CoreBastion Security Consulting // Research Intelligence
Video Analytics · Unified Ops · Posture Validation · Physical Security Market · 2026 Edition. 57 vendors tracked across five segments with current market intelligence through Q2 2026.
Market Structure
All 57 vendors map to one of five categories based on where they sit in the physical security stack. The first three segments cover detection and management. The fourth covers unified battlefield awareness across every sensor. The fifth covers posture validation and stress-testing of everything built.
Integrated hardware + software + AI. Full-stack vendors owning the camera, server, and analytics layer. Best for greenfield or single-vendor deployments.
Examples: Verkada, Avigilon, Genetec, Axis, Hanwha Vision, Hikvision, i-PRO, Milestone, Bosch, Cisco Meraki, Digital Watchdog, Brivo (merged Eagle Eye)
Camera-agnostic software overlay. No proprietary hardware. SaaS or cloud-native. Ideal for AI uplift on existing infrastructure without rip-and-replace.
Examples: Ambient AI, ZeroEyes, Hakimo, Scylla, Irisity, Actuate, BriefCam, Omnilert, Airship AI, Spot AI, Rhombus, Coram, IntelliSee, Veesion, Xtract One, Calipsa, Volt AI, Umbo CV, Deep Sentinel, Gorilla Technology, PureTech Systems, AMAROK/Evolon, Sentry AI
Foundational platforms, VMS marketplaces, and operational intelligence layers that analytics are built on or feed into. For integrators and large-enterprise custom builds.
Examples: Palantir, Hexagon AB, NVIDIA Metropolis, AWS Kinesis Video Streams, Milestone (VMS layer), Pelco, Alarm.com for Business, ExacqVision, Qognify, AxxonSoft
Every connected system becomes a sensor. VMS, access control, IDS, alarms, and environmental inputs feed a single AI reasoning layer. Paul's "Vision Ops" concept: holistic attack vector detection, not siloed alerts.
Examples: Genetec Mission Control, AlertEnterprise, SureView Immix, Everbridge, AxxonSoft, CNL Software IPSecurityCenter, Hakimo AI Operator
AI red team layer. Scores security posture, simulates component degradation, models failure scenarios, and produces defensible gap analysis. Stress-tests the full stack before an adversary does.
Examples: Mistabra (category creator), Picus Security, Cymulate, CISA SAFE, Mandiant Security Validation
Full Market Coverage
57 vendors mapped across segment, deployment model, core capabilities, target market, and key differentiator. Updated through Q2 2026.
| Vendor | Segment | Deploy Model | Core Capabilities | Target Market | Key Differentiator | Tags |
|---|---|---|---|---|---|---|
| Enterprise Platform (12) | ||||||
| Verkada | Enterprise Platform | Hybrid cloud | AI cameras, access control, NLP natural language search, environmental sensors, unified cloud console | Commercial enterprise, mid-market | Zero on-prem server; FedRAMP Moderate authorized May 2026 (DOE sponsor); fastest sales cycle in the market | FedRAMP 2026 |
| Avigilon (Motorola Solutions) | Enterprise Platform | Cloud, On-prem | Appearance search, unusual motion detection, LPR, Alta cloud platform, facial recognition | Enterprise, critical infrastructure, government | Appearance search across days of footage in seconds; Motorola radio and dispatch ecosystem integration | |
| Genetec | Enterprise Platform | Hybrid, On-prem, Cloud | KiwiVision privacy protection, Mission Control PSIM, Omnicast VMS, Synergis access control, AutoVu LPR, Security Center federation | Large enterprise, government, data centers | Strongest VMS ecosystem in North America; privacy-by-design; expanding into unified security operations platform | CoreBastion Preferred |
| Axis Communications | Enterprise Platform | Edge | Onboard ACAP edge analytics, object/people/vehicle detection, LPR, edge AI, thermal imaging | All segments | Open edge AI ecosystem with 1,000+ third-party ACAP apps; acquired FF Group 2026 expanding retail analytics | NDAA FF Group Acq. |
| Hanwha Vision | Enterprise Platform | Edge, Cloud | Object detection, LPR, crowd analytics, Wisenet AI cameras, Ambarella SoC edge processing | Enterprise, government | NDAA-compliant alternative to Chinese OEMs; Ambarella SoC partnership delivering 4x edge inference improvement | NDAA Ambarella 2026 |
| Hikvision | Enterprise Platform | Edge, On-prem | DeepinView AI cameras, behavioral analytics, facial recognition, LPR, thermal | Global enterprise, commercial | Largest global camera install base; lowest cost edge AI at scale; NDAA restricted for U.S. federal use | NDAA Restricted |
| i-PRO (Panasonic spinoff) | Enterprise Platform | Edge, Hybrid | AI open platform cameras, edge analytics, thermal, multi-sensor, NDAA-compliant hardware | Government, critical infrastructure, enterprise | NDAA-compliant Japanese alternative; open AI platform architecture; strong in government and critical infrastructure | NDAA Gov |
| Milestone Systems | Enterprise Platform | On-prem, Hybrid, Cloud | XProtect VMS, Hafnia VLM generative AI plug-in (NVIDIA partnership), open SDK, 10,000+ integrations | Large enterprise, critical infrastructure | Largest open VMS integration ecosystem; Hafnia VLM (2026) enables natural language video search across XProtect archive | Hafnia VLM 2026 |
| Bosch Security Systems | Enterprise Platform | Edge, On-prem | IVA Pro analytics, FLEXIDOME cameras, AI-based person and vehicle detection, deep-learning analytics | Enterprise, critical infrastructure, European government | Deep EU enterprise presence; long heritage in edge analytics; ONVIF compliance and open integration | |
| Cisco Meraki MV | Enterprise Platform | Cloud | Edge AI processing, object detection for people and vehicles, motion metadata, Meraki dashboard integration | Enterprise, multi-site commercial | Native integration with Meraki network stack (Wi-Fi, switches, SD-WAN); unified IT and physical security management | |
| Digital Watchdog (DW) | Enterprise Platform | On-prem, Hybrid | DW Spectrum VMS, MEGApix AI cameras, LPR, analytics, edge processing | Commercial enterprise, mid-market | Strong North American mid-market presence; competitive on total cost of ownership | |
| Brivo (merged Eagle Eye Networks) | Enterprise Platform | Cloud-native | Brivo Security Suite: AI, access control, cloud video surveillance, visitor management, intrusion; Brivo Genius Mobile Agent natural language emergency response | Commercial real estate, multifamily, enterprise | Merged December 2026 to form world's largest AI cloud-native physical security company; 1B+ sq ft secured across 80 countries | Merger Dec 2025 |
| Pure-Play AI (23) | ||||||
| Ambient AI | Pure-Play AI | Cloud, Hybrid | Pulsar VLM: vision-language model with 150+ threat signatures, four-step reasoning trace, false alarm reduction, agentic physical security platform; Securitas Technology global reseller | Fortune 100, data centers, critical infrastructure, hyperscale | Category leader in agentic physical security; FY26 ARR doubled with 140%+ NRR; Pulsar VLM GA November 19, 2025; Securitas global reseller agreement closes enterprise distribution gap | CoreBastion Preferred Pulsar VLM GA |
| ZeroEyes | Pure-Play AI | Cloud | AI gun detection on existing cameras; human verification by trained military veterans before dispatch; multi-threat platform expansion (knives, aggressive behavior) | Schools, government, healthcare, corporate campus | DHS SAFETY Act Full Designation; human-in-the-loop verification reduces false dispatch; only gun detection vendor with that designation | CoreBastion Preferred SAFETY Act |
| Hakimo | Pure-Play AI | Cloud, SaaS | AI Operator: autonomous alarm handling for access control and camera queues; triages and resolves low-risk alarms without human intervention; escalates confirmed events | Data centers, enterprise, GSOC operations | Directly addresses GSOC alert fatigue; $20.5M raised; integrates with Genetec, Lenel, and major ACS platforms; CoreBastion preferred for GSOC-scale alarm management | CoreBastion Preferred |
| Scylla AI | Pure-Play AI | Edge, Cloud | Real-time threat detection: weapons, fight detection, person of interest, perimeter intrusion, crowd analytics; runs on existing cameras | Transportation, government, enterprise | Strong multi-threat detection breadth; camera-agnostic; growing transportation sector deployments | |
| Irisity | Pure-Play AI | On-prem, Cloud, Hybrid | IRIS+ Enterprise: perimeter protection, virtual perimeter, loitering vehicle detection, forensic video search, crowd density up to 50,000 people; built-in anonymization | Airports, critical infrastructure, government, smart city | April 2026: major U.S. airport contract for 1,000 IRIS+ Enterprise AI channels; listed on Nasdaq First North; globally trusted at 3,000+ locations | Airport Contract 2026 |
| Actuate (formerly Aegis AI) | Pure-Play AI | Cloud, Edge | Weapon detection, intrusion detection, tailgating, perimeter analytics on existing cameras | Enterprise, government, education | Camera-agnostic; rapid deployment without hardware replacement; growing government sector presence | |
| BriefCam (Canon) | Pure-Play AI | On-prem, Cloud | Video synopsis, forensic video search, appearance search, facial recognition, crowd analytics | Law enforcement, government, large enterprise | Fastest forensic video search in the market; hours of footage reviewed in minutes; acquired by Canon; strong law enforcement deployment base | |
| Omnilert | Pure-Play AI | Cloud | AI gun detection, emergency mass notification integration, weapon detection on existing cameras | Schools, higher education, healthcare, corporate | DHS SAFETY Act Full Designation (2026); integrated gun detection plus emergency notification in a single workflow | SAFETY Act Full Desig. 2026 |
| Airship AI | Pure-Play AI | Edge, Cloud, On-prem | Outpost AI: edge video analytics, multi-sensor integration, real-time threat alerting; Acuity: data management platform for law enforcement | Law enforcement, government, border security, defense | Edge-first architecture for low-bandwidth and disconnected environments; strong DoD and DHS customer base | Gov / DoD |
| IntelliSee | Pure-Play AI | Cloud, Edge | 11+ detection types: weapons, falls, trespassing, loitering, unauthorized vehicles, crowd formation, slip and fall; overlays on existing cameras | Healthcare, manufacturing, retail, enterprise | Broadest detection type library in the pure-play segment; avoids platform lock-in by working on customer's existing infrastructure | Added Q2 2026 |
| Spot AI | Pure-Play AI | Hybrid (IVR edge) | Intelligent Video Recorder edge device; natural language video search; AI alerts; SOC 2 Type II certified; operational analytics | Retail, logistics, manufacturing, enterprise | On-site IVR minimizes cloud bandwidth; natural language search across camera archives; strong retail and logistics vertical | |
| Rhombus Systems | Pure-Play AI | Cloud | Cloud-managed video, access control, environmental sensors, AI analytics, NLP search via LLM integration, customizable operational analytics | Commercial enterprise, education, multi-site | Honeywell partnership 2026 expands enterprise reach; cloud-first with strong UX; Honeywell distribution accelerates enterprise sales | Honeywell Partner 2026 |
| Coram | Pure-Play AI | Cloud | Open platform cloud VMS; works with any IP camera; AI analytics; no hardware replacement required; Fortune 500 and local business deployments | Commercial, mid-market, enterprise | Zero rip-and-replace; broadest IP camera compatibility in the cloud segment; strong cost-of-migration advantage | |
| Veesion | Pure-Play AI | Edge, Cloud | Gesture recognition AI for shoplifting detection; real-time alerts to loss prevention; integrates with existing cameras | Retail, grocery, pharmacy | Purpose-built for retail loss prevention; gesture-based detection (not just object recognition) reduces false positives in retail environments | |
| Xtract One (formerly Patriot One) | Pure-Play AI | Edge | Frictionless weapons screening; radar and sensor fusion for concealed weapon detection without walk-through metal detectors; ingests at venue throughput rates | Venues, stadiums, arenas, transportation hubs | Eliminating the security checkpoint bottleneck; frictionless screening at full crowd throughput rates; strong venue and stadium deployments | |
| Calipsa (Motorola Solutions) | Pure-Play AI | Cloud | False alarm reduction for remote video monitoring; AI pre-screens camera alerts before human review; integrates with monitoring station workflows | Remote video monitoring centers, alarm receiving centers | Acquired by Motorola Solutions; reduces monitoring center false alarm cost by 80%+; now integrated into Motorola unified stack | Acquired: Motorola |
| Volt AI | Pure-Play AI | Cloud | Automated security monitoring, behavioral analytics, perimeter protection, real-time alerts; connects to existing camera infrastructure | Commercial, enterprise, critical infrastructure | Proactive threat identification focus; emerging player with growing enterprise reference list | |
| Umbo CV | Pure-Play AI | Cloud, Edge | Autonomous video monitoring with AI triage; real-time detection and human escalation for verified events; integrates with monitoring stations | Logistics, commercial real estate, remote sites | Fully autonomous monitoring workflow; designed for unstaffed or minimally staffed sites | |
| Deep Sentinel | Pure-Play AI | Cloud | AI + live human guard hybrid; AI flags events, live guards verify and intervene verbally in real time via cameras and two-way audio | Commercial property, construction sites, high-crime risk sites | Human intervention before police dispatch; documented deterrence effectiveness through verbal challenge | |
| PureTech Systems | Pure-Play AI | On-prem, Hybrid | Geospatial video analytics for critical infrastructure; perimeter protection for substations, oil and gas terminals, water treatment; GIS-based threat visualization | Utilities, substations, oil and gas, water treatment, CNI | Narrowest and deepest focus in the market: geospatial critical infrastructure perimeter analytics; used where GPS-referenced threat visualization is required | Added Q2 2026 CNI Specialist |
| Gorilla Technology | Pure-Play AI | Edge, Cloud, On-prem | Video intelligence platform: facial recognition up to 100,000 biometric profiles, LPR, behavior analytics, AI investigator for post-event forensic search | Smart city, government, enterprise | Strong APAC smart-city footprint; security convergence blending physical and digital; post-event AI investigator for rapid crime-solving | |
| AMAROK / Evolon Technology | Pure-Play AI | Edge, Cloud | AI-powered video monitoring for perimeter security; electric fence integration; remote video verification; Evolon AI analytics (AMAROK 45% investment stake) | Commercial, industrial, logistics, distribution | Perimeter security-as-a-service model; electric fence plus AI monitoring combined; AMAROK strategic investment in Evolon closes the analytics gap | AMAROK/Evolon 2026 |
| Sentry AI | Pure-Play AI | Cloud | AI-powered remote guarding and video monitoring; behavioral analytics; real-time alert escalation; integrates with existing cameras | Commercial, retail, logistics | Remote guarding augmentation; emerging competitor to Hakimo and Deep Sentinel in the autonomous monitoring segment | Added Q2 2026 |
| Infrastructure / Decision Layer (10) | ||||||
| Palantir Technologies | Infrastructure | On-prem, Cloud, Classified | Data fusion across physical, cyber, and operational domains; AIP (AI Platform) for enterprise AI ops; used in defense, law enforcement, and critical infrastructure | Government, defense, large enterprise, CNI | The most powerful decision intelligence platform in existence; few security organizations can operationalize it; highest complexity and cost in the market | Gov / Defense |
| Hexagon AB | Infrastructure | On-prem, Cloud | HxGN OnCall for public safety; GIS-integrated situational awareness; sensor fusion across physical and digital systems; smart facility management | Government, smart city, utilities, enterprise | GIS-native situational awareness; strongest geospatial integration in the commercial security market | |
| NVIDIA Metropolis | Infrastructure | Edge, Cloud | AI video analytics development platform; VIT foundation models; TAO Toolkit for custom model training; Jetson edge AI hardware; Holoscan sensor processing | Platform: ISVs, integrators, OEMs, enterprise | The AI silicon and software foundation that most commercial security analytics run on; not a camera or VMS vendor but powers the ecosystem | |
| AWS Kinesis Video Streams | Infrastructure | Cloud | Video ingestion and processing infrastructure; Rekognition Video AI APIs; scalable storage and analytics pipeline; used as OEM foundation by multiple security vendors | Platform for security software builders; large enterprise self-build | Scales to unlimited camera count; used as hidden infrastructure by many branded security platforms | |
| Milestone Systems (VMS layer) | Infrastructure | On-prem, Hybrid | XProtect as open analytics marketplace; MIP SDK for deep third-party integration; ecosystem of 10,000+ integrations across analytics, access control, sensors | System integrators, enterprise, government | The open VMS most commonly used as the integration platform for third-party AI analytics overlays | |
| Qognify | Infrastructure | On-prem, Hybrid | Cayuga VMS, Situator PSIM; large-scale video management and incident correlation; used at transportation and government installations | Transportation, government, large enterprise | PSIM-integrated VMS; strong in transit and government where multi-system correlation is a baseline requirement | |
| Pelco | Infrastructure | On-prem, Hybrid | VideoXpert VMS, Sarix cameras; open platform; analytics integration marketplace; government and infrastructure specification history | Government, utilities, critical infrastructure | Long specification history in U.S. government and critical infrastructure; open platform enables broad analytics integration | Gov Heritage |
| ExacqVision (Johnson Controls) | Infrastructure | On-prem, Hybrid | Open VMS platform; broad IP camera compatibility; integration with access control and building management; enterprise and government | Enterprise, government, healthcare | Johnson Controls integration gives access to full building management and access control ecosystem; competitive cost of ownership | |
| AxxonSoft | Infrastructure | On-prem, Edge | AxxonNext VMS; AI analytics integration; multi-site management; PSIM capabilities; open SDK | Government, enterprise, smart city | Strong international presence; competitive cost; open architecture supports broad third-party integration | |
| Alarm.com for Business | Infrastructure | Cloud | Cloud-managed video, access control, intrusion, environmental monitoring; unified dealer-delivered platform; AI analytics integration | SMB, mid-market commercial, dealer channel | Largest dealer-delivered cloud security platform; strong SMB to mid-market commercial reach via integrator network | |
| Unified Ops / PSIM — Vision Ops (7) | ||||||
| Genetec Mission Control | Unified Ops / PSIM | On-prem, Hybrid | Procedure-driven incident management; automated task assignment; escalation timers; unified alarm and video correlation; audit trail and chain of custody | Large enterprise, data centers, government | Native integration with Genetec Security Center; no middleware required; CoreBastion preferred incident management for Genetec deployments | CoreBastion Preferred |
| Hakimo AI Operator | Unified Ops / PSIM | Cloud, SaaS | Autonomous AI alarm handling across access control and camera queues; learns normal patterns; triages alerts; routes verified events to human operators | Data centers, enterprise, GSOC | Directly reduces GSOC headcount requirement; $20.5M raised; proven in multi-site data center deployments | CoreBastion Preferred |
| AlertEnterprise | Unified Ops / PSIM | Cloud, SaaS | Cyber-physical identity convergence; access control meets cyber security; insider threat detection across IT and OT systems; identity governance integration | Critical infrastructure, utilities, enterprise, government | Bridges the physical-cyber identity gap; alerts on access anomalies that cross both domains simultaneously | CNI |
| SureView Immix | Unified Ops / PSIM | On-prem, Cloud | Remote monitoring center platform; alarm management; multi-site VMS aggregation; operator workflow and escalation tools | Remote video monitoring centers, enterprise SOC | Purpose-built for remote monitoring operations; integrates with virtually all major VMS and alarm platforms | |
| Everbridge | Unified Ops / PSIM | Cloud, SaaS | Mass notification, critical event management, threat intelligence, incident response coordination; integrates with physical security systems for unified response | Enterprise, government, healthcare, critical infrastructure | Links physical security incident detection to enterprise-wide emergency communication and response orchestration | |
| CNL Software (IPSecurityCenter) | Unified Ops / PSIM | On-prem, Hybrid | Open PSIM platform; broadest legacy system integration library; correlates video, access, PIDS, fire, and building management under one operator interface | Airports, utilities, government campuses, multi-system environments | Strongest legacy integration library in the PSIM category; handles old and new systems in the same interface | |
| AxxonSoft (Unified Ops) | Unified Ops / PSIM | On-prem, Hybrid | AxxonNext PSIM capabilities; multi-sensor correlation; event-driven automation; integration with access control, fire, and perimeter systems | Government, enterprise, smart city, industrial | Cost-effective PSIM alternative for international and emerging market deployments where Genetec or CNL are cost-prohibitive | |
| Security Posture Validation (5) — Category Created 2025 | ||||||
| Mistabra | Posture Validation | Confidential Preview | Physical security posture validation platform; turns readiness into measurable, auditable, defensible evidence; simulates component degradation and failure scenarios; produces gap analysis for boards and auditors | Data centers, critical infrastructure, enterprise, government | Category creator for physical security posture validation; the first platform purpose-built to stress-test a physical security program the way a red team tests a cyber program; in confidential preview (mistabra.com) | Category Creator CoreBastion Advisory Board |
| Picus Security | Posture Validation | Cloud, SaaS | Continuous security validation; breach and attack simulation; control effectiveness scoring; MITRE ATT&CK mapped threat simulations | Enterprise, government (cyber-physical convergence layer) | Continuous automated red-teaming of security controls; relevant at the cyber-physical convergence boundary where access control and network security overlap | |
| Cymulate | Posture Validation | Cloud, SaaS | Extended security posture management; attack surface management; breach and attack simulation; exposure analytics; risk scoring | Enterprise, financial services, government | Broadest attack surface coverage in the BAS category; relevant for organizations with converged physical and cyber security programs | |
| Mandiant Security Validation (Google Cloud) | Posture Validation | Cloud, On-prem | Control effectiveness validation using real-world threat intelligence; MITRE ATT&CK emulated attacks; Advanced Environmental Drift Analysis; continuous posture monitoring | Enterprise, government, critical infrastructure | Backed by Mandiant frontline threat intelligence from active incident response; highest-fidelity threat emulation in the commercial market | Gov / CNI |
| CISA SAFE | Posture Validation | Government program | CISA Security Assessment Framework for Enterprise; free federal security posture assessment program for critical infrastructure operators; gap analysis against NIST CSF and sector-specific standards | Critical infrastructure operators, federal agencies | Free federal program; no-cost posture assessment for qualifying CNI operators; direct access to CISA threat intelligence and sector specialists | Federal Program |
Vendor Deep Dive
The most consequential product launch in physical security AI in 2025. General availability November 19, 2025.
Pulsar VLM is not an analytics overlay. It is a reasoning system trained specifically on physical security threat signatures across 150+ threat categories. Where legacy video analytics detect an object class ("person detected"), Pulsar reasons about the scene: who is present, what they are doing, whether the behavior is anomalous relative to the location and time context, and what threat category applies if any. The output is not a pixel-match alarm. It is a contextualized threat assessment with a four-step reasoning trace the operator can review.
Scene ingestion across all connected camera feeds simultaneously. Raw visual data converted to semantic tokens.
VLM reasoning about what is happening in the scene. Objects, actors, relationships, and temporal context evaluated together.
Threat classification against 150+ signature library. Anomaly scoring relative to learned baseline for that camera location and time of day.
Verified threat routed to operator with full reasoning trace. False positives eliminated before human review. SOC queue receives only confirmed events.
ARR doubled in FY26 with 140%+ net revenue retention — meaning existing customers are expanding deployments faster than Ambient is adding new logos. That metric is the strongest signal of product-market fit in the enterprise SaaS market.
Securitas Technology global reseller agreement closes the distribution gap that kept Ambient a known quantity among practitioners but limited in field sales reach. Securitas has the integrator relationships, the service contracts, and the enterprise security account footprint to carry Pulsar into large-enterprise accounts that Ambient's direct team cannot reach cost-effectively.
CoreBastion assessment: Ambient AI is the preferred AI analytics platform for data center and CNI physical security programs at scale. The VLM approach is structurally superior to rule-based analytics for high-camera-count perimeter and interior monitoring. The Securitas partnership de-risks the integration and support question that previously prevented some enterprise procurement teams from moving forward.
Architecture
Physical security AI does not live in a single product. It operates across six functional layers from edge sensor to posture validation. Understanding which layer a vendor occupies determines whether it competes with or complements your existing stack.
Market Intelligence
Significant vendor developments, acquisitions, product launches, and market movements tracked through Q2 2026.