North America's grid security information-sharing centre logged more than 3,500 physical security incidents in 2025, according to the E-ISAC's end-of-year report. Three percent of them caused an operational disruption. The other 97%, more than 3,300 incidents, still each needed someone to decide whether it was worth sending a crew, calling the police, or doing nothing.
That decision is what substation video surveillance is for. Our pillar post on proactive and reactive surveillance describes proactive monitoring as a loop of detect, classify, verify, respond and resolve. At an unmanned site, the respond step starts as a decision made far away, and the video system exists to give that decision good evidence quickly.
Why Nobody on Site Changes the Problem
At a guarded warehouse or a staffed store, detection can trigger someone nearby. At a substation, a telecom tower or a pumping station there is nobody nearby. The nearest crew may be a long drive away, at night.
Our post on perimeter detection sets out the race between detection and response: the response has to arrive before the intruder finishes. At a remote unmanned site, that race usually can't be won by arrival. Someone stripping copper or cutting through a fence will often be gone before any vehicle gets there.
So the response path changes shape. It becomes two steps:
1. A remote decision. Someone in a control room looks at the site and decides what is happening and what it warrants.
2. A dispatch sized to that decision. A crew in the morning, a crew now, the police now, or nothing.
Proactive is the only mode here, because there is no one on site to be reactive with. But the thing it buys is a better decision, made in time to send the right response.
What the 15 Minutes in CIP-006 Is For
North American utilities have a written deadline for the first step. NERC CIP-006-6, requirement R1.5, says a utility must "issue an alarm or alert in response to detected unauthorized access" into a physical security perimeter to the people named in its incident response plan "within 15 minutes of detection."
Two details matter for the video system:
- It is an alert deadline. The standard puts a clock on getting the right people informed. It says nothing about anyone arriving.
- Its scope is narrow. It covers physical perimeters around high-impact systems, and medium-impact systems with external routable connectivity. The separate physical-security standard for transmission stations, CIP-014, doesn't apply below 200 kV, as ReliabilityFirst's substation security briefing notes. Many substations fall under neither.
So many unmanned sites have no regulatory clock at all, and the ones that do have a 15-minute window to inform people. Video either makes that window useful or wastes it. A raw alarm reaching a control room says that a door contact opened. A live view reaching the same room says who opened it, what they are doing, and whether anyone is in danger.
Triage at a Distance: The Job Substation Video Surveillance Does
The same ReliabilityFirst briefing describes the expected response: the control centre or security operations centre assesses rapidly, then notifies dispatch to contact law enforcement. That assessment is the step most unmanned-site video is not designed for.
The operator is sorting events into categories that need different responses:
What the operator is looking at | What it usually warrants | What the video must show to decide |
|---|---|---|
Animal, weather, debris, a sensor fault | Log it; no dispatch | A clear view of the alarm zone within seconds |
Vandalism or someone at the fence line, now gone | A crew in daylight; evidence preserved | Recorded footage of what happened, and a live view confirming the site now |
Theft in progress (cable, copper, equipment) | Police now; crew to follow | Number of people, vehicles, which part of the yard they are in |
A person inside an energised yard | Police and the utility's own operations, urgently | Exactly where the person is relative to live equipment |
The last row is about life, as well as assets. Substations are lethal to people who don't know what they are touching. In April 2023 two men died at a substation in Gainesville, Georgia, while trying to steal copper and electrical components, CBS News reported from the police account. A control room that can see where an intruder is standing can tell responders what they are walking into.
The volume makes the sorting the main cost. Reporting also varies: the WECC's 2025 security review counted 220 physical security incidents reported on the federal DOE-417 form in the Western Interconnection in 2024, up from 107 in 2023, and attributes much of the rise to minor incidents reported by a single entity. Either way, most events are minor, and each one costs an operator's attention. Video that lets the operator dismiss the minor ones in seconds is what keeps the control room able to act on the serious ones.
What Substation Video Surveillance Has to Survive
Unmanned sites have the worst conditions for live video: thin backhaul, no local IT staff, darkness, and weather. A design that ignores them produces a control room that receives alarms and then waits for video that never loads.
The requirements follow from the triage job:
- A live substream that fits the link. Many remote sites connect over cellular or a narrow utility WAN. Across India, average upload speeds in late 2025 ranged from about 2.5 to 8.4 Mbps depending on the operator, per Opensignal's national figures, and remote locations sit below the average. A low-bitrate live view that opens instantly is worth more to triage than a full-resolution stream that buffers.
- Full-resolution recording kept on site. Record at full quality locally, send the live substream to the control room, and pull high-resolution clips only when an incident needs them.
- Camera control that responds. An operator triaging an event wants to pan, tilt and zoom to the alarm zone. Delay in that loop makes the camera overshoot, which is why steering a camera over the web is harder than streaming it.
- One control room, many sites. A utility's sites report into one place. Our post on connecting dozens of sites to one control room covers why that is an architecture problem more than a bandwidth one.
- The alarm and the view arrive together. The operator should never have to find the camera that matches an alarm. The alert should open the right live view, already pointed at the zone.
Latency matters, but in a specific way. A talk-down needs sub-second audio and video. Triage can tolerate a second or two of delay in the live view, but it can't tolerate the view taking 30 seconds to start, or a PTZ control loop so slow the operator can't frame the scene.
Evidence for Whoever Arrives Later
Because the dispatched response arrives after the event, the second job of the video is evidence. The crew needs to know what was damaged and where to look. The police need footage they can use. The utility needs a record for its incident report.
That means the recording has to survive the incident. Intruders who know where the recorder is can damage it, so footage should leave the site promptly once an event is confirmed, and the copy that matters should be held somewhere the intruder can't reach. Recording, export and retention belong in the response design from the start.
Where Video Doesn't Help
Video doesn't make the drive shorter. If the decision is right and the crew is still far away, the cable is still gone. What video changes is how many trucks roll for nothing, how quickly the right people learn about the serious events, and what they know when they arrive.
It is also easy to overbuild. If 97% of incidents cause no disruption, a small distribution site may not justify a live-monitored system at all. Recording with a daily review, or alarms with on-demand video, may be proportionate. The design question for each site is what decision someone needs to make about it, and how fast.
The Bottom Line
At an unmanned site nobody can intervene in the moment, so the first response is a decision made at a distance. Substation video surveillance earns its cost by making that decision fast and well: a live view that opens with the alarm, a camera the operator can steer, full-resolution evidence kept safe, and a control room that can dismiss the minor events quickly enough to act on the serious ones.
What's Next
Unmanned sites are permanent. The opposite problem is a site whose boundary changes as the work progresses. Next: watching a perimeter that moves every three months on a construction site.
Frequently Asked Questions
What is substation video surveillance used for?
It is mainly for remote triage. Nobody is on site and responders are far away, so video lets a control room operator decide whether an alarm is a false trip, vandalism, theft in progress or a person in danger, and send the right response. It also provides evidence for the crew and the police who arrive later.
How quickly must a utility respond to a substation intrusion?
For high-impact and some medium-impact systems in North America, NERC CIP-006-6 requires an alarm or alert to reach the people in the incident response plan within 15 minutes of detection. That is a deadline for informing people. It sets no arrival time, and many substations fall outside its scope.
Can you do a talk-down at an unmanned substation?
You can, but it isn't the core response. Talk-down needs sub-second audio and video and works best where a verbal warning is likely to end the event. At a remote substation the main job is deciding what to send, and that depends on a fast-opening live view and camera control more than on audio.
How much bandwidth does remote site video need?
Far less than full resolution. A low-bitrate live substream is enough for an operator to triage an event, while full-resolution video is recorded on site and retrieved when needed. Size the live stream to the worst link, because remote sites often run on cellular or narrow utility networks.
Should substation video be recorded on site or in the cloud?
Ideally both, in sequence. Record locally at full quality so nothing depends on the link, then move confirmed incident footage off site promptly so an intruder can't destroy it. Platforms such as Samvyo, based on SFU architecture, keep the media path and recording on infrastructure the operator controls, on premises or in its own cloud.
What does a control room need from unmanned site video?
An alert that opens the right live view, a camera it can steer without lag, a feed that loads over a thin link, and recorded evidence it can export. Samvyo is one option for the live delivery layer, carrying camera feeds to browser-based control rooms at sub-second latency while the operator keeps control of the media path.
