Security vendors are routinely asked to prove a return on investment. Procurement wants a payback period, finance wants a number, and vendors oblige with calculators. I have built one of those calculators myself.

ROI captures some of the benefits of video analytics well: those that come from saving labor or reducing frequent, countable losses. A monitoring center is the clearest case. Most of the other benefits sit in things that do not happen, and ROI has no good way to count them.

This matters because the measure shapes the decision. If buyers fund only what fits an ROI model, they will underinvest in protection and overinvest in efficiency. The answer is not less measurement but different measurement.

Where ROI works: labor and frequent losses

A monitoring center sells watched hours. Its main cost is operators. An operator can only watch a limited number of feeds with real attention, and much of their time goes to alarms that turn out to be nothing: wildlife, weather, shadows, staff on site after hours.

Video analytics such as Scylla change that equation directly. Filtering false alarms and passing on only events worth a human look means each operator can cover more sites. The benefit shows up in figures the business already tracks:

● sites or cameras per operator ● alarms handled per shift ● share of alarms that are false ● operator hours per site per month ● cost to serve a customer

Here ROI is the right tool. The investment is software and the return is fewer operator hours, or more revenue per operator. Both sides are in dollars, over a defined period, with a clear before and after. A center can trial the system on a subset of sites and compare.

The same logic applies wherever the benefit is labor or frequent, countable losses: replacing some guard patrols, cutting the time spent searching footage after an incident, reducing retail shrinkage, or avoiding call-out fees for false alarms.

Even here, ROI captures only part of the value. An operator who sees fewer false alarms is more likely to respond properly to the real one. But the labor case alone usually justifies the purchase.

Most deployments carry some of these benefits. ROI is the right measure for that part. The rest needs other measures.

Where ROI breaks down

Most security buyers are not monitoring centers. They are schools, hospitals, retailers, utilities, transport operators, defense sites and corporate campuses. For them, security is not the product. It is a condition of operating, and much of the value of video analytics is protection. Four problems make ROI a poor fit for that value.

The counterfactual cannot be observed. ROI needs a "without" case. If a perimeter system detects an intruder who is then stopped, we do not know what that intruder would have done. If nothing happens all year, we cannot tell whether the system deterred someone or no one tried.

The events that matter are rare. A weapon on a campus, a breach at critical infrastructure, an assault in a car park. At any single site these are infrequent, so the site's own history is too short to estimate a rate, let alone a change in rate. A large portfolio of sites can estimate rates, but most sites cannot. A system can work well for years before the event it exists for occurs.

Averages hide the losses that matter. Most of the risk sits in a few severe events. An expected annual loss can be calculated, but it treats a small chance of catastrophe the same as a steady trickle of minor losses. Organizations are not indifferent between the two, which is why they buy insurance even though it loses money on average.

Attribution is unclear. Security outcomes come from layers: fences, lighting, access control, guards, procedures, cameras and analytics. When an incident is prevented or contained, the credit cannot be split cleanly between them.

Vendors respond by supplying the missing numbers: an assumed incident rate, an assumed cost per incident, an assumed reduction. The result looks rigorous but is mostly assumption. Experienced buyers know this, which is why ROI claims in security are so often discounted.

What the improvement actually is

Analytics such as Scylla's improve security in ways that are real but rarely show up as a cash return, starting with the safety of staff, students, patients and customers.

● Detection that does not depend on attention. A person watching dozens of screens misses things, especially late in a shift. Software does not tire or get distracted, and it watches every feed, every hour. It has its own limits, such as poor lighting and obstructed views, so performance should be tested on site. ● Faster response. Detecting a weapon, an intrusion or a fight as it starts, rather than when someone reports it, gives earlier warning for lockdown, evacuation and response. The aim is to reduce harm once an incident begins, not only to prevent it. ● Coverage of cameras nobody watches. Many organizations record far more video than anyone views. Analytics turn passive recording into live detection without adding staff. ● Alarms people trust. When most alarms are noise, people stop taking them seriously. Reducing false positives restores the credibility of the alarm itself. ● A consistent record. Every detection is logged with time, location and footage. That supports investigation, insurance claims and showing a regulator what happened. ● Deterrence. Cameras on their own deter little. Detection that reliably leads to a response does, and once that is known it changes behavior. It is the hardest benefit to measure.

What the evidence shows

These benefits are not speculative. The research behind them is well established.

● Recording is not enough; monitoring and action are. A 2019 systematic review of 40 years of research, covering 80 evaluations, found crime fell about 13% in CCTV areas compared with control areas, and about 37% in car parks. Actively monitored schemes showed a significant reduction. Passively monitored schemes showed no significant effect, and neither did violent crime overall (Piza, Welsh, Farrington and Thomas, 2019). Cameras by themselves are not a meaningful deterrent. The value comes from someone seeing the event and acting on it. ● People cannot watch screens for long. An often-cited finding from Sandia National Laboratories is that "after only 20 minutes of watching and evaluating monitor screens, the attention of most individuals has degenerated to well below acceptable levels" (Green, 1999). A 2015 study of 42 experienced CCTV operators found they detected about half of target behaviors. Novices and generalists lost performance over time, while specialists maintained theirs (Donald, Donald and Thatcher, 2015). ● Most alarms are noise. Between 94% and 98% of burglar alarm calls to police in the US are false (Sampson, 2007). An alarm stream like that trains people to ignore it. ● Violent incidents are over quickly. Of 160 active shooter incidents in the US between 2000 and 2013, 63 had a known duration. Of those, 69% ended in five minutes or less, and 23 ended in two minutes or less (FBI, 2014).

None of these studies gives an ROI for a particular site, and they measure human monitoring rather than analytics. Together they show where the gaps are. Surveillance reduces crime when it is monitored and acted on, not when it only records. People cannot sustain that monitoring, most alarms are false, and violent incidents are decided in minutes.

For violent incidents, the case for analytics is earlier warning and response, not deterrence. When an incident can be over in two minutes, the earliest possible alert matters, such as a weapon seen before it is used. Analytics is designed to close these gaps, and how well a given system does so should be tested on the customer's own sites.

Leaders invest in what they cannot yet measure

Requiring an ROI before funding video analytics is part of a wider pattern. Leading firms invest across the board, in people, processes, systems, brand and capability as well as plant and equipment. Many of those investments are judged qualitatively rather than by a calculated return. The evidence is correlational, but it is consistent: firms that invest beyond what they can measure in the short term tend to outperform.

● McKinsey's study of 615 large and mid-cap US companies found that, from 2001 to 2014, firms with a long-term orientation grew revenue 47% more and earnings 36% more than other firms. By 2014 they had also spent almost 50% more on R&D (Barton et al., 2017). ● A 2021 McKinsey Global Institute study found the fastest-growing companies invest 2.6 times more in intangibles, such as software, data, training and organizational capability, than slow-growing ones (Hazan et al., 2021). ● Brynjolfsson, Rock and Syverson show that the investments needed to make technologies such as AI useful are largely intangible and poorly measured. Measured productivity often falls before it rises, a pattern they call the productivity J-curve (2018).

The other side of the pattern is just as clear. In a survey of 401 financial executives, 80% said they would cut discretionary spending on R&D, advertising and maintenance to meet an earnings target. A majority would reject a project with a positive net present value if it meant missing the analyst consensus (Graham, Harvey and Rajgopal, 2005).

The principle is the same in each case. Leading organizations pursue growth and positive change through investment, even when the evaluation is qualitative rather than quantitative. Lagging organizations hold back, even where the benefit is real, because they cannot put a number on it. Qualitative does not mean unaccountable. It means structured judgement: risk assessment, scenario analysis and testing.

Spending on video analytics behaves more like maintenance than R&D, and maintenance is exactly what gets cut to meet a target. Its benefits are real but delayed, spread out and hard to attribute. Organizations that demand a hard ROI before funding it will underinvest, not because the protection lacks value but because their measurement cannot see it. Leaders decide the level of protection they need, fund it, and track whether it is delivered.

Preparing for rare, severe events

Some risks are unlikely in any given year but would do serious damage if they occurred: an armed attack, a major breach at a critical site, a serious assault on staff or customers. These should not be ignored because they are improbable.

Their low probability is exactly what makes a short-term ROI hard to assign. In most years the preparation will appear to return nothing. Its value is that the organization is ready when the event does happen.

That readiness makes the business more robust. A prepared organization is better placed to:

● protect people, by warning and responding early ● keep operating, by containing the incident and recovering quickly ● stay insurable, by showing insurers that the risk is managed, which affects cover, terms and premiums ● protect its reputation, by showing customers, staff, regulators and the public that it took reasonable steps

Boards already accept this logic for business continuity planning and disaster recovery. Those are funded for readiness, not for a return in a normal year. Security against rare, severe events deserves the same treatment.

In many places this is also a legal duty, and the legal test is not ROI. Australian work health and safety law requires risks to be controlled so far as is reasonably practicable. It weighs likelihood, harm, what is known and the controls available, and cost excuses inaction only when it is grossly disproportionate to the risk (Safe Work Australia). In the UK, Martyn's Law requires venues holding 800 or more people to document measures that reduce the risk of a terrorist attack (Mayer Brown). As detection technology becomes more available and affordable, what counts as reasonably practicable shifts with it.

Better measures

Security can be measured without pretending to know the counterfactual. The useful measures fall into six groups.

Detection and response can be tested directly. Staged intrusions, simulated weapons and walk tests produce evidence in weeks, without waiting years for a real incident. Testing should also count the costs, including false alerts that trigger an unnecessary response and the privacy obligations that come with any video system.

The last row is the important shift. Instead of asking whether security pays for itself, ask whether this is the most cost-effective way to reach a level of protection the organization has already decided it needs. That is how organizations already buy fire suppression, insurance and safety systems.