What a human operator can actually watch
Walk into any guard shack or SOC. There's a wall of feeds, and there's a human reading their phone, talking to a coworker, or doing administrative work. That's not laziness. It's biology.
The vigilance research, going back to Norman Mackworth's 1948 radar-operator studies, reaches the same conclusion in every replication. Sustained attention on a monitoring task decays sharply after about 20 to 30 minutes, and the miss rate on infrequent target signals climbs into the double digits inside an hour. The FAA, the Air Force, and the security industry have all run their own versions with the same result.
The number of feeds a trained operator can usefully scan at once lands between four and nine, depending on event frequency and screen layout (ASIS, IFSEC estimates). A 50-camera site already exceeds that. A 200-camera multi-building campus is mathematically beyond what any single human can monitor. The 80-camera retailer staffing one CCTV operator per shift isn't catching events. They're filming evidence after the fact. That's the gap analytics fills.
What gets automated, and what still needs a human
Analytics handles the always-on, multi-feed work a human won't do consistently: after-hours person detection with object classification (so deer and wind-blown signage don't fire alerts), LPR at gates and docks, tailgating at access doors, PPE compliance on production lines, loitering and zone-entry rules, slip-trip-fall detection, and after-hours motion in closed areas. None of these is something a human couldn't do in principle. All of them are tasks a human won't do reliably across a shift, across multiple feeds, across multiple sites.
What analytics doesn't replace is the human work it depends on: verification (a trained operator pulls the live feed and confirms before anyone escalates), decision-making under ambiguity (did the cleaning crew change schedules?), communication (calling the right person, escalating to law enforcement), the two-to-four-week tuning exercise that drops false positives into a useful band, and incident review for claims and prosecution. The model produces the timeline; a human turns it into a case. The SOC operator now verifying twenty real alerts a shift instead of scanning two hundred feeds for nothing is doing more valuable work, not less.
What a multi-site rollout actually looks like
The path most multi-site operators end up taking, in order.
- One pilot site. Two to four weeks. Establish the false-positive baseline, tune the most aggressive rule (usually after-hours person detection or PPE), confirm the camera angles support the analytics you bought.
- Two to five expansion sites. Validate that the rules tuned at the pilot transfer to the expansion sites. They usually mostly do, with some location-specific tuning per camera angle.
- Wave-based rollout. 10 to 15 sites per wave on a fixed cadence (4 to 6 weeks per wave). The cadence is what matters. Predictable wave completion builds operator trust and lets the central team plan the next wave's resources.
- Steady-state. Central SOC monitoring, weekly false-positive review by site, monthly compliance report to ops leadership, quarterly tuning cycle.
The deployments that fail skip the pilot, push all sites live at once, get hammered by false positives, lose operator trust in week two, and never recover.
What it actually costs
Per Security Industry Association multi-site benchmarks: $35K to $220K per site for a full multi-site enterprise install (any vertical), median around $95K. Retail-specific multi-location rollouts come in lower at $15K to $60K per store. Analytics-only overlay onto existing cameras costs less, often $5K to $25K per site plus a per-camera license. Payback usually lands in 12 to 24 months, not 6, from a combination of reduced labor, reduced shrink, fewer false-alarm fines, and reduced premium exposure from verified response. What doesn't hold is payback from "AI catches a $500K theft on day one." Vendor pitches that lead with that number are pitching the rare event, not the operating model.
The conversation that gets to the right answer fastest names what you'd want a human doing 24/7 if you could afford it, then asks which of those tasks the analytics handles. Most of them, if you can articulate the task. None of them, if you can't.