AI security platforms for models, apps and agents

HiddenLayer scans model files for malware, vulnerabilities and integrity problems. Its wider AI security platform adds AI discovery, attack simulation and runtime monitoring for models, applications and agents. The company's GitHub Action connects model scanning to CI/CD and supports SaaS or on-premises scanners.

HiddenLayer raised a $100 million Series B on 2 September 2026, led by Delta-v Capital. The announcement also describes Agent Harness Security for protecting AI coding agents at runtime. The website offers a sales demo for the platform.

IBM Guardium AI Security discovers AI deployments and assesses vulnerabilities and misconfigurations. Its AI firewall checks prompts and outputs for code injection, personal-data exposure and leakage.

IBM’s lifecycle record lists the SaaS product as generally available since 30 May 2025. It integrates with watsonx.governance to share inventory and risk information, giving buyers a security component that can work alongside governance processes.

Microsoft Defender for Cloud discovers AI workloads in Azure, Amazon Bedrock and Google Vertex AI, maps their components and flags configuration risks and attack paths through Defender CSPM. Agent discovery and posture features require Microsoft Agent 365 from 1 July 2026.

Its AI threat protection analyzes prompts and answers for threats including jailbreaks, data leakage and poisoning, and sends alerts to Defender XDR. This protection covers supported Azure OpenAI and Azure AI Model Inference services, scans text tokens, and excludes connected AWS accounts. Administrators enable the AI Services plan on an Azure subscription; an additional setting enables model scanning for malware and unsafe model components.

Microsoft sells the service through Azure. Public pricing meters AI Services by 1,000 tokens, with rates dependent on the selected offer and region. The trial ends after 30 days or 75 billion scanned tokens, whichever comes first.

Noma Security combines AI asset discovery, red teaming, agent access controls and runtime detection and response. It covers endpoint, SaaS and cloud agents. Teams can approve, review or block agents, MCP servers and skills, then monitor whether permitted actions become risky. Noma’s Open Enforcement approach applies policy through existing agent control points.

Palo Alto Networks Prisma AIRS provides AI inventory, supply chain scanning, red teaming, runtime protection and posture management. AI Supply Chain Security is the current name for the former AI Model Security capability. The platform also documents an AI gateway and agent identity controls.

The separate Managed AI Runtime Security offering is still advertised for preview and early access. Buyers should distinguish that managed service’s access terms from the platform’s other runtime deployment options.

Tenable One AI Exposure tracks how employees and agents use ChatGPT Enterprise and Microsoft Copilot. It checks AI settings, integrations and shared data, and applies policies for prompt injection, jailbreak attempts and sensitive data exposure. Its findings sit alongside cloud and identity risks in Tenable One. Tenable describes an agentless deployment.

The product belongs to Tenable, which completed its acquisition of Apex Security in 2025. Apex supplied capabilities for governing AI use and enforcing policies. The product page directs buyers to a demo and sales.

Amazon Bedrock Guardrails filters prompts and responses for harmful content, denied topics and sensitive information. Teams can block or mask supported sensitive data and configure safeguards for their application.

The ApplyGuardrail API works with Bedrock, self-hosted and third-party models, so the checks can sit around model calls outside Bedrock too. AWS also documents central enforcement across multiple AWS accounts for organizations that want shared safeguards alongside application-specific policies.

Arcjet provides SDKs and agent integrations for runtime security. Developers can apply prompt-injection, sensitive-data and content checks and control access to tools, MCP servers and APIs.

Its current platform also discovers agents, records activity and applies allow, hold or block decisions through an OPA/Rego policy engine. Buyers can start with application code or evaluate the broader inventory and audit controls through a trial or demo.

Cisco AI Defense combines AI asset discovery, supply chain scanning, adversarial validation and runtime guardrails. Its documented agent controls include MCP server scanning and protection for MCP requests and responses, covering risks such as tool misuse and privilege escalation.

Robust Intelligence technology is part of AI Defense. Teams can use Explorer Edition to red team models and agents before evaluating an enterprise deployment.

Cloudflare AI Security for Apps, formerly Firewall for AI, adds prompt-injection, personal-data and topic detections to its WAF. It became generally available on 11 March 2026.

Endpoint discovery is available on every plan; AI detection fields and the log-mode ruleset require a paid Enterprise add-on. Detection requires the WAF to be enabled and currently scans JSON requests to endpoints labeled cf-llm. Teams use detection fields in custom or rate-limiting rules to monitor or mitigate requests.

Enkrypt AI provides continuous adversarial testing, runtime guardrails and policy controls. Its platform tests use-case risks and translates internal policies into guardrails. Anaconda acquired Enkrypt AI on 4 August 2026, adding security for models, agents and MCP servers to the Anaconda Platform. Buyers can contact Enkrypt AI’s team to evaluate deployment and commercial terms.

F5 AI Guardrails checks model and agent interactions at runtime, with policies for prompt attacks, sensitive-data leakage and unwanted outputs. Teams can create custom guardrails and restrict agent actions and tool use.

F5 introduced AI Guardrails and AI Red Team after completing its CalypsoAI acquisition. The product page also documents enforcement logs, agent visibility and SIEM export for teams that need to review policy decisions.

Fiddler Guardrails evaluates prompts and responses against safety, security and privacy policies. It checks for jailbreaks, prompt injection, personal-data exposure and unsafe content, using configurable thresholds.

The checks run on Fiddler Centor Models, formerly Fiddler Trust Models, inside the customer’s cloud or VPC. Guardrails sits alongside Fiddler’s LLM and agent observability products. The site offers a demo for buyers evaluating policy enforcement within their own infrastructure.

Google Cloud Model Armor screens prompts and responses for prompt injection, sensitive data and malicious URLs. Teams configure templates and can use the service for applications on Google Cloud or other providers.

Image screening remains in preview, with support limited to JPEG, PNG and BMP images of up to 4 MB in the US and EU multi-regions. Buyers should also account for its single-turn processing: Model Armor inspects requests independently and does not retain conversation context across turns.

Guardrails AI provides runtime checks for policy violations, hallucinations and data leakage. Its Guardrails Hub lists validators that developers can use in AI applications.

Harvey acquired Guardrails AI on 8 September 2026, and the team joined Harvey’s product and engineering organization to work on agent reliability. Buyers considering a new commercial deployment should confirm the offering and support terms with the vendor.

Lakera checks prompts and answers for injection attempts, jailbreaks and sensitive data exposure. Its AI Agent Security product also discovers agents and MCP-connected tools and applies policies to tool use and agent actions. Lakera offers API-based cloud deployment, alongside AI red teaming. Dropbox names Lakera as a supplier for protecting its LLM applications.

Check Point acquired Lakera in 2025. Before the acquisition, Lakera raised a $20 million Series A on 24 July 2024, led by Atomico. Its published plan comparison lists a free Community plan with 10,000 requests per month and an 8,000-token prompt limit; Enterprise has custom pricing and SaaS or self-hosted deployment.

Azure AI Content Safety provides APIs for harmful content, prompt attacks and protected material. Its Task adherence API detects agent tool use that is misaligned with a user interaction. Teams can access guardrails through Microsoft Foundry or standalone Content Safety APIs.

Groundedness detection remains a public preview capability and will retire on 30 April 2027, alongside several other preview features. Direct use requires an Azure subscription and a Content Safety resource in a supported region. Buyers planning groundedness checks should review the linked migration guidance before committing.

NVIDIA NeMo Guardrails is an open-source Python library for programmable input, retrieval, tool and output checks. Teams configure policies with YAML, Colang flows and custom actions in their own applications.

The NeMo Guardrails microservice catalog now marks the artifact as unsupported. It states that NeMo microservices was sunset on 1 October 2026 and will receive no new releases. This changes the deployment choice for buyers who were considering the enterprise microservice.

The deployment guide still describes the microservice as an NVIDIA AI Enterprise option, and the catalog still lists an AI Enterprise license requirement for production. Buyers should resolve that documentation conflict with NVIDIA before planning a microservice deployment.

Radware LLM Firewall inspects prompts before they reach origin servers. It applies controls for prompt injection, resource abuse and sensitive personal data, with policies for unwanted AI content. The product is part of Radware’s cloud security offering, and buyers can contact sales to discuss commercial access and integration.

TrojAI combines red teaming with runtime checks for models, applications and agents. Its current product checks prompts and answers for attacks and data leakage, discovers agents and MCP servers, and monitors tool calls. It supports self-contained deployment on-premises or in a customer's cloud.

A10 Networks acquired TrojAI on 15 June 2026. TrojAI previously announced $5.75 million in additional seed funding on 3 April 2024, led by Flying Fish. A10's product page offers a sales demo.

CrowdStrike Falcon AI Detection and Response combines prompt visibility, threat detection, data protection, access controls and automated response. It covers endpoints, applications, agents, MCP servers and AI gateways. CrowdStrike lists Falcon AIDR as generally available within the Falcon platform, with a single sensor and console for those controls.

Dynamo AI tests AI applications before release with DynamoEval and checks prompts and answers at runtime with DynamoGuard. Its controls cover prompt injection, jailbreaks, data leakage and company policies. Experian describes using Dynamo AI for its generative AI deployments.

DynamoGuard runs in a customer's VPC or on-premises servers. Applications can replace their model endpoint with its guarded chat endpoint or call an analysis endpoint. A browser extension also checks staff use of ChatGPT and Microsoft Copilot.

The company is DynamoFL, Inc., trading as Dynamo AI. It announced a $15.1 million Series A on 16 August 2023, co-led by Canapi Ventures and Nexus Venture Partners. The product page directs buyers to contact the company for commercial terms.

Lasso discovers AI agents and applications, maps their models and tools, and assesses security posture. Teams can enforce policies inline through a proxy, API or AI gateway and investigate threats with agent and attack context. The site offers a product demo for buyers evaluating coverage across their own integrations.

NeuralTrust pairs TrustGuard agent runtime security with the TrustGate gateway for models, MCP servers and APIs. Teams can inspect prompts, responses and tool calls, apply identity-aware access rules and monitor agent behavior.

Its pricing page lists Free, Standard and Enterprise plans. Standard costs $49 a month, credited toward usage; model-provider token charges are separate. Private deployment is an Enterprise option. Buyers should compare request limits, security-processing charges and deployment needs before choosing a plan.

Operant AI provides runtime protection for AI applications, agents and MCP connections. Its product family includes AI Gatekeeper, MCP Gateway, Agent Protector and Endpoint Protector. The Semantic Firewall makes inline allow, block or redact decisions based on agent intent, while endpoint controls detect shadow AI and block supported device-level attacks.

Zenity inventories AI agents, checks their permissions and configurations, and applies runtime policies across SaaS, cloud, custom and endpoint environments. Its MCP security layer records requests, tool calls and responses with the user or agent identity behind them, and provides a central point for enforcing tool-use rules. Teams publish an MCP server and register a gateway URL to route agent connections through Zenity.

Zenity raised a $125 million Series C on 3 August 2026, led by Norwest. Qumra Capital, SoftBank Vision Fund 2, Hitachi Ventures and LG Technology Ventures joined the round. The platform page offers a sales demo.

Adversa AI offers autonomous red teaming for models, applications, agents and MCP infrastructure. Teams can describe business risks in text or structured CSV, then use those scenarios to guide attack agents. Results include risk-ranked findings, reproducible attack evidence and remediation playbooks.

The offering is delivered as a service, with a live demo available. It suits a buyer who needs testing tied to application behavior, tool misuse and business rules.

Alice, formerly ActiveFence, tests AI models and agents with malicious prompts and tasks, then monitors live inputs and outputs against company policies. It names Anthropic, Google and Cohere as labs it works with. Its WonderSuite combines red teaming and runtime guardrails, which applications call through REST APIs.

Alice raised $140 million on 25 August 2026, led by Apax Digital Funds, bringing total funding to $280 million. Apax Digital joined its board. Access to the API platform starts with an account opened by an Alice representative.

Giskard offers continuous red teaming, LLM evaluation and agent guardrails. Its software checks AI applications for security and response-quality failures.

Buyers can also commission a managed assessment with a deploy-or-fix report. That service includes severity review, remediation guidance, tickets in the customer’s workflow and retesting until fixes are confirmed. Specify whether the purchase covers platform access, an assessment engagement or both.

Mindgard maps AI systems, agents, tools and behavior, then tests them with attacker-style techniques. The platform tracks vulnerabilities and remediation, with APIs, CI/CD support and a Burp Suite integration for development and security workflows.

Its current description emphasizes continuous assessment and validation of defensive improvements. Buyers evaluating protection in production should establish which findings trigger remediation and which controls enforce policy within their application.

Promptfoo tests prompts, agents and retrieval applications through a CLI and library that can run in CI/CD. Its repository remains MIT licensed and now identifies Promptfoo as part of OpenAI. The companies announced an acquisition agreement on 9 March 2026.

The free Community plan includes evaluations, vulnerability scanning and 10,000 red-team probes per month, running locally or on a customer's infrastructure. Enterprise adds managed cloud deployment and team controls; an on-premises package is also available. Both paid packages have custom pricing. Promptfoo announced an $18.4 million Series A on 29 July 2025, led by Insight Partners with Andreessen Horowitz participating.

Fortinet acquired Virtue AI, adding automated adversarial testing, agent protection and runtime guardrails to its AI security portfolio. The former Virtue AI site now leads to FortiAIGate.

FortiAIGate inspects prompts, outputs and agent tool calls for injection, jailbreaks and data leakage. It also has usage and budget policies, with self-hosting that keeps prompts, data and logs on customer infrastructure. Buyers evaluating the former Virtue products should confirm which testing and runtime capabilities are included in the proposed Fortinet deployment.

Cato AI Security monitors AI interactions and applies security and data-protection policies. AI for Applications covers API calls and data flows between enterprise applications and models; AI for End Users governs employee use of third-party AI services.

Cato acquired Aim Security in September 2025. The documentation lists separate per-user licenses for the two services, so buyers should specify the application and employee coverage they need when requesting terms.

Harmonic Security checks staff use of AI tools and applies policies to sensitive data shared with them. Its deployment components include a browser extension, an endpoint agent for desktop apps and coding tools, and a local MCP gateway that checks agent-to-tool traffic. API and telemetry integrations add visibility.

Harmonic Security announced a $50 million Series B on 14 October 2026, led by Crosspoint Capital Partners, bringing disclosed total funding to $76 million. Its website names Advisor360 and Apax in customer testimonials and offers sales demos.

Nightfall controls sensitive data movement across AI agents, MCP servers, endpoints and SaaS applications. Its MCP Gateway approves servers and applies policy to tool calls, while inference hooks inspect prompts, responses and tool activity inside supported live sessions.

The platform also discovers and classifies exposed data and detects attempted exfiltration. For buyers, the useful distinction is which agent connections need inline controls and which SaaS or endpoint channels need data loss prevention. Nightfall offers a live demo to evaluate those workflows.

Prompt Security is part of SentinelOne, which completed the acquisition on 5 September 2025. Its browser extension detects and can block sensitive data sent to AI web apps.

The agent security product discovers agents and MCP servers, governs access and actions, and keeps audit records. It uses an MCP gateway, browser extension, security plugins and API integrations. Before the acquisition, Prompt Security raised an $18 million Series A on 20 November 2024, led by Jump Capital. SentinelOne offers sales demos.

Zscaler AI Guard for Apps inspects AI prompts and responses inline. It checks for injection, jailbreaks, malicious URLs and unsafe content, with prompt-level data loss prevention and intent-based guardrails. Teams get dashboards, alerts and records of guardrail decisions for policy review.

The application product sits alongside AI Guard for Users, which governs access by user, application and risk. Buyers should specify application inspection and employee access controls separately when discussing coverage.