What Happens to Your Footage When the Vendor Sunsets the Product Line?

When a cloud-managed camera reaches end of support, the vendor stops guaranteeing security fixes and stops guaranteeing the connection to the console you use to reach your video. Owned hardware on your own storage solves the second problem, not the first.

Every cloud-managed camera you buy has two dates attached to it. Neither one appears on the quote or comes up in the demo, and both are published where anyone can read them before signing.

The first is end of sale: the last day the vendor will sell you that model. The second is end of support: the last day the vendor will affirmatively support it. The gap between the second date and the end of your depreciation schedule is the part of the purchase nobody runs the arithmetic on, and it's where cloud camera fleets quietly turn into liabilities.

This isn't an argument about whether cloud platforms are good. It's an argument about time, and you can settle it with a calculator and two published web pages.

Two Dates, and Where to Find Them

Vendors that run disciplined lifecycle programs publish these dates. That's a point in their favor, and the argument here depends on it.

Cisco Meraki keeps a public end-of-life page listing announcement, end-of-sale and end-of-support dates by product, plus a published support policy defining the terms. The policy defines the end-of-sale date as "The last date to order the product through Cisco Meraki point-of-sale outlets," and the end-of-support date as "The last date a product will be affirmatively supported by Cisco Meraki, typically five years following the EOS Date" (Cisco Meraki support policies, retrieved 2026-09-24).

The same policy is candid about what can change after the end-of-support date. Meraki says it can't guarantee that legacy hardware will be able to connect to the management software indefinitely, that its technical support may no longer troubleshoot that hardware, and that it may no longer issue firmware updates or patches for it (same source).

Read the first of those again. For a cloud-managed camera, the management software is how you reach the video.

In fairness, the policy also says legacy products typically can connect for their entire useful life, and that if connectivity or troubleshooting does end, Meraki will use best efforts to offer a workable upgrade and, failing that, credit the remaining license time on a prorated basis (same source). That's a real remedy. It's a credit, though, not a promise that you'll reach last year's footage.

A Worked Example From Published Dates

Numbers make this concrete, and these are the vendor's own.

Product	Announced	End of sale	End of support	Support window after last sale date
MV Gen 2 cameras	Aug 11, 2025	Dec 31, 2025	Dec 31, 2030	5 years
MV21-HW, MV71-HW	Mar 19, 2019	Jun 19, 2019	Jun 19, 2026	7 years

Dates as published on the Cisco Meraki end-of-life products and dates page, retrieved 2026-09-24.

Two things fall out of that table immediately.

The support window isn't fixed. One line got five years after end of sale. The other got seven. The policy says "typically five years," and typically is doing real work in that sentence. It's a planning guideline, not a floor, so the only number that matters is the one published for your specific model.

And the second line has already expired. The end-of-support date for MV21-HW and MV71-HW was June 19, 2026. Any of those cameras still mounted and connected today are running past the last date the manufacturer said it'd affirmatively support them.

Now run the arithmetic the sales conversation skips. Suppose a buyer bought MV Gen 2 cameras on the last day they were available, December 31, 2025. Support runs to December 31, 2030, so five years. If that buyer's finance team depreciates camera hardware over seven years, the fleet spends its final two years on the books as an asset the manufacturer no longer supports. Nothing went wrong. Nobody was misled. The two clocks were never compared.

What Actually Stops on Each Date

End of sale is the gentler of the two. You can't buy the model anymore, which matters for standardization and spares. Fleets that grow after the end-of-sale date end up mixed-generation, an operational annoyance rather than a risk.

End of support is where the substance is, and it lands in three places.

Firmware may stop. It can taper earlier, too: Meraki's policy sets a separate firmware version restriction date, after which legacy hardware isn't eligible for future firmware upgrades and gets engineering support only for critical security vulnerabilities, until it reaches end of support (same source). A camera that stops getting security patches is a working camera turning into a growing exposure, and we'll come back to that.

Troubleshooting may stop. Support for that hardware may be discontinued, so a fault becomes your problem or your integrator's.

The management plane becomes uncertain. For a cloud-managed product, this is the one that decides whether you can still get your video. The console is the way in, wherever the video is stored, and the vendor has explicitly declined to guarantee that connection indefinitely after the end-of-support date.

That last point inverts an assumption most buyers hold without examining it. With an on-premise recorder, the hardware failing is the risk and the footage sits in your building. With a cloud-managed system, the hardware can be in perfect condition and the way in can still go away.

What Happens to Recorded Video

It depends on where the video lives and what the contract says, which is why this belongs in procurement rather than in an incident review.

Ask three questions and write down the answers.

Where is recorded video stored: on the device, on a local appliance, in the vendor's cloud, or split across them? If any part of the archive is in the vendor's cloud, retention is tied to the platform's lifecycle whether or not anyone's said so.

What's the documented export path, and does it work without the console? A platform that can only export through its cloud interface has tied your archive to a service with a published end date.

What are the vendor's written obligations at end of life? Some vendors commit to a data export window. Some don't commit to anything. The difference is invisible until it matters, and it's exactly the kind of thing that sounds reassuring in a meeting and vague in the contract.

Portability is the other half of the same problem: whether the file you export can be opened by anyone else at all. An archive you can only read through a proprietary path, on a platform with a published end-of-support date, has two expiration risks stacked on top of each other.

The Security Problem After Support Ends

A discontinued camera doesn't become inert. It becomes an unpatched computer on your network, and one documented case makes the point better than any hypothetical.

Amazon Cloud Cam reached end of life on December 2, 2022. In 2025 a vulnerability in the device was published as CVE-2025-6031. Amazon's description, carried in the National Vulnerability Database record, reads: "Amazon Cloud Cam is a home security camera that was deprecated on December 2, 2022, is end of life, and is no longer actively supported. When a user powers on the Amazon Cloud Cam, the device attempts to connect to a remote service infrastructure that has been deprecated due to end-of-life status. The device defaults to a pairing status in which an arbitrary user can bypass SSL pinning to associate the device to an arbitrary network, allowing for network traffic interception and modification" (published 2025-06-12, last modified 2026-06-17, retrieved 2026-09-24). Amazon, which issued the CVE, scored it 7.7 under CVSS 4.0 and 7.5 under CVSS 3.1, both rated High, and the NVD record lists those scores (same source).

Amazon's own security bulletin on the same CVE offers no patch and no mitigation. Its resolution is a single sentence: "This product was end of life as of December 2, 2022 and should not be used" (AWS Security Bulletin AWS-2025-013, retrieved 2026-09-24).

Look at the mechanism, because it's the part that generalizes. The vulnerability exists because the device was designed to phone home to infrastructure that no longer exists. When the service went away, the camera fell back to a pairing state an attacker can exploit. The end-of-life event didn't just remove support. It created the vulnerability.

That's the structural lesson for anyone running cloud-managed cameras. The failure mode isn't "the camera stops working." It's "the camera keeps working, in a degraded state nobody's monitoring, with no patch coming." A device that's unsupported, still powered and still on your VLAN is an asset on your books and a liability on your network. It's the same reasoning behind our position that an IP camera is a computer on your network and that its exposure is decided by the vendor behind it.

None of this makes Amazon or Meraki bad actors. Amazon published a bulletin telling people to stop using the device, which is the responsible thing to do. Meraki publishes its end-of-support dates years ahead. The point isn't that vendors misbehave at end of life. It's that end of life arrives on a schedule the buyer could've known about and usually didn't ask for.

Run the Overlap Before You Buy

Here's the whole method, and it fits on one line: put the vendor's published end-of-support date next to the last day your depreciation schedule carries the asset, and look at the gap.

If support ends first, you've got a stranded-asset window, and you should decide now who owns it. The options are all reasonable and all better than discovering the gap in year six: shorten the depreciation schedule to match the support window, budget a refresh at the support date, negotiate a written extended-support commitment before signing, or choose an architecture where the support date doesn't control your access to the footage.

If you're buying today, ask for the end-of-support date of the specific model in writing, not the product family. Families outlive models. The MV Gen 2 line reaching end of sale in December 2025 didn't end the MV product family, but it started the support clock on those particular units.

And check the date on any hardware you already own. If a model in your fleet has an end-of-support date in the past, that isn't a future planning item. It's a current condition.

The Owned-Hardware Alternative, and Its Honest Limits

Iron Gate designs, engineers, assembles and tests its systems in Holly Hill, Florida, and we sell owned hardware rather than access to a platform, so we've got an obvious interest in this argument. Here's the version with the limits included.

What ownership changes is the failure mode. When recording and retention live on equipment you own, on your premises, the vendor's product lifecycle doesn't decide whether you can reach your own video. That's a real structural difference, and it's the same reasoning behind our comparison of cloud and on-premise camera architecture, our position on data sovereignty and our look at the total cost of subscription-dependent hardware.

What ownership doesn't change: hardware still ages, firmware still needs maintaining, and somebody still has to patch things. An on-premise system nobody updates isn't safer than a cloud system that gets patched automatically. It's differently exposed. Owning the hardware moves the responsibility to you, and that's only an improvement if you pick it up.

We're also not going to dress up our own support life. Iron Gate publishes a 7-year warranty on camera systems, 5 years on SecMod portable units and 3 years on other hardware, and a warranty isn't a support-life commitment: it covers defects in the hardware, not how long firmware keeps coming. Our current firmware support commitment is one year on purchased hardware, or the length of the lease on leased hardware. That's shorter than our camera warranty, which means an owned system needs a plan for security fixes after year one. Get that plan for your model in writing, from us included, and hold us to the same standard as everyone else. It'd be a strange article that exempted us.

Five Lifecycle Questions to Put in Writing Before Purchase

Ask these of every camera vendor, including us, and keep the written answers in the procurement file rather than relying on what was said in a meeting.

What's the published end-of-support date for this exact model, and where is it published?

What's your stated policy for how long support runs after end of sale, and is that a commitment or a typical?

After the end-of-support date, what specifically stops: firmware, troubleshooting, cloud console access, or all three?

If the cloud console is retired, what's the documented path to retrieve or export archived video, and what's the export window?

What advance notice do you commit to before an end-of-sale or end-of-support announcement?

A vendor who answers all five in writing is telling you they've thought about the end of the relationship, not just the beginning. That's a better signal about the next seven years than any spec on the datasheet.

Common Questions

What happens to my security cameras when the manufacturer stops supporting them?

Typically three things: firmware updates may stop, troubleshooting support may end, and for cloud-managed products, continued access to the management console is no longer guaranteed. The cameras usually keep running, which is what makes this risk easy to ignore until a vulnerability is published with no patch coming.

How long do cloud security cameras receive firmware updates?

It varies by vendor and model, so the only reliable answer is the published date for your specific product. As one example, Cisco Meraki's policy says support typically runs five years after the end-of-sale date, while its own end-of-life table shows one MV line with a five-year window and an older pair with seven. Firmware can taper before that: after Meraki's firmware version restriction date, legacy hardware gets no new firmware upgrades and only critical security fixes until end of support (Cisco Meraki support policies and end-of-life page, retrieved 2026-09-24).

How do I find the end-of-support date for my camera model?

Look for the vendor's end-of-life or product lifecycle page, which disciplined vendors publish and keep current, and search for your exact model number rather than the product family. If a vendor doesn't publish lifecycle dates at all, that's an answer too.

Can I still use a security camera after the cloud service shuts down?

Sometimes it keeps recording locally and sometimes it doesn't, but "can I" and "should I" are different questions. Amazon's security bulletin for CVE-2025-6031 says the Cloud Cam "was end of life as of December 2, 2022 and should not be used" (AWS Security Bulletin AWS-2025-013, retrieved 2026-09-24). An unpatched, unsupported device on your network is a risk whether or not it still shows a picture.

Is an unsupported camera actually dangerous, or is that overstated?

CVE-2025-6031 carries a CVSS 4.0 base score of 7.7, rated High, assigned by Amazon and listed in the National Vulnerability Database (retrieved 2026-09-24), and the vulnerability exists specifically because the device's cloud infrastructure was retired. In that case, the end-of-life event created the risk rather than just leaving it unpatched.

What should I ask a camera vendor about lifecycle before buying?

Ask for the end-of-support date of the exact model in writing, what the support policy commits to versus what it calls typical, exactly which services stop at that date, the documented export path if the cloud console is retired, and how much advance notice you'll get. Then compare that date to your depreciation schedule before you sign.

Sources

• Cisco Meraki, End-of-Life (EOL) Products and Dates, retrieved 2026-09-24.
• Cisco Meraki, Support policies, Product End-of-Life (EOL) Policy, retrieved 2026-09-24.
• NIST National Vulnerability Database, CVE-2025-6031, published 2025-06-12, last modified 2026-06-17, scores assigned by Amazon as the issuing organization, retrieved 2026-09-24.
• Amazon Web Services, Security Bulletin AWS-2025-013, Insecure device pairing in end-of-life Amazon Cloud Cam, retrieved 2026-09-24.

To walk through lifecycle exposure and retention for a specific fleet, call 904-896-5618 or book a security assessment.

Iron Gate Technologies