, and the math is unforgiving: bitrate times the number of cameras times hours times retention days equals the storage you must buy. The full cost treatment, including that storage math, lives in the surveillance cost model.

XProtect architecture: cameras to recording servers, a management server with SQL, plus operator and mobile clients. Figure 2. XProtect as a distributed system. The management server holds configuration and rules in SQL; recording servers ingest camera streams; clients view and administer. You scale by adding recording servers, not by swapping the platform.

The real differentiator: ONVIF baseline plus the MIP SDK

Every VMS vendor says "open." XProtect is one of the few where the word has a precise, two-layer meaning, and separating the two layers is the single most useful thing you can learn about the product.

The first layer is camera openness through ONVIF. ONVIF is the common language that lets cameras and video software from different makers work together; its governing body states plainly that "conformance to profiles is the only way that ensures compatibility between ONVIF conformant products." XProtect conforms to four of those profiles — Profile S and T for live streaming, Profile G for recording and replay, and Profile M for analytics metadata — and ships device drivers in regularly updated "device packs." More than 16,500 devices sit on its Supported Device List, over a thousand of them handled by a single optimized ONVIF driver, with a Universal Driver as a fallback for anything else that can produce a stream. In plain terms: you are very unlikely to own a camera XProtect cannot record.

The second layer is application openness through the MIP SDK. The Milestone Integration Platform Software Development Kit is the published toolset that lets outside developers build on XProtect, and it supports three depths of integration: a lightweight protocol integration over open interfaces (usable from non-Windows systems), a component integration through a .NET library that shares video and data, and a plug-in integration that embeds new panels and features directly inside the Smart Client and Management Client. A separate Driver Framework lets partners add support for new cameras and IoT devices. This is the layer that built Milestone's ecosystem — thousands of third-party analytics, access-control, and business applications listed in its Technology Partner Finder — and it is what a closed cloud platform structurally cannot match.

Here is the boundary that protects you from disappointment. Remember that ONVIF only guarantees a baseline — the specific profile both the camera and the VMS conform to. Advanced, differentiating features routinely sit outside that baseline: edge-AI events and rules, advanced pan-tilt-zoom tours, proprietary codecs, and deep analytics tuning typically arrive through a vendor's own driver or an MIP SDK integration, not through plain ONVIF. So the right question to ask is never "is it ONVIF?" but "which profiles does this camera and this feature use, and what falls back to a driver or the SDK?" Keep "baseline interoperability" and "full feature parity" as separate ideas. The mechanics are in ONVIF explained for engineers and the profile-by-profile guide in which ONVIF profile your product needs; the SDK side, where ONVIF runs out, is covered in proprietary camera SDKs beyond ONVIF.

ONVIF Profiles S, T, G, M as the camera baseline; the MIP SDK protocol, component, and plug-in integrations beyond it. Figure 3. XProtect's two layers of openness. ONVIF profiles S/T/G/M give the camera baseline; the MIP SDK and Driver Framework provide the deep, differentiating integrations the baseline does not cover.

How XProtect scales to many sites: federation

A single management server with its recording servers is one "site." Real estates — a retail chain, a transit authority, a city — are many sites, and XProtect has two distinct technologies for tying them together. Confusing them is a common scoping error, so here is the clean distinction.

Milestone Federated Architecture (MFA) ties XProtect Corporate and Expert installations into a parent-child hierarchy that, to operators and administrators, looks and behaves like one large system — one login, one map, video and metadata reachable across sites according to each user's rights. Crucially, MFA requires no additional licences. It is designed for tightly connected sites that are fewer but larger, each with solid network links between them. Think of it as wiring several full control rooms into one command center.

Milestone Interconnect solves the opposite shape. It connects many smaller, geographically scattered sites — any paid XProtect or Milestone Husky recorder — back to a central XProtect Corporate, and it is optimized for low-bandwidth or intermittent connections, pulling or caching recordings centrally as the link allows. Think of it as many small branch recorders reporting home to headquarters over modest internet links. MFA is depth at a few big nodes; Interconnect is reach across many small ones. The general pattern of treating many sites as one estate is covered in federation: many sites as one.

Milestone Federated Architecture as a hierarchy of large sites, beside Interconnect linking many small distributed sites. Figure 4. Two ways XProtect becomes one estate. Federated Architecture binds fewer, larger sites into one hierarchy (no extra licences); Interconnect reaches many small, distributed sites over thin links.

Licensing and the cost shape

XProtect is priced the way the on-prem family is priced: as a capital expense, not a subscription. You buy a base licence once per system (it lets you install the server software on as many servers as the deployment needs), then one device licence per camera channel you connect. On top of that sits Milestone Care — the software-maintenance subscription (offered as Care Plus and Care Premium) that entitles you to new versions, support, and a trade-in path as you upgrade. For XProtect Corporate, Care is mandatory for the whole installation during the first year. This is the opposite shape from cloud video-surveillance-as-a-service, which bills a recurring fee per camera per month forever.

Walk the arithmetic out loud once, because the shape is the point, not the exact figures. Take a 200-camera Corporate-class estate and look only at the software (servers, storage, and cameras cost roughly the same whichever VMS you pick, so leave them out). Treat the device licence as an illustrative one-time cost per channel and Care as an illustrative annual cost per channel:

xprotect_5yr_software = (device_licence × cameras)
                        + (care_per_cam_per_year × cameras × years)
xprotect_5yr_software = ($200 × 200) + ($35 × 200 × 5)
xprotect_5yr_software = $40,000 + $35,000 = $75,000

That is roughly $75 per camera per year for software over five years. Put it beside a cloud platform at, say, $25 per camera per month — $25 × 200 × 12 × 5 = $300,000, or $300 per camera per year — and the on-prem shape is far cheaper on the software line at this scale. The cloud platform still wins for many buyers, because it removes the servers, the IT staff, and the integrator, and puts modern analytics on every camera on day one. The lesson is the one from the landscape article: the shapes cross, and you must find the crossover for your own numbers and time horizon before signing. List prices here are illustrative — Milestone sells through certified partners who discount real quotes heavily above 100 cameras, and the device licence varies by edition.

A common mistake to avoid

The costliest XProtect mistakes are not about the software at all — they are about assumptions. Three recur. First, assuming "ONVIF" means every feature works: a camera adds and records fine over Profile S, and then the team discovers its smart-detection events need the vendor's driver or an MIP SDK integration to surface in XProtect. Test the features you actually need, not just "does it connect," on a small sample before buying the fleet. Second, assuming the free tier still exists: Essential+ was retired in 2025 R2, so a proof of concept that budgeted zero for the VMS now needs a paid Express+ licence. Third, forgetting Care in the five-year budget: the device licence is a one-time number, but the maintenance subscription recurs, and a quote that omits it understates the real total. None of these is a flaw in the product; each is a planning gap that an honest evaluation closes up front.

Cloud and AI: where Milestone is heading

XProtect began as pure on-premises software, but Milestone now spans the deployment spectrum, and a fair profile has to account for the direction of travel. On-premises XProtect remains the core. XProtect on AWS lets enterprises run that same software in the cloud they manage. Milestone Kite, powered by the Arcules cloud platform, is a true video-surveillance-as-a-service offering aimed at small and mid-sized organizations — auto-updating, subscription-billed, supporting thousands of camera models — and Arcules can run alongside on-premises XProtect as a hybrid, with the connection extended in the 2025 R1 release to the Corporate, Expert, and Professional+ editions and to long-term cloud retention. In short, Milestone's answer to the cloud-native challengers is to offer on-prem, hybrid, and cloud-native under one open-platform umbrella rather than forcing a single model. The deployment-model trade-offs themselves are covered in on-prem, cloud, and hybrid VMS.

On analytics, XProtect's historical model is "bring the best-of-breed through the SDK" rather than "one native engine," which is why the video-analytics map matters more here than a single feature list — the analytics are an ecosystem, and accuracy is always a precision-and-recall range that depends on scene, lighting, and tuning, never a single guaranteed number. The newer thread is Milestone's "responsible AI" investment: Project Hafnia, an effort with NVIDIA to build anonymized, annotated video datasets for training models in a privacy-respecting way, and the 2025 acquisition of brighter AI for anonymization. The XProtect 2026 R1 release added an AI-powered video-summarization capability built on NVIDIA's vision-language technology, turning hours of footage into searchable text. For buyers in regulated, privacy-sensitive environments, this European, GDPR-conscious posture is a genuine differentiator — but biometric and AI analytics remain a legal gate, not just a feature, so confirm the privacy obligations in GDPR for video surveillance before switching anything on.

Deployment spectrum: on-prem XProtect, hybrid XProtect plus Arcules, and cloud-native XProtect on AWS and Milestone Kite. Figure 5. Milestone across the deployment spectrum. The same open-platform DNA runs on-premises (XProtect), hybrid (XProtect + Arcules), and cloud-native (XProtect on AWS, Milestone Kite).

Where XProtect fits — and where it doesn't

An honest profile names both. XProtect fits when openness and scale are the job: a multi-vendor camera estate you refuse to lock to one hardware brand, a deployment that must integrate with access control, alarms, and business systems, an enterprise or city that needs federation, or a regulated environment that values a European, privacy-forward roadmap. It is the safe reference choice precisely because so much plugs into it and because it scales without a rebuild.

XProtect is the wrong tool when the job is small and simple. For a 20-camera single site with no IT staff and no integration needs, a cloud video-surveillance-as-a-service platform will be live faster, update itself, and skip the servers, the SQL database, and the integrator — and the loss of Essential+ removes the old "free Milestone for tiny sites" answer. XProtect also assumes you bring infrastructure and competence: servers to size, recording capacity to plan, and usually a certified integrator to deploy it well. And while its analytics ecosystem is vast, teams that want one tightly-coupled native AI engine out of the box sometimes prefer an analytics-first cloud platform. The reference example of "open and scalable" is, by the same token, heavier than "sealed and instant." Whether to adopt it, assemble on open components, or build is the subject of custom vs off-the-shelf VMS.

Where Fora Soft fits in

Fora Soft has built real-time video, streaming, and computer-vision software since 2005, across 625+ shipped projects, and a large share of our surveillance work lives exactly at XProtect's open edge — building MIP SDK plug-ins, wiring custom analytics and external systems into XProtect through its component and protocol integrations, and extending what the platform shows an operator. The discipline we bring is the one this section preaches: design for how the integration behaves at full camera load and on a bad-network day first — realistic detection precision and recall under real lighting, latency you have measured, recording that does not drop frames under stress — then the feature list. When a team's needs outgrow what even an open platform exposes, we help weigh extending XProtect against assembling on components or building, with the honesty that reinventing recording is expensive and Milestone solved it a long time ago.

What to read next

For the commercial overview of the market this profile sits inside, see Fora Soft's video surveillance management systems playbook and the rundown of modern VMS software features.

Call to action

References

  1. ONVIF — "ONVIF Profiles" (an ONVIF profile is a fixed set of features a conformant device and client must support; "conformance to profiles is the only way that ensures compatibility between ONVIF conformant products"; video systems use Profiles D, G, M, S, and T; "compliance to regulations… are outside the scope of ONVIF." Page modified 2026-05-11). Primary standard (tier 1). https://www.onvif.org/profiles/
  2. Milestone Systems — "ONVIF® drivers" (XProtect VMS documentation, 2025 R2: Milestone is conformant with ONVIF Profiles S, T, G, and M and ships standard ONVIF drivers kept current with the official ONVIF specifications; a Universal Driver streams non-conformant devices). First-party engineering on a standard (tier 3, documenting tier-1 conformance). https://doc.milestonesys.com/latest/en-US/portal/htm/chapter-page-onvifdriver.htm
  3. European Union — "General Data Protection Regulation (Regulation (EU) 2016/679)" (Art. 9 treats biometric data used to uniquely identify a person as special-category data; Art. 35 requires a Data Protection Impact Assessment for high-risk processing such as large-scale systematic monitoring or biometric analytics — the legal gate on AI/biometric analytics in XProtect deployments). Primary law (tier 1). https://eur-lex.europa.eu/eli/reg/2016/679/oj
  4. IEC — "IEC 62676 series: Video surveillance systems for use in security applications" (specifies minimum requirements and recommendations across the system lifecycle; EN IEC 62676-4:2025 covers application guidelines including information security and data privacy — the system-level floor any VMS should meet). Primary standard (tier 1). https://webstore.iec.ch/en/publication/34391
  5. Milestone Systems — "Milestone Integration Platform (MIP) SDK" / "Integrate with XProtect" (the MIP SDK supports three integration types — protocol, component via .NET library, and plug-in embedded in XProtect — plus a Driver Framework for cameras and IoT devices; the basis of the open-platform partner ecosystem). First-party engineering (tier 3). https://www.milestonesys.com/support/for-developers/integrate-with-xprotect/
  6. Milestone Systems — "XProtect VMS system architecture" / "Server components" (the management server stores configuration in a Microsoft SQL Server database and runs authentication, permissions, and the rule system; recording servers ingest and store camera streams; Smart Client, Management Client, and Mobile Server are the access tier). First-party engineering (tier 3). https://doc.milestonesys.com/latest/en-US/system/sad/sad_servercomponents.htm
  7. Milestone Systems — "Milestone Federated Architecture" and "Milestone Interconnect (explained)" (MFA ties XProtect Corporate and Expert sites into a parent/child hierarchy that appears as one system and needs no additional licences, optimized for fewer/larger sites; Interconnect links many smaller distributed sites to a central XProtect Corporate over low-bandwidth or intermittent connections). First-party engineering (tier 3). https://doc.milestonesys.com/latest/en-US/wp_interconnect/milestone_interconnect_in_1.htm
  8. Milestone Systems — "XProtect variant comparison" and "What's included in XProtect variants" (the Express+, Professional+, Expert, and Corporate editions and their scale/feature differences; Essential+ discontinued with XProtect 2025 R2). First-party product documentation (tier 3). https://www.milestonesys.com/products/software/xprotect-comparison/
  9. Milestone Systems — "About licenses" (XProtect licensing: a base license per Software License Code installable on unlimited servers, one device license per camera channel, and Milestone Care for software updates; Care mandatory in year one for Corporate). First-party engineering (tier 3). https://doc.milestonesys.com/latest/en-US/standard_features/sf_mc_gsg/sysarch_aboutlicenses.htm
  10. Milestone Systems — "Milestone introduces Milestone Kite" and "XProtect 2026 R1 / Arcules updates" (Milestone Kite, powered by Arcules, is a VSaaS for SMB supporting 6,000+ camera models from 100+ manufacturers and complements XProtect on AWS for enterprise; 2026 R1 adds AI video summarization on NVIDIA vision-language technology and expands cloud retention). First-party / company announcement (tier 3). https://www.prnewswire.com/news-releases/milestone-systems-strengthens-security-operations-and-expands-cloud-capabilities-with-xprotect-2026-r1-and-arcules-updates-302754972.html
  11. Milestone Systems — "Project Hafnia" with NVIDIA, and the brighter AI acquisition (April 2025) (an anonymized, annotated visual-data platform for training compliant AI models, with pilots in Genoa and Dubuque; the responsible-AI / privacy-forward roadmap). First-party / company announcement (tier 3). https://www.milestonesys.com/company/news/press-releases/nvidia-milestone-systems-project-hafnia/
  12. Milestone Systems — "Milestone grows net revenue… in 2025 and invests in the intelligent video era" (Milestone is a standalone company in the Canon group since 2014, reported ~EUR 298M / ~USD 340M / DKK 2.2B 2025 net revenue, reinvesting near a third in analytics, responsible AI, and cloud). First-party / company announcement (tier 3). https://www.prnewswire.com/news-releases/milestone-grows-net-revenue-to-usd-340-million-in-2025-and-invests-in-the-intelligent-video-era-302723849.html
  13. Genetec — "Genetec retains world-leader position in video management software" (Omdia 2024 and 2025 Video Surveillance & Analytics Database reports rank Genetec the world's number-one VMS vendor; market context for where Milestone sits among the enterprise on-prem leaders). Analyst-cited via vendor (tier 4). https://www.genetec.com/about-us/news/press-center
  14. Milestone Systems — "Supported devices" / Device Pack release notes (more than 16,500 devices on the Supported Device List, over 1,000 tested ONVIF devices on a single optimized driver, updated continuously via device packs). First-party engineering (tier 3). https://www.milestonesys.com/support/software/supported-devices/