What the standard says
Most camera systems record to a box in the office called a DVR or NVR (digital or network video recorder). When owners want to watch from their phones, the simplest setup is port forwarding: a rule on the office router that sends outside traffic straight to the recorder. That works, but it also puts the recorder’s login page on the internet for anyone to find. Search engines that catalog internet-connected devices can spot these systems, and their owners often don’t know they’re visible [1].
CISA’s Cross-Sector Cybersecurity Performance Goals, its baseline of common security practices, set three expectations that apply here [2]:
Nothing exploitable exposed. Devices on the public internet should expose no exploitable services, and anything that must be exposed needs extra protection [2].
No default passwords. Change the manufacturer’s default password on all hardware, software and firmware [2].
Fix known exploited flaws. Internet-facing systems should be patched for any flaw on CISA’s Known Exploited Vulnerabilities list, starting with the most critical [2].
CISA’s guide to getting devices off these search engines asks a simple question for each exposed system: can it sit behind a VPN instead? A VPN (virtual private network) is an encrypted connection that only approved users can open, and it removes the direct link between attackers and the device [1]. Many camera makers also offer a cloud app that connects the phone to the recorder without any open port. One maker, for example, says its service removes the need for manual port forwarding and router setup [3].
Firmware is the software built into the device itself. The FTC tells owners to change default passwords, check for firmware updates, and review camera access logs for unfamiliar logins, noting that many internet-connected cameras are open to snooping [4].
Updates only help while the maker still offers them. NIST expects connected devices to stay in service for years, sometimes decades, and asks makers to plan how long they can realistically support them [5]. NIST IR 8259 is written for device makers, not owners, but it explains why an older recorder can stop getting fixes while still working fine.
What you’ll hear
“Hackers are watching your cameras right now.”
There’s something to it. CISA warns that attackers look up default passwords online and test them against internet-exposed devices [6]. But a visible login page isn’t proof that anyone got in. The more likely risk is quieter: a recorder usually sits on the same office network as your computers, and the FTC notes that a device with out-of-date security can become a weak point on that network [4].
The fair version: an exposed recorder is an open door worth closing, not a sign that someone is already inside.
What the numbers say
We couldn’t find a reliable public statistic on how many small-business recorders are reachable from the internet, or how often they’re broken into. Instead, here are numbers from CISA’s own catalog:
1,734: entries in CISA’s Known Exploited Vulnerabilities catalog as of October 4, 2026 [7][8]. Every entry is a flaw with evidence of real-world attacks. CISA is a federal agency, and it urges every organization, not only government, to use the catalog to set priorities [7].
At least 17 of those entries involve security cameras, video recorders or video management software, from 11 different makers, added between 2021 and 2026 [8]. Many let an attacker run commands or skip the login entirely.
4 of those entries carry CISA’s warning that the product is, or could be, end-of-life, and tell owners to stop using it if no fix exists [8].
What we’ve seen
We haven’t run into this yet.
Putting it together
A recorder that’s reachable from the internet isn’t a crisis, but it is an easy target that’s usually easy to fix. Confirm whether anyone still needs direct access, move phone viewing to the maker’s app or a VPN, then close the port, change the default password and update the firmware. If the recorder no longer gets updates, plan to replace it.
What good looks like
No camera or recorder login reachable directly from the internet.
Remote viewing through the maker’s cloud app or a VPN.
Every default password changed, with a unique password per system.
Firmware up to date, with someone named to check for updates.
A recorder the maker still supports, with a replacement planned before support ends.
Cameras and recorders kept on their own network, separate from office computers where possible.
Access logs reviewed now and then for logins nobody recognizes.
Questions for your IT resource
Is there a port forwarding rule on our router that points to the camera recorder?
How do we view the cameras from our phones today, and could that work without an open port?
Has the recorder’s default password been changed, and who has the login?
When was the recorder’s firmware last updated?
Does the maker still support our recorder model, and until when?
Are the cameras on the same network as our office computers?
For your camera installer: does this system support the maker’s cloud app or a VPN for remote viewing?
Related learning
How do you keep a remote-access VPN safe?
A remote-access VPN lets staff reach the office network from anywhere, so it has to be reachable from the internet. That’s normal; what matters is keeping it updated, requiring MFA, and never putting remote desktop directly on the internet.
How we put together your Free Security Assessment
The Free Security Assessment is a review of what’s already public about your business: your email setup, domain, website, phone listings and anything left open to the internet. We make one ordinary visit to your home page and never scan, log into or test anything.
How to read your Free Security Assessment
Your Free Security Assessment starts with what’s working well, then lists each item worth confirming with how sure we are and how soon it’s worth handling. This page explains each part so you can read it on your own.
Related services
Sources
CISA, Get Your S.O.S. How-to Guide (Stuff Off Search), undated. (checked 2026-10-08)
CISA, Cross-Sector Cybersecurity Performance Goals, goals 1.E, 2.A and 2.W. (checked 2026-10-08)
Axis Communications, Axis Secure Remote Access, undated. (checked 2026-10-08)
Federal Trade Commission, Securing Your Internet-Connected Devices at Home, Consumer Advice, August 2022. (checked 2026-10-08)
NIST, IR 8259 Rev. 1, Foundational Cybersecurity Activities for IoT Product Manufacturers, April 2026. (checked 2026-10-08)
CISA, Secure by Design Alert: How Manufacturers Can Protect Customers by Eliminating Default Passwords, December 15, 2023. (checked 2026-10-08)
CISA, Reducing the Significant Risk of Known Exploited Vulnerabilities. (checked 2026-10-08)
CISA, Known Exploited Vulnerabilities Catalog data files, official mirror of the catalog, data as of October 4, 2026. (checked 2026-10-08)
How we rate these. Our judgment from real setups, applied the same way on every page. Cost: $ = no new spend or under $25/month · $$ = a modest monthly tool or a short project · $$$ = new hardware, licensing, or a larger project. Effort: Light = one sitting · Moderate = setup plus follow-up over days or weeks · Heavy = planning, testing and staff changes. Outlined marks show how far it can go for some businesses. N/A = doesn’t apply to this topic. Time to fix: how long the first useful step takes, then how long until it’s fully done. Ratings are typical averages, not quotes. Time to fix: the filled dot is when the first useful step lands, the hollow dot is when it’s fully done. Who can do it: highlighted chips are who can reasonably handle it.