Guardrails & AI firewalls
13 organizations: 7 independent · 5 acquired · 1 open source / nonprofit
Products that sit in the request path and inspect what goes into and comes out of a model: user prompts, retrieved documents, tool results and responses. They block prompt injection, jailbreaks, toxic output and leaks of sensitive data.
- How it works
- Mostly small fine-tuned classifiers, sometimes backed by an LLM judge, regex and data-loss rules. Delivered as an API call, an SDK or an inline proxy; several now run at the network edge (Cloudflare runs Llama Guard on its GPUs) or on CPUs only (Lasso claims under 5 ms, its own measurement).
- Maturity
- Generally available and widely bought, and the fastest-consolidating segment: Lakera, Prompt Security, CalypsoAI, Pangea, Aporia and Enkrypt AI have all been acquired.
- How well it works
- Cheap, fast and effective against known and low-effort attacks. The research record says classifiers are bypassed by adaptive attackers far more often than their static scores suggest, so treat them as one layer, not a security boundary.
- Who benefits
- Application teams shipping chat assistants and agents; regulated firms that need data-loss controls on AI traffic.
- Open source
- NVIDIA NeMo Guardrails, Meta LlamaFirewall / Prompt Guard, Guardrails AI. Protect AI's LLM Guard was archived in July 2026 after the Palo Alto Networks acquisition.
Strengths
- Drop-in; no change to the agent's design
- Low latency and vendor-neutral
- Doubles as data-loss prevention
Limits
- Probabilistic: misses novel attacks, blocks some benign requests
- Sees one message at a time, not multi-step intent
- Adaptive attackers tune against it
Leaders: