Abstract: A security system includes a server and at least one dual-mode image capture device. The capture device includes a camera that captures images of a field of view of a monitored area. When motion is detected in the monitored area, the capture device sends the images as video to a server, and when the motion is not detected in the monitored area, the capture device sends, at intervals, at least one still image to the server. Irrespective of whether the capture device has a cloud storage subscription, the server may store the still image(s) in a database for later retrieval as evidence of an event at or near the monitored area. In certain embodiments, when the still image(s) do not significantly differ from a reference image of the monitored area, the still image(s) may be discarded and not stored in the database.