Storage and Retention

Session recording generates volume faster than any other security control and is queried less often than almost any. The retention decision determines whether it is affordable.

What drives the volume

Video capture, overwhelmingly. Text is orders of magnitude smaller.

Session count and duration.

Screen resolution and colour depth for video.

Whether idle time is captured, which is frequently most of a session.

Tier coverage. Recording everything at the highest fidelity is the default configuration and rarely the right one.

Reducing it without losing capability

Match fidelity to tier. Video on tier zero, text everywhere else, metadata universally.

Suppress idle periods, which removes a large share of video volume.

Compress and deduplicate, which most products support.

Tier the storage: recent recordings on fast storage, older on cheap, oldest deleted.

Record commands rather than pixels wherever a shell is involved, which is both smaller and searchable.

Setting the period

Start from the obligation, not from what the storage allows. Some frameworks and jurisdictions specify a minimum.

Then from the use case: how far back do investigations actually reach? For most organisations the answer is weeks to months, not years.

Then from the legal position: retaining monitoring data longer than justified is itself a compliance problem in several jurisdictions, not a safe default.

Different periods by tier are defensible and usually correct.

Document the justification, because both an auditor and a regulator may ask, from opposite directions.

Deletion that works

Automated, because manual deletion does not happen.

Verified, with a report of what was deleted.

Including backups, which is where retained data survives a deletion policy.

With a legal hold mechanism that overrides deletion for specific matters, applied before the automation runs.

Test that a hold survives the retention job, which is a failure only discovered during litigation.

Access to the archive

Recordings contain credentials and sensitive data, so the archive is a high-value target.

Restrict access to a small named group.

Log every access, and review the log.

Require a reason recorded at retrieval.

Alert on bulk retrieval, which is either an investigation or a problem.

The cost conversation

Model it before deployment, using your own session volume rather than a vendor estimate.

Sessions per day, average duration, capture mode, retention period.

The number is frequently large enough to change the design, which is better discovered before purchase.

Present the trade-off explicitly: longer retention, higher fidelity, or broader coverage — you can have two.

What to keep longest

Metadata, which is small and answers the most common question.

Tier zero sessions.

Sessions flagged during review.

Sessions related to an incident, exported and held separately from the automatic retention.

Everything else can be short, and shortening it is usually the right answer once the actual query pattern is measured rather than assumed.

Modelling the volume before purchase

The storage bill is the most common budget surprise and it is calculable in advance.

Sessions per day, from your own authentication logs.

Average duration.

Capture mode per tier.

Compression and idle suppression, at the vendor's stated ratios and then discounted.

Retention period.

Multiply and add growth.

Check the result before choosing the retention policy, because the number frequently changes the design and it is much cheaper to discover that before signing.

Legal hold

The mechanism that overrides deletion, and it fails quietly if untested.

Applied before the retention automation runs, which requires legal to be part of the process for relevant matters.

Scoped to specific sessions, people or periods.

Preventing deletion in the archive and in backups, which is where retained data survives a hold that only covered primary storage.

Tested: apply a hold, run the retention job, confirm nothing was deleted.

Released when the matter ends, because indefinite holds accumulate and defeat the retention schedule entirely.