AI Model & Agent Security

Now pick what to compare Lakera Guard against.

Lakera Guard clear

Open a name for its full profile

Prisma AIRS
Capabilities only
Palo Alto Networks · Commercial · 6 capabilities in this domain
Compare →
HiddenLayer AISec Platform
Capabilities only
HiddenLayer · Commercial · 5 capabilities in this domain
Compare →
Cisco AI Defense
Capabilities only
Cisco · Commercial · 4 capabilities in this domain
Compare →
Noma Security
Capabilities only
Noma Security · Commercial · 4 capabilities in this domain
Compare →
Amazon Bedrock Guardrails
Capabilities only
Amazon Web Services · Commercial · 3 capabilities in this domain
Compare →
Azure AI Content Safety
Capabilities only
Microsoft · Commercial · 3 capabilities in this domain
Compare →
Lakera Guard
Capabilities only
Lakera · Freemium · 3 capabilities in this domain
selected
promptfoo
Capabilities only
Promptfoo · Open Source · 3 capabilities in this domain
Compare →
LlamaFirewall
Capabilities only
Meta · Open Source · 2 capabilities in this domain
Compare →
MCP-Scan
Capabilities only
Snyk · Open Source · 2 capabilities in this domain
Compare →
Mindgard
Capabilities only
Mindgard · Commercial · 2 capabilities in this domain
Compare →
NeMo Guardrails
Capabilities only
NVIDIA · Open Source · 2 capabilities in this domain
Compare →
PyRIT
Capabilities only
Microsoft Security Engineering · Open Source · 2 capabilities in this domain
Compare →
garak
Capabilities only
NVIDIA · Open Source · 2 capabilities in this domain
Compare →
ModelScan
Capabilities only
Protect AI · Open Source · 1 capabilities in this domain
Compare →
OpenSSF Model Signing
Capabilities only
Open Source Security Foundation (OpenSSF) · Open Source · 1 capabilities in this domain
Compare →

In AI Model & Agent Security

promptfoo

Promptfoo · AI Model & Agent Security

Close ×

Open SourceCompany

promptfoo generates adversarial test cases for injection, jailbreaks, PII leakage, excessive agency and tool misuse and compares model and prompt versions.

Repository ↗

What it does3 capabilities · 2 at full coverage

2 of 3 at full coverage.

AI Red Teaming & Model EvaluationFullAI · level 4 · 9 providers
LLM Application Security TestingFullAI · level 3 · 4 providers
MCP Tool Poisoning DetectionPartialAI · level 4 · 2 providers

What it proves10 controls across 4 frameworks

Satisfied through its capabilities, not claimed by the vendor.

LLM Top 104 / 10LLM01:2025 LLM04:2025 LLM05:2025 LLM06:2025
Agentic Top 103 / 10ASI01 ASI02 ASI04
AI RMF2 / 19MANAGE 1 MEASURE 2
AICM1 / 18TVM

What it stops6 techniques · 1 risk

6 techniques countered, 4 of them common

LLM JailbreakAML.T0054Very Common
LLM Prompt InjectionAML.T0051Very Common
Craft Adversarial DataAML.T0043Common
Extract LLM System PromptAML.T0056Common
MCP Tool PoisoningEmerging
Poison Training DataAML.T0020Emerging

1 risks reduced

AI application or agent manipulated into harmful action or data leakageHigh

Where it runs2 phases · 2 ways to deploy

Capabilities per lifecycle phase

Test2
Operate1

How it is delivered

CI/CD integrationCLI tool

What it unlocks3 activities · reaches level 5

Program activities its capabilities support, reaching level 5. Supporting an activity is not completing it.

Level 3

Test AI applications and detect prompt injectionMedium effort

Level 4

Least-agency agents and governed MCP toolsMedium effort

Level 5

Continuous AI red teaming and data integrity assuranceHigh effort

How it holds up

Not assessed yet: no strengths, limits or evaluation scores. 47 of 340 products carry an assessment and 29 are scored.

What it costsOpen core or freemium · free tier

LicensingOpen core or freemium

Priced perfree tier plus paid tiers

BillingSubscription

Scales withFeature tier, users or usage beyond the free tier

Total cost

Start free; enterprise needs such as SSO, audit logs and policy often require the paid tier.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with

No supported language, standard, integration or named feature recorded.

What else to look at

No alternative, competitor or family sibling is modeled for it.

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13