Category 6 of 12 · Controls: What goes into and out of the model

Runtime guardrails and AI firewalls

Inline inspection of prompts, retrieved content, and model output to catch prompt injection, jailbreaks, sensitive data, and unsafe actions while the agent runs.

Mitigates: ASI01 Agent Goal Hijack, ASI06 Memory and Context Poisoning, LLM01 Prompt Injection, LLM05 Improper Output Handling, LLM07 System Prompt Leakage · MITRE ATLAS AML.T0051, AML.T0054

Vendors, by signal score

• #1
  Palo Alto NetworksPlatform suite

  Prisma AIRS: AI runtime security, agent security, AI red teaming, model scanning, posture management, and an AI gateway, built partly from acquisitions of Protect AI, Koi (agentic endpoint security), and Portkey (now Prisma AIRS AI Gateway), with CyberArk as its identity security platform.

  65
• #2
  CiscoPlatform suite

  Cisco AI Defense, which incorporates the Robust Intelligence acquisition, adds agent red teaming, runtime guardrails, and MCP server scanning; Duo registers agents as identities with human owners, and Secure Access enforces MCP policy. Cisco also acquired the NHI vendor Astrix Security.

  60
• #3
  Check PointPlatform suite

  The Check Point AI Defense Plane combines Workforce AI Security, AI Application and Agent Security, and AI Red Teaming (in limited release), built on the Lakera acquisition (Lakera Guard and Lakera Red) and the Cyata agent discovery acquisition.

  55
• #4
  SentinelOnePlatform suite

  AI security built on the Prompt Security acquisition: runtime protection for employee and homegrown AI, discovery of shadow MCP servers and agents, Prompt AI Agent Security (preview) for agent governance, and Prompt AI Red Teaming.

  55
• #5
  HiddenLayer

  AI security platform with runtime detection and response for models and agents: evaluates model requests, responses, and tool calls against policy and can block or redact them, alongside AI discovery, supply chain scanning, and attack simulation.

  47
• #6
  FortinetPlatform suite

  FortiAIGate guards LLM traffic against prompt injection, data leakage, and model poisoning; the Virtue AI acquisition adds agentic red teaming, agent and MCP tool discovery and scanning, blocking of malicious tool calls, and real-time guardrails.

  45
• #7
  Lasso Security

  GenAI and agent security platform with intent-based runtime guardrails, a CPU-only guardrail model (LEAP), agent discovery, and policy over which tools and resources an agent may use.

  39
• #8
  LakeraAcquired by Check Point

  Runtime guardrails for LLM applications and agents (Lakera Guard) that screen prompts, tool responses, and tool descriptions for injection and data leakage, plus AI red teaming. Acquired by Check Point in 2025.

  38
• #9
  Straiker

  Agent security platform: Discover AI inventories agents and MCP servers, Ascend AI red-teams them, and Defend AI blocks prompt injection, data exfiltration, and destructive actions at runtime, with a kill switch to cut off or shut down a rogue agent.

  36
• #10
  Protect AIAcquired by Palo Alto Networks

  AI and ML security company behind model scanning, runtime LLM protection, and the open-source LLM Guard toolkit. Acquired by Palo Alto Networks in 2025; protectai.com now redirects to Prisma AIRS, and the LLM Guard repository is archived.

  30
• #11
  PangeaAcquired by CrowdStrike

  AI guardrails and AI detection and response: collectors capture prompts, responses, and MCP traffic, policies block or redact risky content, and every interaction is logged with user identity and sent to a SIEM. Acquired by CrowdStrike in 2025; now CrowdStrike Falcon AIDR.

  23
• #12
  CalypsoAIAcquired by F5

  Runtime guardrails for AI inference: inspects prompts, outputs, and agent tool calls, blocks unauthorized tool calls, and logs every enforcement decision with its reasoning. Acquired by F5 in 2025; now sold as F5 AI Guardrails.

  19
• #13
  Aim SecurityAcquired by Cato Networks

  AI security for employee AI use, coding agents, and MCP: discovers agents, inspects prompts and tool calls, and blocks unsafe actions at runtime. Acquired by Cato Networks in 2025; now part of Cato's SASE platform.

  17
• #14
  Prompt SecurityAcquired by SentinelOne

  AI firewall and usage control for employee AI tools, coding assistants, and homegrown AI apps: blocks adversarial prompts, scrubs sensitive outputs, and keeps a log of agent actions. Acquired by SentinelOne in 2025.

  16

Ranked within this category only. How the score works.

Also covers this category

• AIR

  Context firewall for AI agents: vets skills, plugins, MCP servers, and sub-agents before they are installed, keeps a marketplace of approved add-ons, discovers sanctioned and shadow agents, and blocks malicious agent actions at runtime.

  31
• CrowdStrikePlatform suite

  Falcon AIDR, now presented as Falcon Guardian, discovers workforce AI and endpoint agents, governs which agents may run, and ties each prompt, identity, and tool call to downstream system actions in Falcon Next-Gen SIEM. Built with the Pangea acquisition, with SGNL powering Continuous Identity for AI Agents.

  67
• Invariant LabsAcquired by Snyk

  Research-led agent security: MCP-Scan (now Snyk Agent Scan) finds tool poisoning, rug pulls, and cross-server tool shadowing in MCP servers and agent skills, alongside Guardrails and Explorer for runtime rules and agent trace inspection. Acquired by Snyk in 2025.

  25
• Noma Security

  AI security platform that discovers agents, models, MCP servers, and skills across cloud, SaaS, and endpoints, keeps an approved-agent registry with per-tool access policies, and monitors agent sessions at runtime.

  29
• Operant AI

  Runtime defense for AI applications and agents, including an MCP Gateway that catalogs MCP servers and tools, enforces trust zones and least-privilege tool permissions, and blocks untrusted servers and data flows inline.

  37
• Pillar Security

  AI agent security platform: RedGraph runs multi-turn adversarial attacks against agents to test tool orchestration and permission escalation, alongside AI discovery and posture, runtime guardrails, and governance.

  10
• SPLXAcquired by Zscaler

  Automated AI red teaming with thousands of attack simulations, plus runtime guardrails, prompt hardening, and discovery of models, workflows, and MCP servers. Acquired by Zscaler in 2025 and now sold as Zscaler AI Red Teaming.

  10
• WitnessAI

  AI security and governance for employees and agents: catalogs AI apps, agents, and MCP servers, applies intent-based policy by department and role, enforces control at the tool-call and MCP-server level, and blocks prompt injection and jailbreaks.

  36
• ZscalerPlatform suite

  Zscaler AI Protect extends the Zero Trust Exchange to AI: secure access to GenAI apps, AI asset discovery, and runtime guardrails, plus AI Red Teaming from the SPLX acquisition, an AI Broker with an agent registry for MCP and A2A traffic, and an AI Access Graph built on Symmetry Systems.

  70

Questions to ask a vendor

1. Does it catch indirect prompt injection in retrieved content, not only in user input?
2. What latency does it add per call at your traffic level?
3. Can policies be tuned per agent and per tool?

Go deeper

• AI threat detection shortlist

FAQ

What is indirect prompt injection?

Instructions hidden in content the agent reads, such as a web page, email, or document, rather than typed by the user. It is the most common way an agent's goal is hijacked.

Do guardrails replace least privilege?

No. Guardrails reduce how often an agent is manipulated; least privilege limits the damage when it is. Both are needed.