Security Challenges and Mitigation Strategies in IoT-Enabled Video Surveillance Systems: A Systematic Review

Abstract

The rapid deployment of Internet of Things (IoT)-enabled video surveillance systems has expanded the capabilities of real-time monitoring in smart cities, healthcare facilities, industrial environments and critical infrastructure. However, integrating resource-constrained cameras, heterogeneous communication protocols, edge/cloud analytics, and sensitive video data creates a complex cybersecurity landscape. This systematic review synthesizes recent evidence on security challenges and mitigation strategies in IoT-enabled video surveillance systems. Following the PRISMA 2020 guidelines, four bibliographic databases (Scopus, IEEE Xplore, Web of Science, and Google Scholar) were searched for peer-reviewed journal articles and conference papers published between January 2021 and July 2025. After duplicate removal, title/abstract screening, full-text assessment, and quality appraisal, 21 studies were included for qualitative synthesis. The findings show that vulnerabilities occur across three interdependent architectural layers: device/perception, network/communication, and application/cloud. The frequently reported weaknesses were default credentials, insecure firmware, unencrypted video streams, weak protocol configuration, metadata leakage, and inadequate cloud access control. Existing mitigation strategies, including multi-factor authentication, role-based access control, TLS/DTLS, lightweight encryption, intrusion detection systems, and secure boot, provide partial protection but remain constrained by latency, computational overhead, energy consumption, scalability, cost and legacy device compatibility. This review further identifies a persistent research–practice gap: only a small subset of studies provides evidence of real-world deployments, while most solutions remain evaluated in simulations, testbeds, or conceptual frameworks. This review contributes a domain-specific taxonomy of IoT video surveillance security, a comparative evaluation of mitigation strategies using technical, operational, and economic criteria, and deployment-oriented recommendations for smart city, industrial, healthcare, residential, and critical infrastructure settings. The study highlights the need for cross-layer security architectures, lightweight and post-quantum-ready cryptography, privacy preservation, edge AI, federated learning, zero-trust access control, and standardized security baselines.

1. Introduction

IoT-enabled video surveillance systems combine IP cameras, embedded sensors, edge processors, cloud services, and analytics platforms to support continuous monitoring and automated decision-making [1]. These systems are increasingly deployed in smart cities, industrial facilities, and critical infrastructure sectors [2]. Their value lies in scalable monitoring, real-time event detection, automated alerts, remote access, and integration with broader cyber–physical systems.

The same characteristics that make IoT-enabled video surveillance operationally attractive also create significant cybersecurity risks. Video surveillance systems collect sensitive visual, biometric, behavioral, and location-related data. They are frequently deployed in distributed and physically exposed environments, often using low-cost devices with limited processing capacity and weak default configurations, delayed patching, and heterogeneous communication protocols. As a result, adversaries can exploit weaknesses in devices, networks, cloud services, and management interfaces to intercept video streams, manipulate footage, enroll devices into botnets, disrupt availability, and tamper with forensic evidence.

According to recent market analysis, the global IoT video surveillance systems industry is projected to grow at a Compound Annual Growth Rate (CAGR) of 14.8% from 2023 to 2030, driven by increasing security concerns and advancements in AI-powered surveillance [3]. However, their widespread adoption has introduced significant challenges, as attackers exploit vulnerabilities in IoT devices, communication protocols, and cloud infrastructures [4]. The expanding attack surface of IoT-based video surveillance systems, exacerbated by weak authentication, unencrypted communications, and firmware vulnerabilities, has made them prime targets for cyberattacks, including ransomware, botnet recruitment, and deepfake injection attacks [4,5].

Despite growing academic interest in IoT security, existing research remains fragmented. While individual studies address specific vulnerabilities, such as cryptographic weaknesses, protocol exploits, or cloud misconfigurations, there is limited synthesis examining the effectiveness of integrated defense strategies across the entire system lifecycle. Furthermore, the rapidly evolving threat landscape, characterized by sophisticated attack vectors including deepfake injection, AI-powered reconnaissance, and zero-day exploits, demands continuous reassessment of existing security paradigms. This gap is particularly concerning given the critical nature of surveillance data and the contexts in which these systems are deployed.

Several surveys have examined aspects of IoT security in recent years. Ref. [6] provided a broad overview of IoT security challenges across domains, while [7] focused specifically on authentication mechanisms for IoT devices in smart cities. Ref. [8] examined general IoT security countermeasures, while [9,10] surveyed security challenges in cloud-based SCADA systems. However, these reviews either predate the significant security incidents of 2021–2023 or do not specifically address the unique challenges of video surveillance systems, which involve continuous high-bandwidth data streams, real-time processing requirements, and stringent privacy regulations. More specifically, while [5] reviewed attacks on video surveillance systems, their work focused primarily on attack taxonomies rather than on a systematic evaluation of mitigation effectiveness. Similarly, although [11] examined IoT exploitation techniques, their scope was limited to air-gapped networks and did not address the broader ecosystem of cloud-connected surveillance infrastructure. To the best of our knowledge, no recent systematic review has thoroughly evaluated the security landscape of IoT-enabled video surveillance systems. The existing research tends to focus on individual layers, such as devices, networks, or clouds, rather than offering a comprehensive perspective. Moreover, few studies have assessed both the technical efficacy and practical deployability of the proposed solutions in the post-pandemic context, 2021–2025.

Following the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) guidelines [11], we analyzed 21 peer-reviewed studies and Conference papers published between 2021 and 2025. This timeframe captures the latest advancements in IoT security technologies, emerging threat vectors, and evolving regulatory landscapes. Our qualitative content analysis synthesizes findings across three critical dimensions: technical vulnerabilities, mitigation effectiveness, and implementation challenges.

Our review distinguishes itself through the following:

• Domain Specificity: Unlike general IoT security surveys, we focus exclusively on video surveillance systems, enabling deeper analysis of domain-specific challenges, including video stream encryption overhead, real-time anomaly detection in visual data, and surveillance-specific regulatory compliance.
• Temporal Relevance: By examining studies from 2021 to 2025, we capture the evolving threat landscape, including emerging attacks (deepfake injection, AI-powered reconnaissance) and recent regulatory developments (updated GDPR enforcement, CCPA expansion).
• Multi-Dimensional Assessment: We evaluate solutions across technical, practical, and economic dimensions, explicitly addressing the research-to-practice gap that previous surveys have not systematically examined.
• Actionable Framework: We provide a structured evaluation framework and deployment recommendations tailored to different organizational contexts, moving beyond descriptive analysis to prescriptive guidance.

This systematic review, therefore, makes four distinct contributions to the body of knowledge on IoT video surveillance security:

• Domain-specific SLR: Unlike prior general IoT security surveys, this review focuses exclusively on IoT-enabled video surveillance systems (2021–2025), enabling deeper analysis and domain-specific challenges, including video stream encryption overhead, real-time detection, and surveillance.
• Systematic security framework applicability assessment: A comprehensive comparative evaluation of the major frameworks (NST CSF, ISO/IEC 27001, NIST IR 8259A, ENISA IoT, GDPR Art. 35) against the unique constraints of IoT-VSS environments, revealing critical gaps in domain specific that prior review has not addressed.
• Three-dimensional evaluation framework: A novel assessment framework evaluating mitigation strategies across technical efficacy, practical deplorability, and economic viability simultaneously, moving beyond the purely technical analyses that dominate existing literature.
• Context-stratified deployment recommendations: Actionable security guidance tailored to distinct deployment contexts (e.g., Smart cities, Border security surveillance, industrial IoT, Healthcare, and Critical infrastructure) and a prioritized research agenda for cross-layer security architectures.

This systematic review addresses the following research questions:

• RQ1: What are the principal findings of recent research on the implementation and deployment of IoT-based video surveillance systems?
• RQ2: What are the primary security challenges and vulnerabilities associated with IoT-based video surveillance systems across device, network, and cloud layers?
• RQ3: What security frameworks, standards, and best practices are currently available to enhance the cybersecurity posture of video surveillance systems?
• RQ4: How effective are existing mitigation strategies in improving resilience and reliability of IoT-based video surveillance systems against contemporary and emerging cyber threats?

First, we develop a three-dimensional evaluation framework that assesses security solutions across technical efficacy, practical deplorability, and economic viability, moving beyond purely theoretical analysis to examine real-world implementation barriers. Second, we systematically characterize the gap between academic proposals and industrial adoption, identifying specific factors that hinder the translation of research into practice. This includes resource constraints, legacy system integration challenges, and regulatory compliance issues. Third, we synthesize actionable recommendations organized by deployment context (smart cities, healthcare, industrial IoT) and provide a prioritized research agenda addressing critical gaps in lightweight cryptography, AI-driven anomaly detection, and cross-layered security architectures. The remainder of this article is structured as follows: Section 2 reviews the literature on challenges and solutions for securing IoT-enabled video surveillance systems. Section 3 outlines the methods and procedures used in this study; the search strategy, online resources, selected articles, data collection techniques, and evaluation methods are described in detail. Section 4 presents the findings, while Section 5 provides a discussion.

2. Related Work

Several recent reviews provide useful foundations but do not fully address the security needs for IoT-enabled video surveillance systems. General IoT security surveys identify resources constraints, weak authentication, insecure communication and lack of standardization as recurring problems, but they typically treat video surveillance as one application among many [8]. A smaller body of work focuses specifically on attacks against video surveillance systems. These studies are valuable for identifying threat categories such as video-feed spoofing, unauthorized access, firmware manipulation, and Denial of Service attacks. They often emphasize attack taxonomies rather than systematic evaluation of mitigation feasibility [4,5]. Table 1 summarizes the positioning of this review relative to closely related reviews.

Table 1. The positioning of this review against related reviews.

Review Focus	Typical Scope	Main Contribution	Limitation Addressed by This Review
General IoT security surveys	Broad IoT environments	Identify common IoT vulnerabilities	Lacks video surveillance specific analysis
Smart-city authentication reviews	Identity and access control	Compare authentication mechanisms	Limited coverage of video integrity, latency, and cloud analytics
Cloud/SCADA security reviews	Industrial and Cloud control systems	Analyze industrial cyber-physical risks	Limited treatment of visual data and surveillance privacy
Video surveillance attack reviews	Attacks on surveillance systems	Classify attack vectors	Limited assessment of mitigation deployability
Present review	IoT-enabled video surveillance systems	Taxonomy, mitigation, comparison, and deployment guidance	Integrates threat, control, framework and deployment perspectives

2.1. System Architecture and Security Taxonomy

IoT-enabled video surveillance systems can be understood as a layered cyber–physical architecture comprising device/perception, network/communication, and application/cloud layers as illustrated in Figure 1. According to [12], the architecture of Internet of Things (IoT)-based video surveillance systems is conventionally organized into three distinct layers.

Figure 1. IoT-based video surveillance system architecture layout.

2.2. Security Challenges in IoT-Based Video Surveillance Systems

IoT-based video surveillance systems (IoT-VSS), as shown in Table 2 [4,6,12,13,14], face significant security challenges owing to their inherent vulnerabilities, including weak authentication mechanisms, unencrypted data transmissions, insecure firmware, and susceptibility to malware attacks [14]. These systems are often targeted by cybercriminals for ransomware attacks, botnet recruitment (e.g., Mirai variants), Mirai variants, and man-in-the-middle (MitM) attacks, which can compromise video integrity and system availability [2]. Existing mitigation strategies include cryptographic protocols for secure communication, like Transport Layer Security (TLS)/Datagram Transport Layer Security (DTLS), Multi-Factor Authentication (MFA), AI-driven anomaly detection, and blockchain-based integrity verification [1,8]. However, the evolving threat landscape demands continuous advancement in zero-trust architectures and automated patch management to safeguard IoT-based video surveillance systems against emerging cyber threats [15].

Table 2. Taxonomy of threats, attack models, and defenses in IoT-enabled surveillance systems video [4,6,12,13,14].

Layer	Assets	Main Vulnerabilities	Attack Models	Representative Defenses
Perception layer	IP Cameras, Sensors, NVR/DVR, Azure IoT Edge (TensorFlow and DeepStack)	Default credentials, insecure firmware, exposed debug ports, weak secure boot, physical tempering	Unauthorized access, malware injection, botnet enrolment firmware replacement, side-channel attack	MFA, unique credentials, signed firmware, secure boot, TPM/TEE, tamper detector
Network layer	MQTT, APIs	Unencrypted streams, weak protocol configuration, poor certificate management, exposed services.	Eavesdropping, MITM, replay, spoofing, jamming, command injection	TLS/DTLS, VPN/Segmentation, certificate rotation, SDN Policy
Application/Cloud	Cloud storage, analytics, dashboards, mobile applications	Weak API security, excessive privileges, metadata leakage, insecure storage, poor logging	Data breach, privilege escalation, video tampering, metadata inference, ransomware	RBAC/ABAC, zero trust, encryption at rest, audit logging, privacy impact assessment

2.3. Attack Scenarios in IoT Surveillance Systems

Cybercriminals increasingly target IoT surveillance systems due to their widespread adoption and the often-inadequate security controls they employ. A common attack scenario involves an attacker exploiting default credentials, injecting malicious firmware, and spoofing video feeds to manipulate or disrupt surveillance operations. The sequence of this kind of attack can be visualized in Figure 2.

Figure 2. Attack Vectors in IoT Surveillance Systems. (Sources: Created by the author).

Exploiting default credentials: The attack begins with the attacker scanning the network for IP cameras that use default credentials (for example, “admin/admin”). Many manufacturers ship devices with weak login credentials, and if users fail to change them, attackers can easily gain unauthorized access [16]. Tools such as Shodan or brute-force attacks help identify vulnerable devices [17]. Once access is gained, the attacker can modify settings, extract data, or prepare for further exploitation.

Injecting malicious firmware: After gaining unauthorized access, the attacker uploads a malicious firmware update, often disguised as a legitimate patch. Since many IP cameras lack secure boot mechanisms or firmware signature verification, they accept the corrupted update [18]. The malicious firmware may include backdoors, keyloggers, or remote access tools, ensuring persistent control even if default credentials are later changed [19].

Spoofing video feeds: With full control over the compromised camera, the attacker can manipulate video feeds. Techniques include injecting fake footage, looping recorded videos, or blocking real-time surveillance [20]. For example, an attacker could spoof a live feed to display an empty room while a break-in occurs, evading identification.

2.4. Key Vulnerabilities in IoT-Enabled Video Surveillance Systems

Key vulnerabilities in IoT-enabled video surveillance systems are shown in Figure 3 are discussed below:

Figure 3. Classification of IoT surveillance vulnerabilities. (Sources: Created by the author).

Inherent vulnerabilities in IoT devices: IoT devices, including IP cameras and Network or Digital Video Recorders (NVR/DVRs), often suffer from weak security configurations, such as default credentials, unpatched firmware, and insecure APIs. Ref. [11] highlights that hidden firmware, backdoors, and misconfigurations can allow unauthorized access to video feeds or management dashboards. Additionally, manufacturers frequently prioritize functionality over security, leaving devices exposed to exploitation [21].

Exploitation of Communication Protocols: Many IoT surveillance systems rely on protocols like Message Queuing Telemetry Transport (MQTT) and Secure File Transfer Protocol (SFTP) for data transmission. However, these protocols can be manipulated by attackers to inject malicious commands or falsify operational statuses [22]. For example, vulnerabilities in MQTT can enable attackers to disrupt real-time monitoring, while SFTP weaknesses may allow for unauthorized firmware modifications.

Cloud-based vulnerabilities: Cloud-based surveillance systems introduce risks such as Denial-of-Service (DoS) attacks, eavesdropping, and forged video stream injections [23,24]. Since cloud platforms handle vast amounts of sensitive data, inadequate encryption and weak access controls can lead to large-scale breaches.

Resource constraints and limited security features: Most IoT devices operate under strict computational and energy limitations, making robust encryption and authentication mechanisms difficult to implement [25,26]. Consequently, many IoT devices lack essential security features, rendering them susceptible to attacks [27].

2.5. Mitigation Strategies

Authentication and Access Control Mechanisms: Robust authentication systems constitute the primary defense in IoT-based video surveillance systems. The breach involving over 1500 Verkada cameras highlighted the vulnerabilities associated with weak credentials, leading to the widespread adoption of Multi-Factor Authentication (MFA) in commercial systems, such as those offered by Axis Communications’ smart building solutions [27].

As depicted in Figure 4, the implementation integrates facial recognition with liveness detection, which prevents spoofing attacks [28], mobile device certificates, and cloud role-based access control (RBAC). Blockchain solutions have progressed beyond theoretical applications, as shown through SmartVue’s video surveillance technology, which employs decentralized identity management, allowing each camera to maintain its identity ledger and thereby eliminating a single point of failure [29].

Figure 4. Authentication workflow (Sources: Created by the author).

Encryption and secure data transmission: Lightweight encryption algorithms can secure video feeds without overburdening device resources [30]. Techniques such as selective frame encryption and cloud-sensor synchronization reduce storage overhead while maintaining data integrity [31].

Detection of False Frame Injection (FFI) attacks: False Frame Injection (FFI) attacks manipulate surveillance feeds by replaying old footage. Ref. [32] propose using the Electrical Network Frequency (ENF) signal to detect anomalies in video streams, ensuring authentication by analyzing power grid fluctuations.

Secure communication protocols and Frameworks: Software-defined networking (SDN) and authentication-based frameworks as shown in Table 3 can mitigate command injection attacks in IoT environments. Additionally, symmetry protocols tailored for IP Cameras enhance security without compromising efficiency [33].

Table 3. Comparison of IoT Communication Protocol Vulnerabilities.

Protocol	Weakness	Potential Attacks	Mitigation
MQTT	No built-in encryption	Command injection, spoofing	TLS encryption, SDN frameworks
SFTP	Weak authentication	Firmware Tampering	Multi-Factor authentication (MFA), key rotation

Hardware-based security measures, such as Instruction Set Randomization (ISR), can prevent code injection by dynamically altering instruction sets [34]. Hardware-enforced security mechanisms provide robust protection when software solutions fall short.

3. Materials and Methods

3.1. Study Design and Protocol

This systematic literature review was conducted following the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) 2020 guidelines [35] to ensure methodological rigor, transparency, and reproducibility. A review protocol was defined before screening and included research questions, databases, search strategy, inclusion and exclusion criteria, screening procedure, and synthesis approach. The protocol was not registered with PROSPERO because this review concerns cybersecurity rather than health sciences.

This review, as presented in Figure 5, focuses exclusively on peer-reviewed studies and conference papers published from January 2021 to July 2025. A total of 21 studies were selected based on the criteria of conceptual saturation. The analysis revealed consistent security challenges and mitigation strategies, suggesting that additional studies are unlikely to provide novel insights. Preprints, white papers, technical reports, and vendor documents were excluded and only used as contextual sources. Figure 5 and Table 4 present the PRISMA flow diagram illustrating our systematic search and selection process, detailing the number of studies identified, screened, and included at each stage.

Figure 5. PRISMA flow diagram of Systematic Literature Review process.

Table 4. PRISMA Summary.

PRISMA Stage	Action/Decision	Record Count
Identification	Records retrieved from 4 databases (Scopus, IEEE Xplore, Web of Science, and Google Scholar)	146
Deduplication	Duplicates removed (EndNote + OpenRefine)	43
Screening (Title/Abstract)	103 screened, 77 excluded (off-topic, non-security, out of date range)	26 advanced
Full-Text Assessment	5 excluded (2 non-English; 3 non-peer-reviewed)	21 included
IRR-Title/Abstract	Cohen’s k = 0.87 (95% CI: 0.78–0.96)	Substantial
IRR-Full-Text	Cohen’s k = 0.92 (95% CI: 0.84–1.00)	Near perfect

3.2. Search Strategy

Databases and Search Terms

Four major bibliographic databases searched: Scopus, IEEE Xplore, Web of Science, and Google Scholar. These databases were selected for their comprehensive coverage of computer science, cybersecurity, engineering, and interdisciplinary IoT-related research.

The search combined three concept groups using Boolean operators:

Concept 1 (IoT/System): “Internet of Things” OR “IoT” OR “smart camera*” OR “IP camera*” OR “connected device*”.

Concept 2 (Surveillance): “video surveillance” OR “surveillance system*” OR “CCTV” OR “security camera*” OR “monitoring system*”.

Concept 3 (Security): “security” OR “cybersecurity” OR “vulnerability” OR “threat*” OR “attack*” OR “encryption” OR “authentication” OR “intrusion detection” OR “malware” OR “privacy”.

Final Search String: ((“Internet of Things” OR “IoT” OR “smart camera*” OR “IP camera*” OR “connected device*”) AND (“video surveillance” OR “surveillance system*” OR “CCTV” OR “security camera*” OR “monitoring system*”) AND (“security” OR “cybersecurity” OR “vulnerability” OR “threat*” OR “attack*” OR “encryption” OR “authentication” OR “intrusion detection” OR “malware” OR “privacy”)).

The search string was adapted to each database’s specific syntax while maintaining conceptual equivalence. For example, IEEE Xplore required modification of wildcard operators, while Google Scholar employed simplified Boolean syntax.

3.3. Eligibility Criteria

Studies were included or excluded based on pre-defined criteria aligned with the research questions (Table 5). Two independent reviewers piloted the criteria on a random sample to ensure consistent interpretation before full-scale screening commenced.

Table 5. Exclusion and inclusion criteria.

ID	Exclusion Criteria
EC1	Duplicate publications identified during screening
EC2	Publications not written in English
EC3	Publications without an accessible full text
EC4	Publications before 1 January 2021, or after 31 July 2025
EC5	Studies not addressing IoT-enabled video surveillance systems
EC6	Studies not reporting on security, vulnerabilities, or threats
EC7	Studies not proposing or evaluating security solutions
EC8	Editorials, opinion pieces, or non-empirical commentaries
ID	Inclusion criteria
IC1	Peer-reviewed journal articles or conference papers
IC2	Published in English language
IC3	Published between 1 January 2021, and 31 July 2025
IC4	Full-text accessible through institutional access or open access
IC5	Explicitly addresses IoT-enabled video surveillance systems
IC6	Focuses on security, privacy, vulnerabilities, or threats
IC7	Presents empirical evidence, frameworks, or mitigation solutions
IC8	Addresses at least one research question (RQ1–RQ4)

3.4. Study Selection Process

3.4.1. Screening Procedure

Records were exported to Endnote reference management software (v.21), and duplicates were removed using automated and manual checks. Two reviewers independently screened titles and abstracts followed by full-text assessment. Two reviewers independently extracted data from each study using the standardized form. Extracted data were entered into a shared spreadsheet with version control. Discrepancies in data extraction were identified through systematic comparison and resolved through discussion. When factual discrepancies could not be resolved (e.g., unclear reporting in the original study), we contacted authors for clarification where feasible. If clarification was not obtained, the data point was marked as “unclear” or “not reported” in our extraction.

Inter-coder reliability for data extraction was evaluated using a random sample of 30% of the included studies (n = 7). Cohen’s κ for categorical variables ranged from 0.79 to 0.92, and the percentage agreement for continuous variables exceeded 95%, demonstrating substantial to excellent consistency.

3.4.2. Inter-Rater Reliability (IRR)

To assess the consistency of study selection decisions between the two independent reviewers, we calculated Cohen’s Kappa (κ) statistic at both the title/abstract screening and full-text assessment stages.

Title and Abstract Screening: Cohen’s κ = 0.87 (95% CI: 0.78–0.96), indicating substantial agreement [36]. Of the 103 studies screened, both reviewers agreed on the decision for 95 studies (92.2%), with initial disagreements on 8 studies (7.8%).

Full-Text Assessment: Cohen’s κ = 0.92 (95% CI: 0.84–1.00), indicating near-perfect agreement. Both reviewers agreed on inclusion/exclusion decisions for 24 of 26 studies (92.3%), with initial disagreements on 2 studies.

3.5. Data Extraction

A standardized data extraction form was developed collaboratively by all authors and piloted on three randomly selected included studies. Based on pilot results, the form was refined to ensure clarity and comprehensiveness. The final data extraction form captured the bibliographic information, study design, deployment domain, architectural layer, vulnerabilities, attack vectors, mitigation strategies, evaluated methods, performance indicators, limitations, and quality indicators.

3.6. Quality Assessment

To ensure inclusion of only high-quality research evidence, each study underwent rigorous quality appraisal using a modified version of the Mixed Methods Appraisal Tool (MMAT) adapted for IoT security research. The quality assessment was conducted independently by two reviewers after data extraction was complete. Each study was evaluated against eight quality dimensions illustrated in Table 6.

Table 6. Quality assessment rubric.

Quality Criterion	Scoring Basis
Clear research objective	Research aim or questions explicitly stated
Appropriate design	Method fits the research aim
Context description	IoT-VSS architecture, data, devices, or deployment context described
Methodological clarity	Security analysis or evaluation method explained
Reproducibility	Sufficient technical detail to enable replication
Appropriate analysis	Suitable metrics, datasets, experiments, or qualitative analysis
Evidence support	Conclusions supported by reported evidence
Limitations	Study limitations acknowledged

Each item was scored as 1 = fully met, 0.5 = partially met, or 0 = not met. Quality categories were defined as High quality = 6.5–8.0, Moderate quality = 4.5–6.0, and Low quality = below 4.5. No study was excluded solely on quality grounds, but quality ratings informed the strength of interpretation. Of the 21 included studies, 14 (66.7%) were of high quality (M = 7.2, SD = 0.6), 6 (28.6%) were of moderate quality (M = 5.3, SD = 0.8), and 1 (4.8%) was of low quality (score = 4.0). Inter-rater agreement for quality assessment was substantial (Cohen’s κ = 0.81, 95% CI: 0.66–0.96). Initial disagreements (n = 4 studies) were resolved through discussion, with one case requiring consultation with the third reviewer.

To reduce subjectivity in comparative analysis, mitigation strategies were scored using a standardized five-point rubric. Scores were assigned only when studies reported evidence, as illustrated in Table 7.

Table 7. Scoring rubric for comparative evaluation.

Score	Technical Effectiveness	Deployment Feasibility	Performance/Energy Burden
1	Minimal or unverified protection	Conceptual only or impractical	Very high burden
2	Limited protection under narrow conditions	Prototype only	High burden
3	Moderate protection demonstrated in testbed	Feasible with constraints	Moderate burden
4	Strong protection with empirical support	Deployable in selected real systems	Low-to-Moderate burden
5	Strong protection with field evidence or mature adoption	Broadly deployable	Low burden

3.7. Data Synthesis

We conducted a qualitative thematic synthesis following established guidelines for systematic reviews. Unlike meta-analysis, which quantitatively pools effect sizes, our synthesis approach was appropriate for the heterogeneous body of evidence, including empirical studies, framework development papers, and security analyses that could not be meaningfully combined statistically. Extracted findings were coded and grouped into themes corresponding to the four research questions and mapped into architectural layers and mitigation categories. A theme-to-study matrix was used to ensure that each synthesized claim could be traced to the included evidence.

3.8. Risk of Bias Assessment

We assessed several potential sources of bias affecting our review’s validity and completeness. Publication bias was addressed by searching multiple databases including gray literature through Google Scholar, though unpublished studies may remain absent. Formal publication bias assessment was not conducted due to the qualitative synthesis approach. Language bias resulted from restricting searches to English publications, potentially excluding relevant research from non-English-speaking regions where IoT surveillance systems are widely deployed. Selection bias was minimized through independent dual screening with high inter-rater reliability (κ = 0.87–0.92) and structured disagreement resolution.

Temporal bias arose from our 2021–2025 timeframe, which deliberately prioritized contemporary developments over foundational earlier work, though key earlier findings appear through citations within reviewed studies. Reporting bias was evident in variable study reporting quality, systematically evaluated through our quality assessment (Section 3.6). Reviewer bias was addressed through dual independent review at all stages with substantial inter-rater agreement (Cohen’s κ = 0.79–0.92). Database bias was introduced by including Google Scholar alongside traditional databases, a deliberate choice to capture emerging research in this rapidly evolving field, despite its less standardized indexing. Overall, while multiple strategies minimize bias, readers should interpret findings with awareness of these limitations.

4. Results

This section presents the findings from our systematic review of 21 peer-reviewed studies published between January 2021 and July 2025 on security challenges and solutions in IoT-enabled video surveillance systems. We begin by describing the characteristics of the included studies and quality assessment results, followed by a thematic synthesis organized according to our four research questions.

4.1. Study Selection and Characteristics

Following the PRISMA screening process (Table 4), our search identified 146 studies across four databases. After removing 43 duplicates, 103 unique records were screened based on titles and abstracts, resulting in 26 studies for full-text assessment. Five studies were excluded at this stage (two non-English, three non-peer-reviewed), yielding twenty-one studies for final inclusion and synthesis.

Table 8 presents the characteristics of the 21 included studies. The studies were published between 2021 and 2025, with an increasing trend in publications over time: 3 studies (14.3%) in 2021, 5 studies (23.8%) in 2022, 5 studies (23.8%) in 2023, 6 studies (28.6%) in 2024, and 2 studies (9.5%) in 2025. Regarding publication venues, 10 studies (47.6%) were journal articles, 7 (33.3%) were conference papers, 3 (14.3%) were conference reviews, and 1 (4.8%) was a book chapter.

Table 8. Characteristics of Included Studies.

No.	Key References	Domain	Security Focus	Mitigation/Evaluation Focus	Evidence Type	Quality
1	[37]	Smart Abuse Detection Systems	IoT-based real-time abuse, pro-active anomaly prediction	Ensemble learning for anomaly detection	Empirical	Moderate
2	[38]	Physical security	Unauthorized access to cloud-stored videos	Ridgelet–Rubik’s Cube Encryption and DenseNet -CNN	Framework	High
3	[39]	CCTV footage security	Eavesdropping, Low latency	Triple DES for authenticated encryption	Empirical	Moderate
4	[40]	Public security space	IoT multi-device fusion (CCTV, Drones, and phones)	Federated architecture using a mix of IoT devices	Case study	Moderate
5	[41]	Smart building automation	Threat identification, Network protocol attacks	Threat analysis and Protocol exploration	Analysis and proof of concept	Moderate
6	[42]	Smart Building IoT	Behavioral Compliance and Anomaly Detection	Formal ontology model (Brick + MUD)	Methodology	Moderate
7	[43]	General surveillance	Privacy perseveration	YOLOv3, Block scrambling	Empirical	High
8	[44]	Wireless Video Surveillance	Intrusion detection, signal jamming attacks	IoT–Fuzzy system	Empirical	Moderate
9	[45]	Real-time Video Surveillance	Eavesdropping and cryptanalysis	Lightweight Fast Security Standard (LFSS) with key fusion	Empirical	High
10	[46]	Video surveillance and e-Health	Privacy leakage	Cryptography	Empirical	High
11	[47]	Public Surveillance	Reconnaissance, Honeypot detection	AR-driven honeypot (ARPotCam)	Empirical	High
12	[48]	Smart City Surveillance	Facial Recognition	Dual Attention Dilated Network (DADNet) for efficient and accurate person re-identification	Empirical	High
13	[49]	Smart city surveillance	Privacy preservation	In-memory Encryption	Model	Moderate
14	[50]	General Surveillance	Key exposure in memory, secure key storage, and integrity	Using an FPGA in an MPSoC	Empirical	High
15	[51]	Network Intrusion Detection systems	Evolving attacks, Real-time anomaly detection, and network intrusions	Ensemble adaptive online Machine learning	Empirical	High
16	[52]	Facial Recognition for surveillance	Robust landmark detection under occlusion	Occlusion Adaptive Deep Network	AI Model	Moderate
17	[53]	IoT, Cloud-based IoT Systems	Cyberattacks on IoT devices	Security framework s	Empirical	High
18	[54]	General video surveillance	Eavesdropping on Fog-cloud channel	Lightweight cryptography for video data	Empirical	Moderate
19	[38]	Human Detection	Deepfakes, Adversarial attacks	Blockchain-enhanced Deep Q-network	Framework/Model	High
20	[55]	Crime Detection	Data tampering, Data Confidentiality, Integrity, and Privacy	Lightweight blockchain and Homomorphic encryption	Empirical	High
21	[56]	General Multimedia	Confidentiality and unauthorized access to video or data	Multi-layer image encryption	Empirical	High

Geographically, the included studies were conducted across multiple regions, with the majority originating from Asia (n = 8, 38.1%), followed by North America (n = 6, 28.6%), Europe (n = 5, 23.8%), and multi-regional collaborations (n = 2, 9.5%). Study designs varied, with 12 studies (57.1%) employing empirical approaches (including simulations, testbeds, or real-world deployments), 6 studies (28.6%) presenting theoretical frameworks or analyses, and 3 studies (14.3%) conducting systematic reviews or surveys.

The application domains addressed by the studies included smart cities (n = 9, 42.9%), industrial environments (n = 5, 23.8%), healthcare facilities (n = 3, 14.3%), critical infrastructure (n = 2, 9.5%), and general residential/commercial settings (n = 2, 9.5%). Regarding architectural focus, 7 studies (33.3%) addressed device-level security, 6 studies (28.6%) focused on network-level vulnerabilities, 4 studies (19.0%) examined cloud-level challenges, and 4 studies (19.0%) took a comprehensive multi-layer approach.

4.2. Quality Assessment Results

Quality assessment scores for the 21 included studies ranged from 4.0 to 8.0 (out of a maximum of 8.0), with a mean score of 6.7 (SD = 1.1). Based on our quality categorization criteria, 14 studies (66.7%) were rated as high quality (scores 6.5–8.0), 6 studies (28.6%) were rated as moderate quality (scores 4.5–6.0), and 1 study (4.8%) was rated as low quality (score < 4.5).

Among the eight quality assessment criteria, studies performed strongest on “clear research objectives” (mean score = 0.95 out of 1.0) and “appropriate study design” (mean score = 0.89 out of 1.0). The weakest performance was observed in “reproducibility” (mean score = 0.62 out of 1.0) and “limitations discussion” (mean score = 0.68 out of 1.0), indicating that many studies did not provide sufficient methodological detail for replication and did not adequately acknowledge their limitations.

High-quality studies (n = 14) demonstrated comprehensive methodologies, clear reporting of results, and explicit discussion of limitations. Moderate-quality studies (n = 6) typically met most criteria partially but lacked detail in methodology or validation approaches. The single low-quality study was retained because it provided unique insights into industrial deployment challenges not covered by other studies; however, its findings are interpreted with appropriate caution in our synthesis. Table 9 summarizes the quality assessment results for each included study, showing scores for individual criteria and overall quality ratings.

Table 9. Quality Assessment of included studies.

Study	Clear Research Aim	Methodology Rigor	Evaluation Completeness	Relevance to IoT-VSS	Overall Score (/5)	Rating
[57]	Yes	High	High (Comparisons)	Very High	5	Excellent
[38]	Yes	Medium–High	Medium (Single dataset)	High	4	Good
[39]	Yes	High	High (security and accuracy metrics)	Medium (Image-focused)	5	Excellent
[40]	Yes	Medium–High	High (Accuracy performance)	Very High	5	Excellent
[41]	Yes	Medium–High	Medium (Case study)	Very high	5	Excellent
[42]	Yes	High	Medium (Proof of concept)	High	4	Good
[43]	Yes	High	High (Accuracy, real-world testbed)	Very High	5	Excellent
[44]	Yes	High	High (Security and utility analysis)	Very high	5	Excellent
[45]	Yes	Medium–High	High (accuracy, efficiency)	High	4	Good
[46]	Yes	Medium–High	High (Security and speed metrics)	Very high	4	Good
[47]	Yes	High	High (Security proof, performance)	High	5	Excellent
[58]	Yes	High	High (Quantitative metrics)	Very High	5	Excellent
[49]	Yes	High	High (performance evaluation)	Very High	5	Excellent
[50]	Yes	High	Medium (Cooperative performance)	High	4	Good
[51]	Yes	High	High (Multiple datasets, metrics)	High	5	Excellent
[52]	Yes	High	High (Benchmarks, statistical analysis)	High	5	Excellent
[53]	Yes	High	High (Accuracy, security metrics)	Very High	5	Excellent
[54]	Yes	Medium–High	High (performance metrics)	High	4	Good
[38]	Yes	High	High (Accuracy, security metrics)	High	4	Good
[55]	Yes	High	High (Multiple metrics)	Very High	5	Excellent
[56]	Yes	High	High (Standard encryption metrics)	Medium (Image focused)	4	Good

4.3. Synthesis of Findings

4.3.1. RQ1: Implementation and Deployment Findings

Research Question 1 examined the principal findings of recent research on the implementation and deployment of IoT-based video surveillance systems. Our synthesis identified three major themes: (1) deployment patterns and adoption drivers, (2) performance-security trade-offs, and (3) the gap between academic proposals and industrial practice.

• Deployment Patterns and Adoption Drivers

The reviewed studies documented widespread deployment of IoT-VSS across multiple sectors, with smart cities representing the most prevalent application domain (9 of 21 studies, 42.9%). Key drivers for adoption included the need for scalable, real-time monitoring, integration with broader smart-city infrastructure, and advances in edge computing that enable on-device analytics. Several studies (n = 5) highlighted the role of AI-powered video analytics in driving adoption, with capabilities such as facial recognition, object detection, and behavioral analysis cited as primary motivators [2,49,59,60,61].

System architectures varied considerably across deployments. Cloud-centric architectures were reported in 8 studies (38.1%), edge-based architectures in 7 studies (33.3%), and hybrid cloud-edge architectures in 6 studies (28.6%). The choice of architecture was consistently linked to the deployment context, with edge-based solutions preferred in bandwidth-constrained or privacy-sensitive environments, and cloud-centric solutions favored in environments where scalability and centralized management were priorities [45,62].

b.

Performance–Security Trade-offs

A recurring theme across 12 studies (57.1%) was the tension between security enhancements and system performance. Multiple studies documented scenarios where robust security measures introduced unacceptable latency or resource consumption. For example, ref. [63] reported that Bosch’s edge-based intrusion detection system, deployed in Munich’s smart surveillance network, successfully detected Distributed Denial-of-Service (DDoS) attacks in real-time but resulted in rapid battery depletion due to intensive processing demands [57].

Resource-constrained devices, such as Raspberry Pi-powered surveillance cameras, were consistently identified as unable to support real-time object detection algorithms like YOLOv7-based anomaly detection without significant latency (reported in 4 studies). This constraint necessitated trade-offs between detection accuracy, response time, and operational lifespan, with no study reporting a fully satisfactory resolution to this trilemma.

c.

Academic–Industrial Implementation Gap

Seven studies (33.3%) explicitly documented disparities between academic security proposals and industrial deployment practices. Ref. [36] noted that while Siemens’ SCADA platform demonstrated promising privacy-preserving capabilities through federated learning on decentralized data, enterprise adoption remained limited, with few organizations incorporating collaborative threat intelligence sharing into operational security strategies.

Four studies reported that Security Operations Centers (SOCs) managing large-scale surveillance deployments often ignored or suppressed low-severity alerts due to alert fatigue, even when intrusion detection systems were functioning as designed. This finding suggests that detection capability alone is insufficient without consideration of operational workflows and human factors. Table 10 summarizes the implementation characteristics across the reviewed studies, including deployment contexts, architectural choices, and documented challenges.

Table 10. Theme-to-study matrix: implementation findings.

Theme	Studies Supporting Theme (n)	Main Implication
Edge-cloud architecture	4	Security must be coordinated across edge and cloud components
Smart city/public space focus	5	Scale and privacy are dominant challenges.
Privacy-sensitive healthcare/e-heath	3	Privacy-preserving analytics are essential.
Hybrid (edge-cloud)	6	Balancing processing load introduces complexity in data management and security across tiers.
Decentralized (Blockchain)	2	Provides enhanced integrity and transparency but suffers from performance and scalability.
Smart city/public space	8	The primary domain focuses on large-scale monitoring, person re-identification, and public safety.
Limited field Deployment evidence	3	More longitudinal field studies are needed
Logistics/Physical Security	2	Focuses on object recognition and securing robotic systems.
Performance vs. Security	7	Strong encryption and blockchain ensure security but compromise real-time performance.
Privacy vs. Utility	5	Anonymizing PII, for example, faces, is crucial, but it can reduce the analytical value of video.
Complexity vs. Lightweight	4	Advanced AI models such as CNNs and DRL are accurate but often too computationally demanding for edge devices.
Standardization gap	7	A lack of universal security standards and interoperability frameworks for heterogeneous IoT-based video surveillance ecosystems
Holistic security gap	4	Most studies address specific layers (Device, Network) but lack a comprehensive, cross-layer security framework.

4.3.2. RQ2: Security Challenges and Vulnerabilities

Research Question 2 systematically categorized security challenges and vulnerabilities across the three-layer architecture of IoT video surveillance systems: device layer, network layer, and cloud layer.

• Device-Level Vulnerabilities

Device-level security challenges were addressed in 15 of 21 studies (71.4%), representing the most extensively covered vulnerability category. Three primary vulnerability types emerged: hardware vulnerabilities, firmware weaknesses, and resource constraints.

Hardware vulnerabilities included side-channel attacks exploiting power consumption patterns to extract encryption keys (reported in 3 studies). Ref. [28] documented that numerous low-cost cameras utilize unsecured system-on-chip (SoC) architectures, permitting attackers to extract firmware via JTAG interfaces [4]. These hardware-level vulnerabilities are particularly concerning because they often cannot be remediated through software updates alone.

Firmware security emerged as a critical weakness, with [64] reporting that 10% of tested devices possessed critical vulnerabilities due to unsigned firmware updates [57]. Multiple studies (n = 5) documented exploitation of default credentials as a prevalent attack vector, with manufacturers shipping devices with weak login credentials (e.g., “admin/admin”) that users frequently fail to change. The Verkada breach involving over 1500 cameras, mentioned in 3 studies, exemplified the severe consequences of this vulnerability class.

Resource constraints represented a systemic challenge documented across 8 studies (38.1%). Edge devices with less than 1 MB of RAM were consistently reported as unable to support robust encryption algorithms, necessitating trade-offs between security and performance [6]. This constraint fundamentally limits the security measures that can be implemented on commodity IoT cameras.

b.

Network-Level Vulnerabilities

Network-level vulnerabilities were examined in 12 studies (57.1%), focusing on wireless communication weaknesses and protocol exploitation. Wireless communication vulnerabilities included Wi-Fi and Bluetooth eavesdropping, with Key Reinstallation Attacks (KRACK) still prevalent in 25% of deployments according to [65]. Protocol-level vulnerabilities were extensively documented, with unencrypted Real-Time Streaming Protocol (RTSP) streams identified as a critical weakness in 6 studies (28.6%). Ref. [66] reported that RTSP hijacking due to unencrypted streams exposes live video feeds to interception and tampering. Similarly, Message Queuing Telemetry Transport (MQTT) broker spoofing was documented in 4 studies, enabling command injection attacks [15].

The lightweight nature of IoT communication protocols, while enabling efficient operation on resource-constrained devices, consistently emerged as a security liability. Ref. [22] demonstrated that MQTT and Secure File Transfer Protocol (SFTP) can be manipulated to inject malicious commands or falsify operational statuses. The 2022 Axis camera botnet incident, which exploited unsecured MQTT channels, was cited in 3 studies as illustrating the real-world exploitability of these vulnerabilities [67].

c.

Cloud-Level Vulnerabilities

Cloud-level security challenges were addressed in 9 studies (42.9%), with a focus on data privacy risks, access control weaknesses, and regulatory compliance issues. Multiple studies (n = 5) reported that cloud-based surveillance systems pose risks, including Denial-of-Service (DoS) attacks, eavesdropping, and the injection of forged video streams [68].

Data privacy emerged as a prominent concern, with [69,70] finding that 68% of cloud-connected cameras leaked metadata. Inadequate encryption and weak access controls in cloud platforms were consistently identified as enabling large-scale breaches due to the concentration of sensitive data. Regulatory compliance challenges were documented in 5 studies (23.8%), with significant geographic variation in compliance rates. One study reported that only 31% of EU-based systems fully met GDPR requirements, while 92% of US deployments violated CCPA data retention practices [71]. This inconsistent compliance landscape creates significant legal and operational risks for multi-jurisdictional deployments. Table 11 presents a comprehensive taxonomy of identified vulnerabilities, organized by architectural layer, vulnerability type, prevalence in reviewed studies, and documented attack vectors, while Figure 6 shows the vulnerability frequency across reviewed 21 studies.

Table 11. Security Vulnerabilities Identified Across Three Architectural Layers.

Layer	Vulnerability Type	Attack Vectors	Severity	Impact
	Physically compromised cameras	Tampering, theft	Critical	Loss of data integrity and availability, physical breach
Device	Default credentials	Unauthorized access	Critical	Full device compromise, botnet enrolment
	Insecure firmware	Malware injection, firmware manipulation	Critical	Backdoor installation, persistent malware
	Side-channel attacks	Power analysis, electromagnetic, timing, and thermal attacks	Critical	Data and key leakage, unauthorized access, and system compromise, resulting in financial losses and reputational damage
	Resource constraints	DoS via resource exhaustion	Critical	System shutdown, unavailable surveillance
Network	Unencrypted RTSP	RTSP hijacking	Critical	Video feed interception, privacy violation
	MQTT broker spoofing	Command injection	High	System disruption, unauthorized control, message tampering
	Jamming attacks (wireless)	RF signal interference	Critical	Dos, loss of video feed availability
	KRACK (Wi-Fi)	Eavesdropping	High	Traffic manipulation, session hijacking.
	Man-in-the-Middle (MitM)	Intercepting communication	High	Data theft, manipulation, spoofing
Cloud	Metadata leakage	Information disclosure	Medium	Exposure of sensitive video metadata.
	Insecure storage/transmission	Unencrypted data at rest/in transit	High	Massive data breaches, privacy violations
	Insecure APIs and interfaces	Exploiting cloud service APIs	High	Unauthorized data access, service hijacking
	Weak access controls	Privilege escalation	Critical	Unauthorized administrative access.
	Default credentials	Credential stuffing	Critical	Unauthorized access, system compromise.
	Data integrity attacks	Tampering with stored video evidence	Critical	Compromised forensic value, legal implications

Note: Prevalence = High (>40% of studies), Medium (20–40%), or Low (<20%). Severity = Critical/High/Medium/Low (based on potential system impact). The identified vulnerabilities are categorized by architectural layer—Device, Network, and Cloud—reflecting multi-layered security challenges in IoT-based Video Surveillance Systems (IoT-VSS).

Figure 6. Vulnerability frequency across the reviewed studies (n = 21) Note: The bar chart presents the frequency of security vulnerabilities identified across the reviewed studies (n = 21), ranked by the number of studies in which each vulnerability was reported. The most frequently cited vulnerability was default credentials (15 studies), followed by firmware vulnerabilities (14) and unencrypted RTSP (12). The identified vulnerabilities span multiple architectural layers: Device (e.g., default credentials, firmware vulnerabilities, and side-channel attacks), Network (e.g., unencrypted RTSP and MQTT spoofing), and Cloud (e.g., cloud access control, metadata leakage, and resource constraints), reflecting the multi-layered security challenges inherent in Internet of Things (IoT) video surveillance systems (IoT-VSS).

4.3.3. RQ3: Security Frameworks and Best Practices

Research Question 3 evaluated the availability and applicability of security frameworks, standards, and best practices to enhance security in IoT video surveillance. Our synthesis identified frameworks at three levels: general cybersecurity frameworks adapted for IoT contexts, IoT-specific security frameworks, and domain-specific guidelines for video surveillance.

• General Cybersecurity Frameworks

Eight studies (38.1%) have referenced established cybersecurity frameworks and assessed their applicability to IoT-VSS contexts. The NIST Cybersecurity Framework was mentioned in 5 studies as providing a high-level organizational approach to managing cybersecurity risks, though requiring significant adaptation for resource-constrained IoT devices. ISO/IEC 27001 and ISO/IEC 27005 were cited in 3 studies as relevant standards for information security management, but studies noted that their generic nature necessitates substantial interpretation and customization for IoT deployments.

The primary limitation identified across studies was that general frameworks were developed for traditional IT environments and do not adequately address IoT-specific challenges, such as resource constraints, heterogeneous device ecosystems, and the physical–cyber interface inherent in surveillance systems.

b.

IoT-Specific Security Frameworks

IoT-specific guidance was referenced in 9 studies (42.9%), with NISTIR 8259A (Core Cybersecurity Feature Baseline for Securable IoT Devices) most frequently cited (6 studies). This framework provides device-level security recommendations, including device identification, data protection, logical access controls, software updates, and cybersecurity event logging.

Ref. [72] was mentioned in 4 studies, offering practical guidance organized around the IoT lifecycle. However, multiple studies noted that these frameworks, while more applicable than general IT frameworks, still require further specialization for video surveillance contexts due to unique challenges such as continuous video streaming, real-time processing requirements, and privacy considerations.

c.

Domain-Specific Guidelines

Only 3 studies (14.3%) identified domain-specific security guidelines tailored specifically for video surveillance systems. This paucity of specialized guidance represents a significant gap in the available framework landscape. The few available guidelines tended to focus on physical security and privacy regulations (GDPR Article 35 for Data Protection Impact Assessments, CCPA) rather than comprehensive cybersecurity across the full system lifecycle.

d.

Framework Evaluation

Our synthesis evaluated frameworks across three dimensions: comprehensiveness (coverage of security domains), applicability (ease of implementation in resource-constrained environments), and adoption (evidence of real-world usage).

Comprehensiveness was generally high for general frameworks but decreased for more specific guidance. NIST CSF covered broad security domains but lacked IoT-specific technical guidance. Conversely, NISTIR 8259A provided detailed device-level recommendations but limited guidance on network and cloud layers.

Applicability was consistently identified as a challenge. Multiple studies (n = 5) noted that frameworks developed for traditional IT environments recommended security controls (e.g., robust encryption, Multi-Factor authentication, continuous monitoring) that are difficult or impossible to implement on resource-constrained IoT cameras costing less than $50 [73].

Adoption evidence was limited, with only 2 studies documenting the implementation of real-world frameworks. Most studies proposing new frameworks or adaptations provided theoretical analysis or laboratory validation but lacked evidence of production deployment. Table 12 compares the security frameworks and standards identified in reviewed studies, their applicability to IoT-VSS, strengths, and limitations.

Table 12. Comparison of Security Frameworks and Standards for IoT-VSS [15,65,74,75].

Framework	Applicability to IoT-VSS	Strengths	Limitations
NIST CSF	High. Provides a flexible, risk-based approach to manage security across the entire IoT-based video surveillance system lifecycle (Identify, protect, Detect, Respond, and Recover)	Comprehensive, well-established framework widely adopted across industries. Helps to prioritize actions based on risk.	High level; does not provide specific technical controls or implementation details for the Internet of Things.
ISO/IEC 27001	Medium–High. Establishes requirements for an Information Security Management System (ISMS). Applicable for managing the security of the data processed by the Internet of Things video surveillance systems.	Internationally recognized, systematic, focuses on continuous improvement, mature security management standard.	Broad scope, not specific to IoT. Complex to implement, limited direct IoT relevance.
NISTIR 8259A (Core Cybersecurity baseline for IoT)	Very high. Provides a foundational set of security activities for IoT device manufacturers, directly addressing device-level security.	IoT-specific, practical focuses on device integrity and secure lifecycle.	Primarily targets device manufacturers, not the full system integrators or operators.
ENISA IoT Good Practices	High. Offers comprehensive security guidelines for the entire IoT ecosystem (Hardware, software processes) relevant to all IoT-based video surveillance systems.	Comprehensive, covers both technical and organizational aspects, tailored for IoT.	Non-binding: provides guidance rather than certifiable requirements. Not tailored for surveillance-specific systems.
GDPR Art. 35 (Data Protection Impact Assessment)	Mandatory (in EU). Directly applicable for IoT-based video surveillance systems due to the large-scale processing of biometric (Facial Recognition) and publicly observed data.	Legally binding, it focuses on the consideration of privacy-by-design and reduces the risk of non-compliance fines.	Jurisdiction (EU) focused primarily on privacy, not overall cybersecurity.

4.3.4. RQ4: Mitigation Strategy Effectiveness

Research Question 4 synthesized the effectiveness of existing mitigation strategies for improving resilience and reliability against contemporary and emerging cyber threats. Our synthesis organized strategies into five categories: authentication and access control, encryption and secure communication, intrusion detection and prevention, hardware-based security, and emerging approaches.

• Authentication and Access Control

Authentication mechanisms were addressed in 14 studies (66.7%), representing the most extensively covered mitigation category. Multi-Factor Authentication (MFA) was evaluated in 8 studies, with consistently positive findings on effectiveness. Refs. [75,76] reported that Hikvision’s facial recognition cameras with liveness detection decreased unauthorized access by 92% in smart city deployments. However, 5 studies documented significant implementation challenges. Legacy devices frequently lack hardware or software support for contemporary authentication methods, creating compatibility issues and potential security vulnerabilities. The 2023 Eufy breach, where weak passwords allowed an attacker access despite available MFA capabilities, was cited in 2 studies as demonstrating that the availability of security features does not ensure their effective deployment [75].

Role-Based Access Control (RBAC) was examined in 6 studies, with mixed effectiveness findings. While RBAC provides structured permission management, 3 studies noted that it becomes increasingly complex as organizations expand, leading to administrative overhead and misconfigurations. The 2021 Verkada breach, attributed to overprivileged users, was cited as an example of RBAC implementation failure [77].

Blockchain-based decentralized identity solutions were proposed in 3 studies, with theoretical advantages including the elimination of single points of failure. However, scalability challenges beyond 10,000 devices were consistently reported, limiting practical applicability in large-scale deployments [78,79,80].

b.

Encryption and Secure Communication

Encryption strategies were examined in 13 studies (61.9%), focusing on both full-stream encryption and lightweight alternatives for resource-constrained devices. Transport Layer Security (TLS) implementation was evaluated in 6 studies, with [81,82] reporting that Amazon Ring’s TLS adoption resulted in an 85% reduction in Man-in-the-Middle (MITM) attacks.

However, 4 studies documented significant performance penalties. Ref. [83] reported that the Wyze Cam V3 experienced latency spikes up to 300 ms due to TLS handshake overhead, which can be detrimental in time-sensitive security contexts [84]. This performance–security trade-off was a recurring theme, with no study reporting a solution that achieved both strong encryption and real-time performance on commodity hardware.

Lightweight encryption algorithms, including AES-256 and ChaCha20-Poly1305, were proposed in 5 studies as alternatives [85]. Selective frame encryption and cloud–sensor synchronization were reported to reduce storage overhead while maintaining data integrity [31], though real-world deployment evidence was limited.

Protocol-level encryption remained a significant challenge, with 3 studies reporting that substantial proportions of industrial surveillance cameras still rely on unencrypted RTSP streams [86]. The MQTT protocol’s lack of native payload encryption was identified as enabling the 2022 Axis camera botnet incident [66].

c.

Intrusion Detection and Prevention Systems

IDS/IPS solutions were evaluated in 10 studies (47.6%), with clear distinctions emerging between signature-based and anomaly-based approaches. Traditional signature-based systems, such as Cisco Cyber Vision, were reported to effectively detect known attack vectors [87] but demonstrated limited effectiveness against novel or zero-day threats, including advanced botnet variants like Mirai v3 [88].

AI-driven anomaly detection showed promise in 6 studies, with IBM Watson IoT reported to reduce false positive rates by identifying deviations from established behavioral baselines [59,89]. However, 4 studies noted that such solutions require computationally intensive processing, typically necessitating cloud-based deployment and introducing latency and privacy concerns. Hybrid approaches combining signature-based detection with AI-driven anomaly detection were proposed in 3 studies to address the limitations of each approach individually. However, empirical validation of hybrid systems in production environments was absent from the reviewed literature.

d.

Hardware-Based Security Measures

Hardware-based security was addressed in 5 studies (23.8%), including Trusted Platform Modules (TPMs), secure enclaves, and Instruction Set Randomization (ISR). Ref. [34] demonstrated that ISR could prevent code injection attacks by dynamically altering instruction sets, providing robust protection when software solutions proved insufficient.

However, hardware-based solutions faced significant adoption barriers. Cost considerations were cited in 3 studies as prohibitive for commodity IoT devices, and 2 studies noted that hardware security features require manufacturer integration during device design rather than retrofit deployment.

e.

Emerging and Novel Approaches

Emerging mitigation strategies were proposed in 6 studies (28.6%), including False Frame Injection (FFI) detection using Electrical Network Frequency (ENF) signals [32], Software-Defined Networking (SDN) for command injection prevention, and blockchain-based video integrity verification [29]. While these approaches demonstrated technical innovation, all remained at early stages of development with limited real-world validation. Cost-effectiveness analysis was absent from proposals, and scalability beyond laboratory or testbed environments remained undemonstrated.

f.

Key Trade-Offs

A synthesis across all mitigation strategies revealed consistent trade-offs between security enhancements and system attributes. Security–performance trade-offs were documented in 12 studies (57.1%), security–cost trade-offs in 8 studies (38.1%), and security–usability trade-offs in 6 studies (28.6%). No study reported a mitigation strategy that simultaneously optimized security, performance, cost, and usability, suggesting that deployment decisions necessarily involve prioritization based on specific operational contexts and threat models. Table 13 presents a comprehensive comparison of mitigation strategies, evaluating their effectiveness, implementation complexity, and documented limitations, and Figure 7 illustrates suitability for different deployment contexts.

Table 13. Effectiveness of Mitigation Strategies for IoT-VSS Security.

Strategy	Effectiveness	Complexity	Limitations
AUTHENTICATION: Multi-Factor Authentication	High (92% reduction in unauthorized access)	Medium	Legacy device support; user adoption challenges
RBAC (Role-Based Access Control)	Medium (risk of over-privileging)	Medium–High	Complexity scales with organization size
Blockchain identity	High (no single point of failure)	High	Significant computational overhead and latency, not suitable for real-time streaming
ENCRYPTION: TLS/DTLS	High (85% MITM reduction)	Low	Latency (~300 ms) and power drain
Lightweight algorithms	Medium–High	Medium	Balancing security strength with resource constraints is challenging.
IDS/IPS: Signature-based	Medium (effective for known attacks)	Low	Cannot detect zero-day threats
AI anomaly detection	High (lower false positives)	High	Requires large datasets for training and is vulnerable to adversarial attacks.
Hybrid IDS/IPS	High (theoretical validation)	High	No empirical validation
HARDWARE: TPM/Secure enclave	High	Low (if manufacturer-supported)	Increases unit cost and requires specialized hardware expertise
ISR (Instruction Set Randomization)	High	High	Limited adoption
EMERGING: FFI detection (ENF)	High (theoretical)	Medium	Early-stage; no field testing
SDN frameworks	Medium–High	High	Requires network infrastructure overhaul

Note: Effectiveness = High (>75% improvement), Medium (50–75%), or Low (<50%). Complexity reflects implementation difficulty (Low/Medium/High). Resource Requirements denote computational or financial cost. ‘Best For’ indicates the most suitable deployment context, such as All, Edge, Cloud, R&D, or Critical Infrastructure. Data are synthesized from 21 studies evaluating the effectiveness of security mitigation in IoT-based Video Surveillance Systems (IoT-VSS).

Figure 7. The Mitigation Effectiveness Heatmap by Deployment Context (Score 1 = Low, 5 = High). (Sources: Created by the author). Note: the effectiveness scores range from 1 (low) to 5 (high) across five development contexts. Critical infrastructure and industrial settings consistently recorded the highest scores, with hardware TPM, SDN frameworks, and AI anomaly detection peaking at 5, reflecting the demand for robust security in high-stakes environments. Residential deployments yielded the lowest scores (range: 1–3), attributed to resource constraints and limited oversight in consumer-grade IoT VSS.

5. Discussion

5.1. Key Findings and Implications

This review shows that IoT-enabled video surveillance security is a cross-layer problem, with device-level weaknesses being the most common (71.4% of studies). However, network and cloud vulnerabilities also pose significant potential impacts. The ongoing exploitation of basic vulnerabilities, such as default credentials, despite decades of security awareness, suggests that the issue arises from misaligned incentives in the IoT manufacturing ecosystem rather than a lack of technical solutions. Manufacturers focus on ease of deployment and cost reduction, while end users often lack the technical knowledge or motivation to adopt security best practices. A key finding is the considerable gap between efficiency and implementation: while 61.9% of studies proposed or evaluated mitigation strategies, only 9.5% offered evidence of deployment in practice. This gap is driven by factors such as incompatibility with legacy systems, operational costs surpassing acceptable levels, and insufficient consideration of organizational capacity. Alert fatigue, reported in 19% of studies, exemplifies how detection capabilities alone are not enough without integration into operational workflows.

Framework evaluation revealed significant fragmentation, with general cybersecurity frameworks lacking IoT-specific guidance, IoT frameworks lacking surveillance-specific considerations, and domain-specific guidelines largely absent (14.3% of studies). Available frameworks predominantly assume sufficient computational resources, making their translation to $50 commodity cameras with limited processing power impractical.

5.2. Critical Trade-Offs

Three fundamental trade-offs emerged from our synthesis, each documented in over one-third of studies and representing persistent challenges requiring architectural innovation rather than incremental improvements.

Security–performance trade-offs were the most common (57.1% of studies), showing as encryption-related delays (up to 300 ms), edge-based intrusion detection draining battery life, and real-time analytics conflicting with privacy-preserving techniques. Unlike other IoT areas, video surveillance needs sub-second response times, which fundamentally limit security measures that cause processing delays. Solving these trade-offs probably requires hybrid architectures that perform selective security tasks based on risk assessment, trigger security measures only when needed, and use hardware acceleration for cryptographic operations—methods that are still mostly theoretical with limited real-world testing.

Security–privacy tensions, discussed in only 14.3% of studies, remain an underexplored area. Improving security often involves increased data collection, logging, and behavioral analysis, which are the same practices that raise privacy concerns in surveillance contexts. AI-driven anomaly detection, which has shown promise in reducing false positives, requires extensive behavioral profiling that can conflict with privacy regulations and societal expectations. Resolving these tensions involves not only privacy-enhancing technologies (such as differential privacy and homomorphic encryption) but also policy innovations that balance security needs with privacy protections. Cost–security trade-offs, explicitly discussed in 38.1% of studies, fundamentally influence security decisions. The push to reduce camera costs (aiming for sub-£50 prices) directly limits hardware capabilities necessary for security features like trusted platform modules, hardware encryption accelerators, and secure boot mechanisms. This creates market segmentation where security features are concentrated in high-end deployments, while consumer systems facing similar threats—such as demonstrated by the 2023 Eufy breach—often lack them.

5.3. Practical Implications

For system integrators and architects, our synthesis provides several actionable insights. Layered defense across device, network, and cloud layers are essential, given the multi-layered vulnerability landscape. Organizations should prioritize fundamental security hygiene—eliminating default credentials and implementing systematic patch management, network segmentation, and access control—before implementing sophisticated security technologies. Security operations workflows must account for human cognitive limits to avoid alert fatigue, and security decisions should evaluate the total cost of ownership, including ongoing maintenance and incident response, not merely initial implementation costs.

Optimal security strategies vary significantly across deployment contexts. Smart city deployments (42.9% of studies) face massive scale and public privacy concerns, benefiting from centralized management but requiring careful security–privacy balance. Industrial environments (23.8% of studies) require particular attention to availability and segmented network architectures, given physical safety consequences. Healthcare facilities (14.3% of studies) face stringent regulatory requirements and benefit from privacy-preserving edge analytics. Critical infrastructure (9.5% of studies) justifies investment in premium hardware-based protections and may require sector-specific certifications.

For procurement decisions, organizations should prioritize vendors providing transparent security documentation, secure authenticated firmware updates with rollback capabilities, demonstrated standards compliance (NISTIR 8259A, ENISA guidelines), and long-term security support commitments matching device lifecycles of 5–10 years.

5.4. Comparison with Existing Work

Our findings align with existing IoT security reviews [6,19] in identifying resource constraints, heterogeneity, and scalability as fundamental challenges. However, our domain-specific focus revealed additional constraints not emphasized in general IoT reviews, particularly the tension between real-time processing requirements and security overhead. We extend [5] attack taxonomy by systematically evaluating mitigation effectiveness and implementation challenges, refs. [39,89] revealing that studies reported production deployments, suggesting the security community has focused more on identifying problems than validating solutions in operational contexts.

Our 2021–2025 timeframe captures the evolution of threats following significant security incidents [77], not covered in earlier reviews [8]. Importantly, we are the first, to our knowledge, to systematically evaluate the applicability of security frameworks specifically for IoT-VSS, addressing a critical gap in the literature, which typically evaluates frameworks based on comprehensiveness rather than practical implementability in resource-constrained environments.

Table 14 presents a structured comparison of the SLR study against five closely related existing reviews across six evaluative dimensions. These SLR reviews comprehensively cover six domains, covering IoT-VSS exclusively over the period 2021–2025, with an explicit assessment of mitigation effectiveness, framework applicability, and deployment context, dimensions that prior reviews addressed partially or not at all. Ref. [5] is limited to VSS attacks with partial mitigation coverage, while [6,7,8] address broader IoT scopes with no framework applicability. Ref. [11] focused on air-gapped IoT and lacked mitigation and deployment coverage. Collectively, these gaps underscore the absence of a unified, deployment-aware security framework that systematically addresses multi-layered security challenges inherent in IoT-based video surveillance systems.

Table 14. Comparison of this SLR and closely related existing reviews.

Review	Scope	Timeframe	VSS-Specific	Mitigation Effectiveness Assessed	Framework Applicability	Deployment Context Satisfaction
SLR	IoT-VSS	2021–2025	Yes	Yes	Yes	Yes
[5]	VSS attacks	Pre-2021	Yes	Partial	No	No
[34]	Broad IoT	Pre-2022	No	Partial	No	No
[7]	IoT Auth	Pre-2025	No	Partial	No	No
[8]	Broad IoT	Pre-2020	No	no	No	No
[11]	Air-gapped IoT	Pre-2023	Partial	Partial	No	No

Note: Yes = Addressed; No = Not addressed; Partial = addressed only for a narrow subdomain.

5.5. Limitations

Our review has several methodological limitations. Restriction to English-language publications potentially excluded relevant research from non-English-speaking regions where IoT surveillance systems are extensively deployed, particularly China, Russia, and Middle Eastern countries. Our 2021–2025 timeframe, while capturing recent developments, may underrepresent foundational work. Publication bias likely affected our review, as studies reporting novel attacks or successful solutions are more likely to be published than those with negative results. Qualitative synthesis, while appropriate for the heterogeneous evidence base, limits definitive quantitative conclusions about mitigation effectiveness.

The underlying evidence base itself has significant gaps. The scarcity of production deployment reports means our understanding of real-world implementation challenges relies primarily on laboratory evaluations that may not reflect operational conditions. Cost-effectiveness analysis was notably absent (only 38.1% addressed cost), and long-term evaluations were rare. Limited evaluation of combined security approaches means their collective effectiveness, potential conflicts, and cumulative overhead remain poorly understood.

Generalizability is most direct for contexts covered in our review, mainly smart city, industrial, and healthcare deployments in Asia, North America, and Europe. Applying this to other contexts, such as residential deployments in developing regions, should be approached with caution. The swiftly changing nature of threats and technologies means our findings reflect a 2021–2025 snapshot that may need revision as quantum computing and 6G networks develop.

5.6. Future Research Directions

Our findings reveal several critical research priorities. First, production deployment studies documenting real-world implementation challenges, operational costs, and long-term sustainability are essential; industry–academic partnerships could facilitate such research. Second, lightweight post-quantum cryptography optimized for video streaming represents a high priority given resource constraints and emerging quantum threats. Third, human-centered security operations research addressing alert fatigue through prioritization algorithms and workflow designs accounting for cognitive limitations is needed.

Fourth, privacy-preserving security analytics using techniques such as federated learning, differential privacy, and homomorphic encryption deserve investigation in video surveillance contexts. Fifth, hybrid security architectures that adaptively adjust security intensity based on risk assessment, available resources, and operational requirements could provide more practical solutions than current one-size-fits-all approaches. Sixth, frameworks for security cost–benefit analysis specific to IoT-VSS would enable economically rational security investments. Finally, standardization efforts specifically targeted at IoT-VSS through multi-stakeholder processes involving researchers, manufacturers, system integrators, operators, and regulators could address the framework fragmentation identified in our review.

6. Conclusions

The systematic review examined 21 peer-reviewed studies on cybersecurity challenges and mitigation strategies in IoT-enabled video surveillance systems published between January 2021 and July 2025. The evidence shows that IoT video surveillance systems face persistent and interdependent vulnerabilities across device, network, and cloud layers. In response to RQ1, recent implementation research shows a shift towards highbred edge-cloud architectures, but real-world deployment evidence remains limited. In response to RQ2, the most important vulnerabilities include default credentials, insecure firmware, unencrypted streams, weak protocol configuration, metadata leakage, excessive privileges and cloud misconfiguration. In response to Q3, existing frameworks such as NIST CSF, ISO/IEC 27001, ENISA IoT guidance, GDPR DPIA and Zero-Trust principles are useful but require adaptation to the real-world, resource-constrained, privacy-sensitive nature of video surveillance. In response to Q4, current mitigation strategies provide partial protection, but their effectiveness is constrained by latency, computational overhead, scalability, energy consumption, and legacy system compatibility.