A mandate, an audit or a funding condition has put Hikvision on a list, and the replacement quote that came back is higher than anyone budgeted for. Before you sign it, separate the two decisions that quote has bundled together.
The camera brand and the software that manages the cameras are separate choices, and only one of them is usually forced. Some requirements apply to the hardware itself, and the only way to meet them is to take the cameras down. Others are about how the system is run and secured, and a new management layer can address them while the cameras stay on the wall for now.
This guide starts with that replace-or-keep question, then compares eight Hikvision competitors on who each one is best for, how it is licensed and whether it works with the cameras you already own. It closes with the rebadging trap, what you give up by leaving a native Hikvision stack, and where the cost actually lands.
TL;DR
- This guide is for IT and security leads who run Hikvision cameras and have been told, by an auditor, a funder or a customer, to deal with them.
- Federal contracts, grant-funded purchases and some insurer or corporate policies require the Hikvision hardware itself to go; a new management layer alone does not satisfy them.
- Where the hardware can stay for now, Coram replaces the recorder and software, works with RTSP cameras on H.264 or H.265, and lets camera replacement follow the budget.
- The trap to avoid is buying a differently branded camera that is Hikvision hardware underneath, which leaves the original compliance problem in place.
- Next step: write down which rule actually applies to your organization, by name, before comparing a single quote, because that rule decides everything after it.
{{cta-component}}
Do You Actually Have to Replace the Cameras?
Whether you have to replace Hikvision cameras depends on which rule applies to you, not on the cameras. If the requirement comes from a federal contract, a federal grant, a state procurement law, an insurer or a written corporate policy that names the hardware, the cameras have to come out. If the concern is how the system is managed, patched and exposed to the internet, the cameras can often stay while the software and recorder change, and replacement can be phased.
When physical removal is required
The federal rule most buyers meet is Section 889 of the FY2019 National Defense Authorization Act, implemented in FAR 52.204-25. Since August 13, 2019, federal agencies may not procure covered video surveillance equipment, which the regulation defines to include equipment produced by Hikvision, Dahua and Hytera or any subsidiary or affiliate of those companies. Since August 13, 2020, agencies also may not contract with an entity that uses covered equipment as a substantial or essential component of any system. That qualifier matters, and it is why a federal contractor should read its own contract language rather than a vendor's summary of it.
Federal grant money carries its own rule. 2 CFR 200.216 bars recipients and subrecipients from using federal award funds to procure or obtain covered equipment, which is why schools, cities and nonprofits spending grant money meet the restriction even when they never contract with the federal government directly.
The FCC adds a market-level restriction. Hikvision is on the FCC's Covered List, and a June 2026 FCC public notice, effective July 16, 2026, prohibits continued importation and marketing of certain previously authorized covered equipment. It also says that continued use of lawfully purchased equipment is not affected. That means the FCC rule makes expansion and replacement parts harder to get, but it does not by itself order an existing installation torn out.
States and other countries have gone further in places. Louisiana's RS 39:1753.1, effective January 1, 2021, names Hikvision and bars covered purchases by state agencies, parishes, cities and public schools. Canada ordered Hikvision's Canadian business wound up in 2025, and the Federal Court dismissed Hikvision's challenge. Insurers and corporate security policies increasingly name the brand as well. Where any of these applies, removal is the requirement.
When a software change is enough
Where no rule names the hardware, the problem is usually the head end: an aging recorder, software that is hard to patch, remote access built on port forwarding, and a management layer that does not fit the rest of the IT estate. That part can change without touching the cameras.
Coram's documented requirement is narrow and checkable: "Coram supports any camera that: Streams over RTSP (Real-Time Streaming Protocol), and Uses the H.264 or H.265 video codec." Coram Point connects to ONVIF and RTSP cameras, and Coram publishes setup guidance for several camera brands, including Hikvision, Hanwha and Axis. Cameras that only stream MPEG are not supported, and analog cameras can join through a video encoder.
The same paragraph has to carry the limit, so here it is plainly: keeping Hikvision cameras on Coram, or on any other software, does not make those cameras compliant with a rule that applies to the hardware. Every camera in Coram's own lineup is NDAA compliant; that statement covers Coram's cameras only, not third-party cameras that Coram manages. The software path buys time and a better-run system, not a compliance outcome. The step-by-step migration, from fleet audit to documentation, is covered in our guide to replacing Hikvision.
What network isolation does and does not solve
Practitioners make a fair point: a camera on a non-routable network segment, with no gateway and no outbound path, cannot reach the internet, so the risk that worries security teams is largely contained. As a cybersecurity control, isolation works, and it is a sensible interim step for any site still running Hikvision hardware.
It often fails as a compliance answer anyway, because the rules above are written about the equipment, not the network. Section 889 asks whether covered equipment is used as a substantial or essential component of a system; 2 CFR 200.216 asks what grant money bought. Neither asks which VLAN the camera sits on, so an auditor reading either one will treat an isolated Hikvision camera as a Hikvision camera.
The honest reading is that isolation reduces cyber risk and does not change compliance status. If no hardware rule applies to you, isolation plus a new management layer may be enough for a long time. If one does, isolation is how you keep the cameras safe until the day they come down.
How to Evaluate a Hikvision Replacement
Hikvision replacements fall into three groups. A like-for-like hardware swap replaces every camera and recorder with another manufacturer's line, usually with that manufacturer's own management software. A hardware-plus-platform change replaces the cameras and moves to a new management layer at the same time. A management-layer-only change keeps the cameras, at least for now, and replaces the recorder and software.
The rule you are under decides which group is open to you. If a hardware rule applies, the management-layer-only path is a bridge at best, and the real choice is between the first two.
Within a group, three criteria separate the options. The first is whether the new system works with the cameras you already own, and what it does with them: some platforms ingest a third-party stream fully, some ingest it with reduced features, and some only work with their own hardware.
The second is the licensing shape. Per camera, per device or per connection, perpetual or term, and whether a recorder or appliance is a separate purchase all change the number more than the camera price does.
The third is the compliance paperwork. Ask each hardware vendor for its written NDAA statement and keep it with the purchase record, because the statement, not the brand, is what an auditor will ask to see. For a single-site, budget-camera comparison, our Reolink vs Hikvision guide covers that ground.
Hikvision Competitors and Alternatives Compared
Each cell below reflects the vendor's own published documentation.
The Eight Alternatives
Coram: best for IT teams keeping existing cameras and replacing the software layer
Coram Video Security runs on a Coram Point appliance at each site, which records on site and replaces the existing NVR, and connects to cameras that stream over RTSP with H.264 or H.265. Coram publishes ONVIF setup guidance for brands including Hikvision, Hanwha and Axis, and analog cameras can join through a video encoder.
Coram's AI runs on the Coram Point rather than inside the camera, so Discover's natural-language search and alerts do not depend on the camera's own analytics. Licensing is a per-camera term license plus the appliance. Video Security is part of Coram's AI physical security platform, alongside Access Control, Emergency Management and Guest Management. Wrong for: teams that need two-way audio or talk-down today, which Coram does not support, and anyone hoping software will make Hikvision hardware compliant.
Axis Communications: best for buyers who want an Axis-first hardware line and specialty form factors
Axis states that all of its products are NDAA Section 889 compliant, and most use its in-house ARTPEC chips. AXIS Camera Station Pro licenses each device once: Core licenses for Axis devices, Universal licenses for third-party ONVIF Profile S and RTSP devices, so mixed fleets can be managed during a transition. The strength is breadth of form factors and a hardware line built around Axis's own silicon. Wrong for: buyers who want a management platform that treats every camera brand equally, since Axis Camera Station is optimized for Axis devices and third-party cameras need the Universal license.
Hanwha Vision: best for a like-for-like hardware swap driven by a compliance mandate
Hanwha Vision publishes an NDAA statement and states that all of its manufacturing facilities are in Vietnam and South Korea, which it says makes its products TAA compliant. It is the most common like-for-like swap when a rule forces the hardware out, because its camera line covers the same range of form factors. Its Wisenet WAVE software is licensed per camera. Wrong for: organizations trying to keep their existing cameras, since Hanwha's value here is the replacement hardware, and teams looking for an AI and multi-site management layer as the main event.
Avigilon: best for large deployments already standardized on Motorola
Avigilon, a Motorola Solutions company headquartered in Vancouver, sells two lines: Avigilon Alta, which is cloud-managed, and Avigilon Unity, its on-premise line. Avigilon states its hardware is compliant with Section 889. Alta's Cloud Connectors bring third-party cameras into the platform, and Avigilon's own documentation says they provide analytics for all connected cameras. Best for organizations already standardized on Motorola video, or buying into it. Wrong for: teams that want one architecture decision, since choosing between Alta and Unity comes first. Our Avigilon vs Verkada vs Coram comparison covers the head-to-head.
Verkada: best for teams who want cloud-managed hardware and will accept a closed stack
Verkada sells cameras, storage and software as one cloud-managed system, and its own pricing page notes that the price includes hardware and an additional license is required. Its Command Connector extends support to certain third-party cameras over ONVIF Profile S and RTSP, with compatibility listed model by model. Verkada addresses NDAA product by product. Best for teams that want cloud-managed hardware from one vendor and are comfortable standardizing on it. Wrong for: estates that want to keep a large mixed camera fleet as a long-term plan, because the platform is built around Verkada's own cameras.
Rhombus: best for a phased move to cloud-managed cameras
Rhombus states that it sources all hardware from NDAA and TAA whitelisted manufacturers and that its devices are engineered in-house. Its Relay Core appliance connects any camera with RTSP streaming, up to 10 third-party cameras per device, and Relay Lite pairs one third-party camera with each Rhombus camera at no extra cost. Analytics on Relay-connected cameras depend on the Rhombus license tier. Best for teams moving to cloud-managed cameras over a phased transition. Wrong for: sites that want hands-off maintenance of the old cameras, since Rhombus says firmware updates for third-party cameras stay with your team.
Genetec Security Center: best for large enterprises with security engineering teams
Genetec Security Center unifies video, access control and license plate recognition for large, complex estates, and it runs on-premise or as Security Center SaaS, which Genetec prices per connection. Genetec is a software platform, so NDAA status depends on the cameras and servers it is paired with. Its depth of integration is a genuine strength for organizations that want security configured around their own requirements. Wrong for: lean IT teams managing security alongside everything else, because a large Security Center deployment assumes security engineering staff who design, configure and run it.
Milestone XProtect: best for multi-vendor estates that want device-level licensing
Milestone XProtect is an open video management system with a published list of supported devices, and Milestone's documentation says you generally need one device license per hardware device with a camera. Like Genetec, it is software, so NDAA status rests on the paired hardware. It suits multi-vendor estates that want to keep many camera brands under one system and prefer device-level licensing with Milestone Care for upgrades. Wrong for: teams that want AI search built in rather than added, and organizations that do not want to run their own recording servers.
A note on Dahua
Dahua is not on this list. It is named alongside Hikvision in Section 889 and on the FCC Covered List, so it does not solve the problem that sent you looking.
The Rebadging Trap: Brands That Are Hikvision Underneath
The rebadging trap is the most expensive mistake in a Hikvision replacement: a buyer replaces Hikvision cameras with a differently branded line and ends up with the same hardware. Federal rules anticipate this. FAR 52.204-25 covers equipment produced by Hikvision or any subsidiary or affiliate, and an auditor applies the rule to what the device is, not what the housing says.
Rebadging is common because many camera brands do not manufacture their own hardware. IPVM, the industry research publication, maintains a Hikvision OEM Directory of brands it says it verified through shipping records, documentation or product testing. Its list includes brands such as Annke, Alula, Arcdyn and Aritech, and IPVM notes that Hikvision also ships under its own sub-brands, including EZVIZ, HiLook, Hikmicro and HiWatch.
IPVM also notes that the list cannot be complete, because most rebadgers conceal the relationship, and that some brands on earlier versions have since stopped selling Hikvision OEM products. IPVM keeps a separate Dahua OEM Directory on the same basis, and the same logic applies to it.
Because a list can never be complete, check the device rather than the brand. Look up the FCC ID on the label: the FCC record names the grantee that certified the device, and its filings can include test reports and internal photos, though some exhibits are withheld under confidentiality requests.
Compare the web interface and the discovery tool the camera answers to, since rebadged units often keep the original manufacturer's software with cosmetic changes. Ask the vendor in writing for the chipset and system-on-chip manufacturer, and for a written NDAA statement that covers the specific models you are buying.
A procurement team can also move the risk to the vendor: ask for a contract clause confirming that no covered equipment, including subsidiary or affiliate hardware, is supplied under the order. If a vendor will not put the chipset origin and the NDAA statement in writing for the exact models on the quote, treat that as the answer.
What You Lose When You Move Off a Native Hikvision Stack
Moving Hikvision cameras onto any other platform keeps the video and loses some of what the native stack did, and the trade is worth stating plainly before the migration rather than after it.
Generic ONVIF and RTSP carry the video stream. They do not always carry a camera maker's own smart events, classification or proprietary analytics, and on Coram, the analysis happens on the Coram Point appliance rather than in the camera, so the camera's own detections are not what drives alerts.
PTZ and fisheye controls depend on the camera's ONVIF support; a camera connected over plain RTSP gives you basic video only. The trade looks similar on other platforms that ingest third-party cameras: Verkada's Command Connector lists compatibility model by model, and Rhombus ties analytics on Relay-connected cameras to its license tier.
Two-way audio is a real gap on Coram today. If talk-down through camera speakers is part of how your site operates, Coram is the wrong fit until that changes, and you should say so to any vendor before a pilot rather than discover it during one.
The setup tooling changes too. The single-vendor configuration tools that came with the Hikvision recorder go away, and camera-level settings such as image tuning stay in each camera's own web interface. The existing Hikvision NVR is replaced by Coram Point rather than reused, which is also where its compliance problem leaves the building. And cameras that only stream MPEG cannot be carried over at all.
None of this is unusual for a migration, and none of it is a reason to stay on a stack a rule says you have to leave. It is a reason to test the specific cameras that matter most, including the ones on doors and parking areas, before committing. If image quality is part of the decision, start with the camera resolution you actually need rather than the highest number on a datasheet.
Where the Cost Actually Lands
The camera invoice is the number everyone sees first, and it is rarely the one that surprises people. Like-for-like replacements from Western and allied brands generally land well above Hikvision's price per camera, and the gap is wide enough that budget-tier substitutes often disappoint on low-light performance.
The number that surprises people is management licensing. When the software comes bundled with the recorder, many buyers have never priced a video management license separately. Every platform on this list charges for that layer in a different shape: Coram per camera on a term, plus an on-site appliance; Axis and Milestone per device; Verkada with a license alongside each camera; Genetec's SaaS per connection; and Rhombus by license tier. Multiply that shape across every camera and every year of the term before comparing quotes.
The other costs follow from the replace-or-keep decision. A hardware rule means cameras, recorders, labor and, often, new mounts or cabling at the doors that matter most. A management-layer change means the recorder or appliance and the license, with cameras replaced later on a schedule you set.
The two paths can be combined, which is what most phased migrations end up doing: change the management layer first where the rules allow it, and replace hardware in order of risk. Ask every vendor to price the same three scenarios: keep all cameras for a year, replace the highest-risk cameras now and the rest later, and replace everything at once. Quotes built on the same scenarios can actually be compared, and the comparison usually shows the license term mattering as much as the hardware.
{{cta-component}}
Before You Sign the Replacement Quote
Two decisions got bundled into one replacement quote: the cameras and the system that runs them. Separate them, name the rule that applies, and only the part that rule forces has to happen now. The rest can follow the budget.
FAQ
.png)
