AI Model & Agent Security

Pick the first of two products.

Open a name for its full profile

Prisma AIRS
Capabilities only
Palo Alto Networks · Commercial · 6 capabilities in this domain
Select
HiddenLayer AISec Platform
Capabilities only
HiddenLayer · Commercial · 5 capabilities in this domain
Select
Cisco AI Defense
Capabilities only
Cisco · Commercial · 4 capabilities in this domain
Select
Noma Security
Capabilities only
Noma Security · Commercial · 4 capabilities in this domain
Select
Amazon Bedrock Guardrails
Capabilities only
Amazon Web Services · Commercial · 3 capabilities in this domain
Select
Azure AI Content Safety
Capabilities only
Microsoft · Commercial · 3 capabilities in this domain
Select
Lakera Guard
Capabilities only
Lakera · Freemium · 3 capabilities in this domain
Select
promptfoo
Capabilities only
Promptfoo · Open Source · 3 capabilities in this domain
Select
LlamaFirewall
Capabilities only
Meta · Open Source · 2 capabilities in this domain
Select
MCP-Scan
Capabilities only
Snyk · Open Source · 2 capabilities in this domain
Select
Mindgard
Capabilities only
Mindgard · Commercial · 2 capabilities in this domain
Select
NeMo Guardrails
Capabilities only
NVIDIA · Open Source · 2 capabilities in this domain
Select
PyRIT
Capabilities only
Microsoft Security Engineering · Open Source · 2 capabilities in this domain
Select
garak
Capabilities only
NVIDIA · Open Source · 2 capabilities in this domain
Select
ModelScan
Capabilities only
Protect AI · Open Source · 1 capabilities in this domain
Select
OpenSSF Model Signing
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 1 capabilities in this domain
Select

In AI Model & Agent Security

LlamaFirewall

Meta · AI Model & Agent Security

Open SourceCompany

LlamaFirewall layers scanners that detect jailbreaks, goal hijacking and insecure generated code, part of the Purple Llama project.

Repository ↗

What it does3 capabilities · 2 at full coverage

2 of 3 at full coverage.

AI Guardrails & Output FilteringFullAI · level 3 · 7 providers
Prompt Injection DetectionFullAI · level 3 · 7 providers
AI Coding Assistant Security GuardrailsPartialDEVSEC · level 3 · 6 providers

What it proves11 controls across 3 frameworks

Satisfied through its capabilities, not claimed by the vendor.

Agentic Top 105 / 10ASI01 ASI02 ASI03 ASI05 ASI06
LLM Top 105 / 10LLM01:2025 LLM02:2025 LLM05:2025 LLM06:2025 LLM07:2025
AICM1 / 18AIS

What it stops8 techniques · 2 risks

8 techniques countered, 5 of them common

Direct and Indirect Prompt InjectionVery Common
LLM JailbreakAML.T0054Very Common
LLM Prompt InjectionAML.T0051Very Common
Extract LLM System PromptAML.T0056Common
LLM Data LeakageAML.T0057Common
AI Agent Privilege AbuseEmerging
AI Agent Tool InvocationAML.T0053Emerging
Slopsquatting (Hallucinated Package Squatting)Emerging

2 risks reduced

AI application or agent manipulated into harmful action or data leakageHigh
Developer workstation or AI assistant introduces compromiseHigh

Where it runs2 phases · 1 way to deploy

Capabilities per lifecycle phase

Code1
Operate2

How it is delivered

Self-hosted

What it unlocks3 activities · reaches level 3

Program activities its capabilities support, reaching level 3. Supporting an activity is not completing it.

Level 2

Scan models and apply guardrailsMedium effort

Level 3

Govern AI coding assistants and agentsMedium effort
Test AI applications and detect prompt injectionMedium effort

How it holds up

Not assessed yet: no strengths, limits or evaluation scores. 47 of 340 products carry an assessment and 29 are scored.

What it costsOpen source (free) · free tier

LicensingOpen source (free)

Priced pernone

BillingFree

Scales withOperating effort only

Total cost

No license cost, but self-support, upgrades, scaling and integration effort must be budgeted as personnel cost.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with

No supported language, standard, integration or named feature recorded.

What else to look at

No alternative, competitor or family sibling is modeled for it.

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13