A shopper falls down on aisle six a little before three. No one is sure of the exact time because the floor was vacant. Weeks later, a letter arrives from an attorney, and suddenly, the exact minute matters.
The footage is there. Somewhere across eleven cameras are forty seconds that could settle the question. Finding those forty seconds may take someone most of an afternoon.
The scenario changes from one organization to the next. At a loading dock, the question might be whether a pallet left damaged or arrived that way. In a care facility, it might be how long a resident was on the floor before someone reached her. Different buildings, different stakes, same problem: hours spent searching through video for an answer that already exists.
That investigation time is one of the most overlooked costs of a physical security program. Systems are evaluated on camera coverage, storage, image quality, and price, but rarely on how much staff time it takes to find the right footage after something happens.
Nearly half (46.5%) of the security, IT, operations, and facilities leaders surveyed for The State of Physical Security in 2026 report, said finding the right footage after an incident takes more than thirty minutes.
Fewer than one in twelve manage it in under two.
Every line on the evaluation measures the wrong thing
Think about how your current security system was chosen. The evaluation almost certainly scored camera count, resolution, frame rate, how many days of retention the storage would hold, which corners of the site were covered, and what the uptime commitment looked like. Every one of those measures the same thing, which is how much the system records and for how long.
There is no line anywhere on that evaluation for how fast it answers a question. Vendors do not offer one and buyers do not ask for one, and the reason is fairly mundane: nobody has agreed on a unit. Storage gets measured in days and terabytes and resolution in megapixels, while retrieval gets measured in nothing at all. A requirement that cannot be clearly stated rarely makes it into a procurement document, and what is not specified rarely gets purchased.
What the clock actually looks like
Those thirty minutes spent trying to find an answer are not one task but several stacked end to end, and most of the delay happens in the seams between them.
Establishing what you are looking for comes first, and the account you have been given is usually approximate: around 2:40pm, near the dock, possibly a forklift involved.
Finding the right camera and the right window means guessing which angle covers the spot and scrubbing until something moves. If whoever you are tracking went anywhere, the search restarts at every camera they pass, and if they crossed into a part of the site running on a different recorder, it restarts with a different login. Then there is the export, in whatever format the system produces, and the question of whether you are permitted to send it, to whom, and in what form.
None of those steps are difficult. Yet, together, they consume a morning. And usually, it costs a morning from someone who has another job to do. At a lot of organizations, the footage desk is a single IT administrator with a queue, and everyone else files a request and waits. The person waiting is frequently the only one who can recognize what actually matters in the clip, which means the review often has to happen twice.
Underneath all of it is a deadline no one ever deliberately set. Footage ages off on a retention schedule chosen years earlier, and claims have a habit of arriving after the only recording that would have settled them is gone.
The cost nobody counts
Oddly enough, none of that is the expensive part.
When finding the right footage takes half a workday, teams start deciding which incidents are worth the effort. It’s not a policy that someone writes down. A locker gets broken into, two people get into a fight in a hallway, a cell phone is stolen out of an unattended room, and while each of those is worth understanding, none of them is worth an afternoon. So they go uninvestigated.
An investigation that never happens leaves nothing behind. There is no incident record, because the incident was never established. Nothing appears in the monthly report, the trend line, or next year's budget request.
Security programs have no field for the things nobody had time to find out, which means the blind spot in any given program is shaped precisely like its retrieval cost. The slower the lookup, the more falls outside the record, and the healthier the program looks on paper, because the only incidents anyone documented were the ones somebody had time for. The costs that get counted are the ones that leave a trace.
Buying more capture makes retrieval worse
The reflex, when a program feels thin, is to add coverage. More cameras, more sites brought onto the system, longer retention. Each of those makes the underlying problem worse, because more footage is a larger haystack and none of it arrives with a better way to search it. There is no statistic for this and there never will be.
What predicts retrieval speed turns out to be organization rather than volume. Teams running everything in one connected system found footage within thirty minutes 64.8% of the time, against 41.7% for teams whose systems operate separately, and camera count showed no such pattern. Whatever a program gains from another dozen cameras, it is not speed.
None of which argues for replacing what you already own. In the survey, 84.2% of teams believed they could keep some or all of their cameras. The problem sits above the hardware, in whether the footage it produces can be searched in plain language from one place or has to be hunted down system by system.
Measure the thing you are actually judged on
All of this points at a number most teams do not currently have: the time from an incident being reported to a shareable clip reaching whoever asked for it. Not the search time once the right camera was found, but the whole span, waiting included.
It can be measured this week against the last real incident the team worked, without buying anything:
- When was it reported, and when did the person asking actually receive video?
- How much of that gap was waiting on someone else rather than searching?
- How many separate systems or logins did it take to follow one person or vehicle across the site?
- Could the person who needed the footage have found it without help?
- In the same month, how many incidents did the team decide not to look into, and why?
The last question is the useful one. An answer like “a few, because they weren’t worth the time” tells you something the rest of the program doesn’t: how often the effort required to investigate is deciding whether an incident gets investigated at all.
Teams are not unaware of any of this. Speeding up investigations was the second most common priority in the survey, behind only improving safety and threat response. What has been missing is a number to put against it, and a number is the only thing a budget conversation reliably responds to.
Start with one incident that has already happened. Reconstruct it from beginning to end. If finding the answer takes an afternoon, you have learned something no camera specification will tell you.
.png)
