Tools · AI security platforms
AI agent security platforms and guardrails
These products cover the AI applications and agents a company runs or builds: they find them, test them for weaknesses, and screen prompts, responses and agent actions at runtime for prompt injection, jailbreaks and leaks of sensitive data. The list runs from company-wide commercial platforms to open-source guardrail libraries a developer adds to one application. A team needs one when agents read untrusted content, such as email, web pages or tool output, and can act on what they read, because prompt injection hides instructions in exactly that content.
AI security platforms 21
-
Agent Guardian (vendor site, opens in a new tab)
generally availableInventories agents and AI apps across cloud, SaaS, browsers and workstations and maps their links to models, tools, MCP servers and sensitive data. It checks tool calls and data access against policy at runtime, can alert, quarantine an agent or block an action, and red-teams agents.
-
AI Agent Security (vendor site, opens in a new tab)
generally availableDiscovers the agents in use and assesses their risk, then inspects what goes into and comes out of agents and governs their actions in real time, blocking prompt injection and jailbreaks.
-
AI Security for Apps (vendor site, opens in a new tab)
generally availableFinds LLM-powered endpoints across a company's web properties and inspects their traffic for prompt injection, PII exposure and custom topics, which can be logged or blocked.
-
Amazon Bedrock Guardrails (vendor site, opens in a new tab)
generally availableConfigurable safeguards that filter harmful text and image content, redact sensitive information and flag hallucinations, applied to Bedrock models and to third-party or self-hosted models. Controls can be managed centrally across AWS accounts.
-
Falcon Guardian (vendor site, opens in a new tab)
generally availableCrowdStrike
AI detection and response that discovers AI use and agents, including shadow AI, and links prompts to the system actions agents take using endpoint telemetry. It inspects AI interactions for direct and indirect prompt injection and redacts, encrypts or blocks sensitive data.
-
Lasso (vendor site, opens in a new tab)
generally availableLasso Security on the vendor map
Inventories agentic applications with the tools, MCP servers and resources they reach, tests them for exploitable weaknesses, and blocks threats along the execution path at runtime.
-
LlamaFirewall (vendor site, opens in a new tab)
generally availableMeta
Open-source guardrail framework for AI agents and LLM apps that runs scanners, such as PromptGuard, over messages to detect and block prompt injection.
-
Model Armor (vendor site, opens in a new tab)
generally availableGoogle Cloud on the vendor map
Screens prompts, responses and agent interactions for prompt injection, jailbreaks, malicious URLs and sensitive data, with adjustable content safety thresholds.
-
NeMo Guardrails (vendor site, opens in a new tab)
generally availableNVIDIA
Open-source toolkit that places programmable rails between application code and an LLM to restrict topics, enforce dialog paths and check inputs and outputs.
-
Netskope Skylight AI Security (vendor site, opens in a new tab)
generally availableNetskope
Inventories users, AI apps, agents, models and AI interactions across cloud, endpoint and network, and governs what agents connect to. Components include an AI gateway, guardrails, agent action controls that block risky actions before they run, and red teaming for self-hosted models.
-
Noma Security (vendor site, opens in a new tab)
generally availableNoma Security on the vendor map
Covers agents run by employees (coding assistants and their MCP servers), agents built by engineering on cloud platforms, and agents built in SaaS tools such as Copilot Studio and Agentforce. It handles discovery, posture, access control, adversarial testing and runtime detection.
-
Pillar (vendor site, opens in a new tab)
generally availablePillar Security
Discovers AI systems and their posture, red-teams them, applies runtime guardrails, covers agents running on endpoints, and tracks governance and compliance. Deploys in the cloud, self-hosted or hybrid.
-
Prisma AIRS (vendor site, opens in a new tab)
generally availablePalo Alto Networks on the vendor map
Discovers AI agents, apps and models, tests them continuously, tracks their permissions and posture, and applies runtime controls that block prompt injection and data leaks.
-
Prompt Security (vendor site, opens in a new tab)
generally availableSentinelOne
Inventories AI tools and code assistants employees use, including shadow AI, and redacts sensitive data across more than 15,000 AI services. It maps agents and MCP servers, holds agents to least privilege with a searchable log of their actions, and tests and guards homegrown AI apps.
-
Rein (vendor site, opens in a new tab)
generally availableRein Security on the vendor map
Observes enterprise AI apps and custom agents in the runtime where they take actions, records what each agent did as well as what it said for audit, and applies guardrails mapped to MITRE ATLAS and the OWASP Top 10.
-
Straiker (vendor site, opens in a new tab)
generally availableStraiker
Maps agents, tools, MCP servers and skills (Discover AI), attacks them autonomously to find failures (Ascend AI), and blocks agentic threats at runtime (Defend AI). A kill switch takes a rogue agent offline.
-
Varonis Atlas (vendor site, opens in a new tab)
generally availableDiscovers AI assets and shadow AI, scans agents, chatbots and models for misconfigurations, pen-tests them for prompt injection and jailbreaks, and enforces runtime policies that stop sensitive data from leaking through AI.
-
WitnessAI (vendor site, opens in a new tab)
generally availableWatches AI use by employees, applications and agents at the network level and maps agent sessions to the MCP servers and tools they call. It enforces an approved list of MCP servers and tools, blocks prompt injection and jailbreak attempts at runtime, and red-teams models before release.
-
Zenity (vendor site, opens in a new tab)
generally availableZenity
Governs AI agents built in SaaS platforms such as Copilot Studio and Agentforce, in cloud services and on endpoints. It manages posture and exposure, sets runtime boundaries on agent actions, covers agent identity and MCP use, and detects threats agents create or meet.
-
Zscaler AI Security (vendor site, opens in a new tab)
generally availableZscaler
Discovers models, agents, MCP servers and shadow AI across more than 2,900 apps, controls who uses AI by role, filters sensitive data from LLM traffic, and governs agent-to-agent traffic. It also red-teams AI apps and routes AI calls through a gateway with inline DLP.
Recent launches
- BeyondTrust AI Agent Security · generally available
- ThreatLocker Zero Trust AI Control · announced
- Project Beacon (Goodfire and Baseten) · announced
- Noma agent security and governance for employee endpoints (Noma Security) · announced
- Lasso LEAP (Lasso Security) · generally available
- CrowdStrike Falcon Guardian · announced
Announced in the last 90 days. Each launch on New tools links the vendor's own announcement.
The briefing
New AI agent governance tools, by email
The briefing's New Tools section covers the latest governance launches, each linked to the vendor's announcement, next to the news that decides which ones matter. At least once a week, five-minute read, free.
You confirm by email. Unsubscribe in one click.
Questions to ask vendors
Neutral questions for a request for proposal (RFP) or a security questionnaire. No product here is named as the answer.
-
Does runtime protection inspect tool calls and their results, or only the prompts and responses a person sees?
-
How is tool output screened for injected instructions, and what happens on a hit: block, redact, or flag for review?
Injected instructions are prompt injection: text hidden in content an agent reads, including what its own tools hand back, that tries to change what the agent does.
-
Which controls stop an action before it runs, and which only raise an alert after it has run?
-
Is authorization enforced by an external control point, or does it rely on the agent framework behaving as documented?
-
What false-positive rate do you measure, and can we test against our own traffic before we buy?
-
Which agent platforms, clouds and endpoint types are covered today, and which are only on the roadmap?
More questions, grouped by topic: Questions to ask AI agent security vendors.
Related incidents
- AWS, Google, and Vercel patched flaws that fired agent tools without the model
- A GitHub issue could escalate from a low-privilege Google ADK agent to a privileged one
- A self-replicating prompt injection spread through Word documents via Copilot
- A poisoned web page rewrote AWS Kiro's config and ran code
Every record in the AI agent incident database links the sources that reported it.
Missing a product, or found an entry that is out of date? Write to [email protected]. A submission is read, never paid for, and does not guarantee a listing. The glossary defines the terms used here.