LLM Security Tools: Guardrails, Red Teaming, Model Scanning and AI-SPM
The products that protect LLM applications, grouped by the job each one does, plus the 2024 to 2026 acquisitions that changed who sells them.
Short answer (checked October 25, 2026): LLM security tools do five different jobs: filtering prompts and responses at runtime, red teaming the model before release, scanning model files for malicious code, keeping an inventory of the AI services in your cloud (AI-SPM), and checking the code that developers and coding agents write. A team shipping its first LLM feature can start with open-source red-team tools (Promptfoo, garak or PyRIT) in CI, and put a filter in front of the model, either open-source NeMo Guardrails or a cloud service such as Microsoft's Prompt Shields. The commercial platforms (Prisma AIRS, Cisco AI Defense, Check Point's Lakera, SentinelOne's Prompt Security, HiddenLayer, Lasso) bundle several of those jobs, and none of their product pages read for this guide lists a price.
Most of the well-known AI security startups were bought between 2024 and 2026, so many product names below now sit inside a larger vendor's platform. Every vendor listed here has a product page or repository that was read for this guide. The capability descriptions come from those pages and are vendor claims, not test results.
Who owns what now
| Company | Buyer | Status | Where the product lives now |
|---|---|---|---|
| Robust Intelligence | Cisco | Announced Aug 26, 2024; closed Sept 24, 2024 | Cisco sells its AI security product as Cisco AI Defense |
| Protect AI | Palo Alto Networks | Closed July 22, 2025 | Prisma AIRS. protectai.com now redirects to the Prisma AIRS page. |
| Prompt Security | SentinelOne | Closed September 2025, per SentinelOne's FY2026 10-K | Branded "Prompt Security from SentinelOne" |
| Lakera | Check Point | Announced Sept 16, 2025; closed Oct 22, 2025 | lakera.ai, under Check Point |
| Promptfoo | OpenAI | Agreed March 9, 2026, subject to closing conditions. No closing announcement found as of Oct 25, 2026. | Promptfoo says the project stays open source |
1. Runtime guardrails and prompt-injection filters
A guardrail sits between users (or retrieved documents, or tool output) and the model. It classifies each prompt and response and blocks or flags injections, jailbreaks and data leaks. This is the main control for LLM01 Prompt Injection, the first entry on OWASP's list, and for indirect injection hidden in documents an agent reads.
| Product | Type | What the vendor says it does |
|---|---|---|
| Lakera AI Agent Security (Check Point) | Commercial API | Runtime protection for AI applications and agents: prompt attack prevention, data leakage protection, real-time threat detection. A separate Workforce AI Security product covers employee use of AI tools. |
| Microsoft Prompt Shields | Azure AI Content Safety / Foundry | Detects user prompt attacks and document attacks (instructions hidden in emails, web pages and files). For Foundry agents it can also scan tool responses (preview). Microsoft notes it doesn't judge whether content is harmful or accurate. |
| NVIDIA NeMo Guardrails | Open source, Apache 2.0 | Programmable input, dialog, retrieval, execution and output rails, with built-in jailbreak and injection detection. |
| Prisma AIRS AI Runtime Security (Palo Alto Networks) | Commercial platform | Real-time safeguards against manipulation, data exposure and unsafe actions, deployed in network-intercept or API-intercept mode, with a separate AI Agent Security module for tool misuse and memory manipulation. |
| Cisco AI Defense | Commercial platform | Guardrails enforced in the network, without agents or libraries, against prompt injection, denial of service, data leakage and harmful responses. |
| Prompt Security (SentinelOne) | Commercial platform | Guardrails for sensitive data, secrets and topics, prompt injection tracking, and controls for agent deployments. |
| Lasso Security | Commercial platform | Runtime enforcement at the proxy, API or AI gateway layer, plus AI usage control and agent security. |
2. AI red teaming and LLM vulnerability scanners
Red-team tools send large sets of attack prompts at your application before release and report which ones got through. The open-source options run from the command line, so they can run in CI on every model or prompt change. The commercial versions add larger attack libraries, scheduled runs and reporting.
| Tool | Type | Notes |
|---|---|---|
| Promptfoo | Open source plus commercial (OpenAI deal pending) | Red-team plugins and presets mapped to the OWASP LLM Top 10. Also evals for RAG and fine-tuned models. |
| garak (NVIDIA) | Open source, Apache 2.0 | Calls itself "the LLM vulnerability scanner." Probes cover prompt injection, jailbreaks (DAN and others), encoding attacks, training-data replay, package hallucination, XSS and toxicity. |
| PyRIT (Microsoft) | Open source, MIT | A framework for finding risks in generative AI systems. The old Azure/PyRIT repository was archived on March 27, 2026 and points to microsoft/PyRIT. |
| Lakera AI Red Teaming (Check Point) | Commercial, plus an expert-led service | Risk-based red teaming with direct and indirect attack simulations and remediation guidance. |
| Prisma AIRS AI Red Teaming | Commercial | Simulated attacks against AI agents and applications. |
| Cisco AI Defense | Commercial | Algorithmic red teaming of models, and an Explorer Edition for testing AI apps before rollout. |
| HiddenLayer AI Attack Simulation | Commercial | Ongoing simulated attacks on AI systems. |
| Lasso AI Red Teaming | Commercial | Automated adversarial testing; Lasso cites a library of more than 3,000 attacks. |
3. Model scanning and AI supply chain
A model downloaded from a public hub is a file that can run code when it loads, because formats such as Python pickle allow it. Model scanners read the file without loading it and look for unsafe code, tampered weights and risky dependencies. This maps to OWASP LLM03 Supply Chain.
- ModelScan (open source, Apache 2.0, from Protect AI): scans PyTorch, TensorFlow SavedModel, Keras H5 and V3, and pickle-based formats (Pickle, Cloudpickle, Dill, Joblib) byte by byte for unsafe code.
- Prisma AIRS AI Supply Chain Security, formerly AI Model Security: scans third-party models for tampering, malicious scripts and deserialization attacks.
- HiddenLayer AI Supply Chain Security and Model Scanning: checks model integrity before deployment and flags dangerous models, tampered weights and risky dependencies.
- Cisco AI Defense lists AI supply chain risk management for models and files, without much detail on its product page.
4. AI security posture management (AI-SPM) and discovery
AI-SPM tools build an inventory of the models, AI services, SDKs and agents running in your environment, then flag misconfigurations and exposed endpoints. They answer the question of which teams are calling Bedrock or OpenAI and with what permissions, which a guardrail can't.
- Wiz AI-SPM: agentless discovery of AI services, technologies and SDKs, an AI bill of materials, built-in rules for misconfigured AI services, and attack paths on the Wiz Security Graph. Named services include Amazon SageMaker, Amazon Bedrock and OpenAI. See the Wiz tool page and the Wiz vs Orca vs Prisma Cloud guide.
- Prisma AIRS AI Posture Management: visibility over training and inference data, AI agents and apps, and access to deployed models.
- HiddenLayer AI Discovery: an inventory of AI apps, models and assets to find shadow AI.
- Lasso: AI discovery and inventory, plus posture management with NIST and OWASP alignment.
- Cisco AI Defense: discovery of AI workloads, models, data and users, including third-party AI apps.
- Snyk Evo AI-SPM: listed on Snyk's plans page at 0.66 credits per active contributor per day, Enterprise only.
5. AI code security
This category covers two things: AI that finds and fixes vulnerabilities in code, and controls on the code that AI coding agents write. The first is the more mature market.
- GitHub Copilot Autofix drafts fixes for CodeQL alerts and comes with GitHub Code Security ($30 per active committer per month).
- Snyk Agent Fix (previously DeepCode AI Fix) generates and rescans fixes in the IDE. Snyk also lists Evo ADS, "Coding Agent Security", at 1.0 credit per active machine per day on Enterprise plans.
For prices, languages and fix limits, see GitHub Advanced Security vs Snyk and the Snyk, GitHub and Semgrep comparison.
OWASP LLM Top 10 coverage
Several vendors say they align with the OWASP Top 10 for LLM Applications (2025), but only Promptfoo publishes a risk-by-risk mapping. The table below repeats what Promptfoo's docs state for each risk. No cell is filled in for other vendors because none of their pages read for this guide gives per-risk coverage.
| OWASP 2025 risk | Promptfoo coverage (as documented) |
|---|---|
| LLM01 Prompt Injection | Yes: owasp:llm:01 plugin plus jailbreak strategies |
| LLM02 Sensitive Information Disclosure | Yes: PII plugins and harmful:privacy |
| LLM03 Supply Chain | Yes: model comparison, vendor acceptance tests and ModelAudit static scanning |
| LLM04 Data and Model Poisoning | Partial: Promptfoo says it can't prevent training-data poisoning, only detect its effects |
| LLM05 Improper Output Handling | Yes, through output assertions rather than a plugin |
| LLM06 Excessive Agency | Yes: excessive-agency, hijacking, rbac and related plugins |
| LLM07 System Prompt Leakage | Yes: prompt-extraction plugin |
| LLM08 Vector and Embedding Weaknesses | Yes: access-control plugins, indirect prompt injection and a RAG poisoning utility |
| LLM09 Misinformation | Partial: hallucination plugins; Promptfoo recommends evals for checking specific facts |
| LLM10 Unbounded Consumption | Yes: divergent-repetition plugin and repeat-based rate-limit tests |
Vendors that claim OWASP alignment without a per-risk table on the pages read: Cisco AI Defense ("NIST, MITRE ATLAS, and the OWASP LLM Top 10"), Lasso (red teaming covers the "OWASP Top 10"), and Lakera (cited in OWASP's LLM and GenAI Security Landscape Guide 2025). garak tags individual probes with OWASP identifiers in its source code, but the tags appear to follow the older 2023 numbering, so they don't line up with the 2025 list above.
Where to start
If you are building on a hosted model, add the provider's own input filter first (Prompt Shields on Azure, or the equivalent on your platform), then put Promptfoo or garak in CI so every prompt or model change is re-tested. Add model scanning as soon as anyone loads open-weight models from a public hub. The commercial platforms start to make sense when you need one dashboard across many AI apps, inline blocking at the network layer, or evidence for auditors. Ask each vendor for pricing, since none is published on the pages linked here.
For the AI tools security teams use (rather than tools that protect AI), see the top 10 AI cybersecurity tools.