Unpatched cameras, unmanaged switches and unrestricted access to footage: for many multi-site organisations, CCTV remains one of the least-governed parts of the security estate. Premium food manufacturer Charlie Bigham’s is one example of a business that treated its camera network as a cyber risk in its own right — and moved it to the cloud as part of a wider push for Cyber Essentials Plus certification.
CCTV is often where physical and cyber risk collide: cameras and recorders are IT assets as much as security ones, yet they frequently sit outside the patch cycles, network segmentation and access governance applied to the rest of the estate. That was the situation facing Charlie Bigham’s when Mike Calverley joined as Head of IT in 2023, tasked with modernising systems and achieving Cyber Essentials Plus certification.
A key concern was an ageing, unpatched CCTV system spanning sites in London and Somerset. “Making Bigham’s safe was a key priority – and that meant rethinking everything, including CCTV,” says Calverley. With his cloud-first IT strategy, Calverley decided to look at video surveillance as a service (VSaaS) platforms. In the end, he chose SEiNG – a managed UK-hosted solution for any new or old CCTV camera.
Closing the gaps in CCTV security
The existing, decades-old surveillance system presented a range of operational and security risks. Outdated cameras and unmanaged switches created both cyber and infrastructure vulnerabilities, with unpatched components left exposed.
Access control was weak: footage could be viewed by anyone in the business, with no restricted permissions or governance. The system relied on on-premises servers requiring ongoing maintenance, pulling IT resources away from higher-value work, and was costly and difficult to scale, with limited vendor support and no clear accountability. Fragmented setups across the two sites made consistent visibility hard to achieve.
Unpatched cameras and switches are network-connected devices like any other on the estate. Left outside normal patch cycles and access controls, they can become a foothold for wider network compromise, not just a weak point in the footage itself. That risk built the case for a cloud-based alternative.
Choosing a managed cloud-first approach
SEiNG works with any ONVIF/RTSP camera and processes footage entirely in a UK cloud environment, removing the need for on-site NVRs. That eliminates a class of unpatched-hardware vulnerabilities, enables AI-analytics on existing camera hardware, and keeps footage within the UK for GDPR purposes.
The cloud-first architecture was the key differentiator for Calverley: “It enabled us to retire on-premise servers at both our Quarry site in Wells and Park Royal London – this supported our Cyber Essentials Plus objectives and modernised our CCTV platform.” Critically, it also allowed the business to retain existing cameras where possible, without limiting functionality — reducing upfront cost and e-waste.
Pricing was also an important consideration for the executive team. A monthly subscription with no upfront capital expenditure was easier to justify than the significant upfront costs and ongoing maintenance associated with an on-premises system. “When you start talking about a CCTV project, the reaction can cause a nervousness around costs, whereas this cloud solution allows us to pay for support and the software on a monthly subscription model,” Calverley explains.
Access control was another driver. The new system integrates with Microsoft 365 via Single Sign-On and two-factor authentication, automatically revoking access when staff leave, and provides granular role-based permissions so employees only see only the footage relevant to their roles. “For me, the big tick is the security side. It solves a problem that is a real threat to businesses in the 21st century: cybersecurity,” Calverley says.
SEiNG also delivers automatic upgrades and proactive monitoring as part of its managed service, reducing manual maintenance versus the previous reactive vendor relationship.
Deployment across sites
Given the age of the legacy system, SEiNG first audited existing cameras to establish what could be reused. “It was all straightforward – they mapped out where we had cameras and checked them, as we had some old ones we knew didn’t work. Made life very easy,” Calverley says.
The deployment uses a Red Hat–based, software-driven architecture avoiding additional on-site servers, with cameras connecting via a Secured By Design–accredited cloud gateway. A vendor-neutral approach meant cameras could be chosen per environment rather than tied to proprietary hardware — including ruggedised units for the effluent plant, and a mobile outdoor camera used to livestream a £3 million building extension at Wells to colleagues in London.
Business impact beyond security
Beyond compliance, the switch has changed how CCTV is used day to day at Charlie Bigham’s.
Food safety. In the veg-prep area, cameras now add oversight alongside metal detectors and weighing equipment. “Those cameras help us ensure procedures are being followed and they play an important role in adding to the quality of our food, even though we have other protection systems in place,” Calverley says.
Cross-site visibility. To share progress on the Wells extension with colleagues in London, Calverley set up a secure, view-only livestream. “We set up a weatherproof camera outside, and I streamed it in real-time to a screen in London. It brought people together as we’d joke about the builders having their cups of tea and we’d even see nature walking around the quarry.”
Workforce efficiency. Investigations no longer require staff to manually trawl through hours of footage; filters, notifications and trackable case management have shifted that work to the people who need it. “Now when we need to look at footage, HR or the security guard handles it – our Site Services Manager doesn’t have to trawl through CCTV anymore.”
Remote monitoring. Browser-based access with SSO lets staff securely view footage off-site — useful for the effluent plant team, whose previous cameras struggled with fumes until ruggedised units were installed. “We give the guys that work in the effluent plant access to their own video walls so they can see the cameras from home. That’s a big win again.”
The compliance payoff
Retiring the on-premises servers and closing off unrestricted access to footage directly supported Charlie Bigham’s Cyber Essentials Plus objectives — turning what had been an audit liability into a documented, access-controlled part of the IT estate. Calverley now treats SEiNG as a standard part of his cloud infrastructure portfolio alongside Microsoft Azure and Microsoft 365, rather than a separate physical-security system managed outside IT oversight: “I have a portfolio of top-tier products, and SEiNG is right up there with the best world-class applications and solutions,” he says.
For Charlie Bigham’s, the broader lesson is one increasingly relevant across manufacturing and other multi-site sectors: CCTV modernisation is no longer just a physical security decision. Bringing camera infrastructure under the same governance, access control and patching discipline as the rest of the network is becoming a prerequisite for certifications like Cyber Essentials Plus — and, in Calverley’s case, a source of operational value well beyond security itself, from food safety oversight to cross-site collaboration.
SEiNG: Cloud video surveillance
