The Login Screen Is Part of the Job: Why CCTV Security Can't Be Bolted On Later

Ask most people what they remember about their CCTV installation and they'll mention the drilling, the cable run, or the app that never quite loads. The bit where someone set the camera password is usually a blur — often because it was typed once, written on a sticky note, and never looked at again. In 2026, that habit is harder to defend.

Since 29 April 2024, consumer connectable products sold in the UK have had to meet minimum security requirements under the Product Security and Telecommunications Infrastructure regime. That covers a lot of kit, including the kind of cameras, doorbells and recorders that end up in homes and small businesses. The rules are not a magical fix, and they do not mean every old camera in the country is suddenly illegal. But they do shift the conversation in a useful direction: security is part of the product, not a favour the installer does afterwards.

What the rules actually ask for

The UK requirements are refreshingly short. For relevant connectable products, manufacturers must not use universal default passwords. A device either has to have a unique password per unit or force the user to set one. Manufacturers also have to publish a way for security researchers to report problems — a vulnerability disclosure policy — and state a minimum security update support period. That last one is the bit people skim past. It is essentially a promise about how long the product will receive security fixes.

Notice what the law does not say. It does not send a van round to check your NVR every year. It places duties mainly on manufacturers, importers and distributors. If you are a homeowner who bought a compliant camera and left the password as 'admin', you have not committed a CCTV-specific offence. But you have undone a lot of the point. And if you are a business specifying consumer-grade kit, or an installer commissioning it, the practical risk still lands on your network.

The rules also do not apply retroactively to every camera already on a wall. A system installed before the regime came in is not automatically unlawful. It may still be a security problem, though, especially if it is running firmware from a manufacturer that stopped issuing updates years ago.

Where installed kits quietly fall short

The classic admin/admin login is the obvious example, but the problem is wider. A camera can be compliant at the point of sale and still end up poorly configured in the real world. Installers under time pressure reuse the same password across multiple jobs because it is easier to remember. Homeowners share the login with a neighbour who feeds the cat. A small shop keeps the default account active because the till manager knows it. None of this looks dramatic. It just means one leaked password can open more than one door.

Firmware is the other quiet failure. A camera bought in 2026 might have a five-year support period, or it might have eighteen months. If nobody notes the end date, the system drifts into the security equivalent of driving without an MOT. The app still works, the picture still looks fine, and nobody notices until something goes wrong.

The network side is often worse. A lot of cheap installations rely on UPnP or port forwarding to make remote viewing work, which can expose a camera directly to the internet. Sometimes the camera is on the same flat network as the office laptop, the smart speaker and the till. That is convenient for the person setting it up and less convenient for anyone who finds the camera login.

The router is part of the camera system

It is tempting to treat CCTV as a box of cameras and a recorder. In practice, the router is part of the system. If the camera can talk to the internet, the router decides how much it can say and who can answer.

For a home installation, the simplest upgrade is often a separate Wi-Fi network for cameras and doorbells. Most modern routers call this a guest network. It is not a perfect security boundary, but it keeps cameras away from phones and laptops. If the recorder can work without internet access, consider leaving it that way and using a local monitor or a VPN for remote viewing. Disable UPnP unless you genuinely need it. Do not port-forward a camera just because the app makes it easy.

For a business, the same idea scales up. Put cameras on their own VLAN or network segment. Allow only the traffic they need. Keep the recorder and camera firmware current. Change the router admin password from whatever it was when the broadband was installed. If remote access is required, use a VPN rather than exposing the NVR login page to the public internet.

A short commissioning checklist

None of this needs to be a fortnight-long project. At commissioning, create unique credentials for each device. Use a password manager rather than a notebook. If the system supports separate user accounts, give the homeowner or business owner their own login and keep the installer account separate. Disable unused services such as Telnet, SSH, UPnP or peer-to-peer cloud features if you are not using them.

Check the manufacturer's published support period and write down the end date. Put a reminder in the calendar a few months before it expires. Look for the vulnerability disclosure policy, even if you never expect to use it. It is a decent signal that the manufacturer has thought about security after the box was sealed.

Then record what you did. A simple handover sheet with the firmware version, support end date, network location and who holds the admin credentials is more useful than a vague promise that 'it's all set up'. Do not put passwords in plain text on the sheet. Point to the password manager or hand them over separately.

What to ask before the drill comes out

If you are buying or specifying a system in 2026, ask whether the product meets the UK's minimum-security requirements. Ask what the support period is. Ask whether the camera can run on a local network without a cloud account. Ask the installer how they will handle passwords and firmware updates. These are not awkward questions. They are the same sort of questions you would ask about a boiler or a burglar alarm.

For installers, the commercial argument is straightforward. Secure commissioning is part of a professional job, not an optional extra. Build it into the quote. Use unique credentials. Leave the customer with a system they can actually maintain. The alternative is a kit that looks finished on the outside and is held together with default logins on the inside.

The boring bit — the login screen, the firmware page, the router setting — is the bit that lasts. Cameras are supposed to make a place safer. It is worth making sure the way they are set up does not quietly do the opposite.