Executive summary
As of November 2026, CybersecTools tracks 213 companies that sell AI security solutions as their main business. The largest groups are based in the United States, Israel and the United Kingdom. In the last 12 months they raised $1.7B across 79 funding rounds, 18 companies were acquired and 96 new companies started in the last two years.
We chose six solutions that cover two halves of AI security. One half is controlling how your staff use public AI apps. The other is protecting the AI apps and agents your teams build.
Palo Alto Networks AI Access Security leads for teams that want shadow AI discovery and data controls in their Palo Alto network stack. CrowdStrike Falcon Guardian fits teams that want AI agent coverage on the Falcon platform they already run. Check Point AI Agent Security suits teams that build their own AI apps and agents and need to block prompt injection and jailbreak attempts as they happen.
The decision you face is which half to secure first. If the risk is data leaking into public chatbots, start with a product that sits in your web traffic or on the endpoint. WitnessAI Platform does this at the network level with no endpoint clients. If you ship AI features to customers, start with runtime protection such as Check Point AI Agent Security or HiddenLayer. Most larger teams will end up needing both.
How we evaluated
We looked at 438 AI security solutions from 274 companies, and the 6 on this page made the cut. We combined our judgment from years of leading enterprise security programs with market data from Mandos, our market intelligence platform, and with the vendor and review pages listed under Sources at the end of this page. For customer feedback, we left out paid reviews, reviews by vendor staff or partners, review campaigns and anything older than two years, so you get an accurate view of what customers say.
Four traits mattered most: finding the AI apps and agents in use, stopping sensitive data from reaching them, blocking prompt injection and harmful output at runtime, and testing AI apps before launch. We left out AI governance paperwork products, model development platforms and products tied to one vendor's AI only. The order follows how widely each product is used by teams like yours. Company momentum shows how the vendor itself is growing, so a market leader can rank first with a lower score.
Read the full method · See all sources
What is AI Security
AI security protects two things: your people's use of AI apps, and the AI apps and agents your company builds. On the use side, it finds which AI services staff use and stops sensitive data from going into them. On the build side, it tests and guards models and agents against prompt injection, data leaks and misuse.
For you, this is where data protection, web security and application security meet. It depends on knowing what data matters and having control of web traffic or endpoints. Your AI rollout plans, compliance work and incident response all depend on it in turn.
Compare AI Security solutions
This analysis focuses on six AI security solutions. The table compares them on vendor, who each one is best for, deployment model and the NIST CSF functions they cover.
- 1.
Palo Alto Networks AI Access Security
Best for: Palo Alto network customers controlling staff AI use
Cloud · SMB to Enterprise · NIST: Identify, Protect, Detect
- 2.
CrowdStrike Falcon Guardian
Best for: Falcon customers adding AI coverage on one sensor
Cloud · Mid-Market to Enterprise · NIST: Detect
- 3.
Check Point AI Agent Security
Best for: Runtime protection for AI apps and agents you build
Cloud · Mid-Market to Enterprise · NIST: Detect
- 4.
Zscaler Security for AI
Best for: Zscaler customers controlling AI apps and data
Cloud · SMB to Enterprise · NIST: Protect, Detect
- 5.
HiddenLayer AI Runtime Security
Best for: Teams building their own AI apps and agents
Cloud · Mid-Market to Enterprise · NIST: Protect, Detect
- 6.
WitnessAI Platform
Best for: Network-level AI visibility with no endpoint clients
Cloud · Mid-Market to Enterprise · NIST: Identify, Protect, Detect
| Solution | Best for | Deployment | Company size | NIST CSF functions |
|---|---|---|---|---|
| Palo Alto network customers controlling staff AI use | Cloud | SMB to Enterprise | Identify, Protect, Detect |
| Falcon customers adding AI coverage on one sensor | Cloud | Mid-Market to Enterprise | Detect |
| Runtime protection for AI apps and agents you build | Cloud | Mid-Market to Enterprise | Detect |
| Zscaler customers controlling AI apps and data | Cloud | SMB to Enterprise | Protect, Detect |
| Teams building their own AI apps and agents | Cloud | Mid-Market to Enterprise | Protect, Detect |
| Network-level AI visibility with no endpoint clients | Cloud | Mid-Market to Enterprise | Identify, Protect, Detect |
See every AI Security solution we list
The full AI Security market, filtered by company size, deployment and NIST coverage.
Secures GenAI app usage with visibility, data protection, and threat defense
Santa Clara, United StatesFounded 2005Public company
- SOC 2
- ISO 27001
- FedRAMP
- PCI DSS
- HIPAA
Best for: Palo Alto network customers controlling staff AI use
At a glance
- Vendor
- Palo Alto Networks
- Headquarters
- Santa Clara, United States
- Founded
- 2005
- Ownership
- Public company (PANW)
- Deployment
- Cloud
- Company size
- SMB, Mid-Market, Enterprise
- NIST CSF
- Identify, Protect, Detect
- Pricing
- Contact sales
Funding, hiring and news for Palo Alto Networks on Mandos.
Our take
Palo Alto Networks AI Access Security finds and controls the GenAI apps your staff use. It keeps a catalog of over 4,000 GenAI apps with details on each. It shows who uses what, and blocks sensitive data from being sent to them with machine learning data classifiers. It also scans AI responses for malicious links and malware.
It earns its place on the staff-use side of this list, because it finds the GenAI apps people use and stops sensitive data from reaching them. It fits best if you already run Palo Alto firewalls or Prisma Access, since the controls sit in traffic you already inspect. Its listed features center on staff use, so if you also ship your own AI apps, ask how far it reaches into runtime protection.
Palo Alto Networks AI Access Security main features
- GenAI application discovery and categorization across 4000+ applications
- Real-time visibility into GenAI app usage and users
- 80+ GenAI-specific attributes for application profiling
- LLM-powered data classification with 300+ ML data classifiers
- Inline detection and blocking of sensitive data transfers to GenAI apps
- Protection against malicious URLs in GenAI responses
- Malware detection in GenAI responses
- Shadow AI discovery and monitoring
Palo Alto Networks AI Access Security main integrations
- ChatGPT Enterprise
Before you buy
Where it is strong
- Catalog of over 4,000 GenAI apps with details on each
- Sits in network traffic you already inspect with Palo Alto
- Scans AI responses for malicious links and malware
Ask in the demo
- Check which AI services it can decrypt and inspect, since customers report gaps with certificate pinning and QUIC
- Ask how quickly new AI agents get signatures, since customers built custom ones themselves
- Confirm which Palo Alto licenses you need for it in your current setup
Runtime security for AI agents on endpoints, from CrowdStrike
Austin, United StatesFounded 2011Public company
- SOC 2
- ISO 27001
- FedRAMP
- PCI DSS
- HIPAA
Best for: Falcon customers adding AI coverage on one sensor
At a glance
- Vendor
- CrowdStrike
- Headquarters
- Austin, United States
- Founded
- 2011
- Ownership
- Public company (CRWD)
- Deployment
- Cloud
- Company size
- Mid-Market, Enterprise
- NIST CSF
- Detect
- Pricing
- Contact sales
Funding, hiring and news for CrowdStrike on Mandos.
Our take
CrowdStrike Falcon Guardian is the newer CrowdStrike product for AI agents. It runs on the Falcon platform and watches agents at the endpoint, where their actions touch the operating system, files, credentials and networks.
It finds known and unapproved agents on Windows, macOS and Linux endpoints, and links prompts, MCP servers and identity to what each agent then does. You can allow approved agent types, block the rest, and stop malicious agent behavior at runtime.
It belongs here because it covers AI agents where they act, on the endpoint, and if you already run Falcon you can add it without a new agent on every machine. It suits mid-sized and large companies already on Falcon. CrowdStrike still lists an AI gateway and managed response for it as upcoming, so ask what is live today before you plan around it.
CrowdStrike Falcon Guardian main features
- Discovery of known and shadow AI agents
- Agent inventory with owner and status
- Prompt-to-runtime activity correlation
- Allow or block agent types on endpoints
- Controls for prompt injection and data exposure
- Agent session rebuilt as causal timeline
- Blocking of malicious agent behavior at runtime
- Native export to Falcon Next-Gen SIEM
CrowdStrike Falcon Guardian main integrations
- Chrome
- Firefox
- Apigee
- Azure API Management
- Kong Gateway
- Kong AI Gateway
- LiteLLM AI Gateway
- Portkey AI Gateway
- TrueFoundry AI Gateway
- JetStream AI Hub
- Claude Code
- Microsoft Copilot Studio
Show all 17Show fewer
- Claude Desktop
- VS Code
- Cursor
- Amazon Bedrock
- OTel Collector
Before you buy
Where it is strong
- Runs on the existing Falcon sensor, with no new agent to deploy
- Shows which AI apps staff use, including unapproved ones
- Masks or blocks personal data and secrets before they reach a prompt
Ask in the demo
- Ask which desktop AI apps it covers today, since a customer says desktop apps get missed
- Check prompt detection on your own examples, since customers call it uneven
- Confirm which parts are live today, since CrowdStrike lists the AI gateway and Falcon Complete for Guardian as upcoming
Runtime security platform for GenAI apps with threat detection & guardrails
Zurich, SwitzerlandFounded 2021$30M raised
- SOC 2
- ISO 27001
Best for: Runtime protection for AI apps and agents you build
At a glance
- Vendor
- Lakera
- Headquarters
- Zurich, Switzerland
- Founded
- 2021
- Deployment
- Cloud
- Company size
- Mid-Market, Enterprise
- NIST CSF
- Detect
- Pricing
- Contact sales
Funding, hiring and news for Lakera on Mandos.
Our take
Check Point AI Agent Security is a runtime security platform for generative AI apps and agents. Its AI Application Firewall detects and blocks prompt injection and jailbreak attempts as they happen. It also filters inappropriate content and stops personal and other sensitive data from leaking.
You connect it with a single API call that works with any app and any LLM, and you can change policies without changing code. Logs can feed your SIEM. Lakera is now part of Check Point.
It earns its place on the build side of this list, because it sits in front of the AI apps and agents your teams ship and blocks attacks as they happen. It fits mid-sized and large teams that build on several models, since one API call covers any app and LLM. Lakera is now part of Check Point, so ask how the roadmap and licensing will change inside the larger company.
Check Point AI Agent Security main features
- AI Application Firewall for GenAI workload protection
- Prompt injection and jailbreak attack detection
- Real-time threat detection and response
- GenAI use case and risk discovery
- Content filtering and data leakage prevention
- Customizable security policies
- Central Security Center dashboard
- SIEM integration via logs
Check Point AI Agent Security main integrations
- Amazon Bedrock
- Google Cloud
- Microsoft Copilot Studio
- Salesforce Agentforce
- n8n
- Relevance AI
- GitHub Actions
- GitLab CI
Before you buy
Where it is strong
- Blocks prompt injection and jailbreak attempts in real time
- One API call works with any app and any LLM
- Policies change without code changes, and logs feed your SIEM
Ask in the demo
- Test its prompt injection blocking on your own app and examples
- Ask how the Check Point purchase changes licensing, roadmap and support
- Ask for customer references, since we found few first-hand reviews
Alternatives to each solution on this list
The closest AI Security alternatives for every pick, matched on features and integrations.
Best for: Zscaler customers controlling AI apps and data
At a glance
- Vendor
- Zscaler
- Headquarters
- San Jose, United States
- Founded
- 2008
- Ownership
- Public company (ZS)
- Deployment
- Cloud
- Company size
- SMB, Mid-Market, Enterprise
- NIST CSF
- Protect, Detect
- Pricing
- Contact sales
Funding, hiring and news for Zscaler on Mandos.
Our take
Zscaler Security for AI adds AI controls to the Zscaler zero trust platform. It shows which AI apps and assistants staff use, including Microsoft Copilot and ChatGPT, inspects prompts inline, blocks prompt injection, and stops personal and sensitive data from being shared. AI isolation lets staff use an AI app without pasting risky data into it.
It connects to Microsoft Copilot, Claude Code, Cursor, GitHub Actions, AWS Bedrock, Kong Gateway, LiteLLM and n8n, among others.
It is on this list because it puts AI controls into a zero trust platform that already carries traffic for many companies, so you get prompt inspection without adding a new path. It fits best if Zscaler already sits in front of your web traffic. If it does not, weigh whether taking on the wider platform is worth it for AI controls alone.
Zscaler Security for AI main features
- AI application and assistant visibility
- Granular policy controls for AI access and usage
- AI isolation to prevent data sharing
- Prompt injection blocking
- Data exfiltration prevention
- PII exposure protection
- LLM and AI model security
- Full audit trail of users, prompts, and responses
Zscaler Security for AI main integrations
- Microsoft Copilot
- Claude Code
- OpenAI Codex CLI
- Azure AI Gateway
- Cursor IDE
- Cline
- Windsurf
- GitHub Actions
- Jenkins
- Google Apigee X
- Google Cloud Run
- AWS Bedrock
Show all 19Show fewer
- Strands
- Kong Gateway
- LiteLLM
- NeMo Guardrails
- Portkey AI Gateway
- TrueFoundry
- n8n
What customers say
Teams use its red teaming to fire large numbers of automated attacks at their own AI apps, so weak spots show up before launch instead of after. On the access side, customers like how much it records, because the prompts staff type into AI sites are logged for review.
Before you buy
Where it is strong
- AI isolation lets staff use AI apps without pasting risky data
- Full record of users, prompts and responses
- Runs inside Zscaler Internet Access with little setup
Ask in the demo
- Test prompt injection rules in a pilot, since one blocked built-in assistant features for a customer
- Ask for documentation and examples for the AI policies, since customers call the docs thin
- Confirm which Zscaler licenses include the AI controls you need
Real-time detection & response for agentic and generative AI applications
Austin, United StatesFounded 2022$156M raised
- SOC 2
Best for: Teams building their own AI apps and agents
At a glance
- Vendor
- HiddenLayer
- Headquarters
- Austin, United States
- Founded
- 2022
- Deployment
- Cloud
- Company size
- Mid-Market, Enterprise
- NIST CSF
- Protect, Detect
- Pricing
- Contact sales
Funding, hiring and news for HiddenLayer on Mandos.
Our take
HiddenLayer AI Runtime Security protects AI apps and agents your teams build. It detects prompt injection, data leaks, model tampering, misuse of agent functions and model theft, and maps alerts to MITRE ATLAS and the OWASP LLM list. It works without exposing your model data.
It connects to GitHub Actions, Jenkins, Splunk, Microsoft Sentinel, LangChain, Hugging Face, AWS Bedrock and Azure AI Foundry, among others.
It earns its place because it covers the AI you build from the build pipeline to runtime, which matters if models and agents are part of your product. It fits mid-sized and large teams with their own MLOps and SOC, because alerts can land in Splunk or Sentinel. Its focus is the AI you build, so if staff use of public chatbots is your bigger worry, start elsewhere on this list.
HiddenLayer AI Runtime Security main features
- Prompt injection detection and prevention
- PII leakage detection and blocking
- Model tampering detection
- Model theft prevention
- Data poisoning defense
- Excessive agency control for autonomous agents
- Real-time monitoring and alerting
- MITRE ATLAS and OWASP LLM mapping
HiddenLayer AI Runtime Security main integrations
- Microsoft Azure AI Foundry
- GitHub Actions
- Jenkins
- Azure DevOps
- JFrog Artifactory
- Splunk
- Microsoft Sentinel
- LangChain
- LiteLLM
- OpenAI Agents SDK
- AWS Strands
- TrueFoundry
Show all 18Show fewer
- Hugging Face
- Anthropic
- GCP
- Meta
- Mistral
- AWS Bedrock
Before you buy
Where it is strong
- Covers the build pipeline as well as runtime, including model scanning
- Maps alerts to MITRE ATLAS and the OWASP LLM list
- Works without exposing your model data
Ask in the demo
- Ask how it covers public AI apps staff use, not only apps you build
- Check which of your model providers and agent frameworks it supports
- Get an example of how its alerts appear in your SIEM
Enterprise AI security platform for visibility, governance, and protection
Mountain View, United StatesFounded 2023$86M raised
- SOC 2
Best for: Network-level AI visibility with no endpoint clients
At a glance
- Vendor
- WitnessAI
- Headquarters
- Mountain View, United States
- Founded
- 2023
- Deployment
- Cloud
- Company size
- Mid-Market, Enterprise
- NIST CSF
- Identify, Protect, Detect
- Pricing
- Contact sales
Funding, hiring and news for WitnessAI on Mandos.
Our take
WitnessAI Platform is an enterprise AI security and governance platform. It watches how AI is used across your staff, models, apps and AI agents at the network level. It finds and catalogs the AI apps in use and checks the intent and risk of each interaction in real time.
It blocks threats in both directions, filters chatbot responses and replaces sensitive data with tokens so it does not leak. It can route requests to secure internal models, governs AI agents at runtime and keeps audit trails. It lists Windows Copilot and Office 365 as integrations.
It belongs here because it sees AI use from the network, which means no endpoint clients or browser extensions to roll out. It fits mid-sized and large companies that want staff-use controls and agent governance in one place. Its listed integrations are few, so ask how it connects to your identity, logging and network setup before you commit.
WitnessAI Platform main features
- Network-level visibility of AI usage across employees and agents
- AI application and model discovery and cataloging
- Real-time intent-based classification and risk analysis
- Runtime AI agent governance and protection
- Bidirectional threat detection and blocking
- Content filtering for chatbot responses
- Sensitive data tokenization
- Intelligent routing to secure internal models
WitnessAI Platform main integrations
- Windows Copilot
- Office 365
Before you buy
Where it is strong
- Network-level visibility with no endpoint clients or browser extensions
- Same policies apply to staff and AI agents
- Tokenizes sensitive data and routes sensitive requests to internal models
Ask in the demo
- Ask which AI apps and agents it can see at the network level, including encrypted traffic
- Check how its policies apply to AI agents, not only to staff
- Ask for customer references, since we found few first-hand reviews
How they fit your cybersecurity program (NIST CSF)
NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. The grid shows which functions each pick maps to in our record, so you can see where a solution sits in your program and what it leaves to other controls.
Where each solution sits on NIST CSF 2.0
All 6 solutions map to Detect. 2 of 6 map to Identify. 4 of 6 map to Protect. None map to Govern, Respond or Recover.
Swipe the table sideways to see all six functions.
| Solution | ||||||
|---|---|---|---|---|---|---|
| All solutions on this list | 0 of 6 | 2 of 6 | 4 of 6 | 6 of 6 | 0 of 6 | 0 of 6 |
| Palo Alto Networks AI Access Security | – | 1 of 3 | 2 of 5 | 1 of 2 | – | – |
| CrowdStrike Falcon Guardian | – | – | – | 2 of 2 | – | – |
| Check Point AI Agent Security | – | – | – | 2 of 2 | – | – |
| Zscaler Security for AI | – | – | 3 of 5 | 1 of 2 | – | – |
| HiddenLayer AI Runtime Security | – | – | 3 of 5 | 2 of 2 | – | – |
| WitnessAI Platform | – | 2 of 3 | 2 of 5 | 2 of 2 | – | – |
A cell shows how many of that function's categories the solution maps to.
A product helps you reach these outcomes, but it does not make you compliant on its own. Your people and processes do the rest.
CISO checklist for selecting an AI Security product
I built this checklist from my own work researching, rolling out and reviewing products like these. I recommend you go through it before you sign.
Nika (Nikoloz) Kokhreidze, Founder of CybersecTools and Mandos
Work through these steps in order to go from a vague AI worry to a contract you can defend.
Your ticks stay in this browser. Nothing is sent to us.
Compare AI Security solutions side by side
Features, integrations, NIST coverage and deployment for every AI Security solution we list, in one table.
Other solutions we considered for this shortlist
We looked at 105 products for this list. These did not make the 6 above but are worth a look for the right team.
1.Neo Agentic Software Control · Neo
Agentic software control, enabling security teams to find, assess, and govern AI agents
2.Alice WonderFence · Alice
Runtime guardrails for GenAI apps providing real-time threat detection & response
3.AIR · AIR Security
Platform for securing, governing, and monitoring AI agent add-ons at runtime.
AI security platform for visibility & control over enterprise AI app usage.
5.Secure Code Warrior Trust Agent: AI · Secure Code Warrior
Provides visibility and governance over AI-generated code in development.
6.Scytale ISO 42001 Compliance Solution · Scytale
All-in-one platform for achieving ISO 42001 AI compliance certification.
7.Raven Runtime AI Agents · Raven
Runtime platform to discover, monitor, and control AI agents in production apps.
8.Backslash Security · Backslash
Agentic AI Endpoint Security - AI agents, MCP servers and Skills, on endpoints
9.DeepKeep AI Firewall · DeepKeep
Runtime protection firewall for AI systems and applications
10.Oso
Security platform for monitoring, controlling, and auditing AI coding agents
Conclusion
Start with the half of the problem that worries you most. If staff use of public AI is the risk, extend the network or endpoint platform you already run: Palo Alto, Zscaler or CrowdStrike. WitnessAI Platform is a fit if you want network-level visibility without endpoint clients.
If you build AI apps, look at Check Point AI Agent Security or HiddenLayer for runtime protection. In every case, test with the AI apps your people actually use, and ask for references for the AI product itself.
Frequently Asked Questions
What is the difference between AI security and AI security posture management?
AI security is the wide field of protecting AI use and AI apps. AI security posture management is one part of it: finding AI apps, models and agents and flagging risky settings. Many products here include posture checks along with runtime controls.
How do I stop staff from pasting sensitive data into chatbots?
Use a product that sits in your web traffic or on the endpoint and inspects prompts before they leave. It should detect sensitive data, block or redact it, and record what was sent. Check that it can inspect the AI apps your staff really use, since some cannot be decrypted.
What is prompt injection?
Prompt injection is when hidden instructions in a message, document or web page trick an AI app into doing something it should not, such as leaking data. Runtime protection products try to detect and block it, and red teaming products test whether your app falls for it.
Do I need red teaming if I have runtime protection?
They do different jobs. Red teaming finds weak spots before launch so you can fix them. Runtime protection catches attacks that still get through once the app is live. Teams that ship AI features to customers usually want both, and some products here, such as HiddenLayer and WitnessAI, include red teaming.
Can my existing network or endpoint security handle this?
Partly. Palo Alto, Zscaler and CrowdStrike all add AI controls to products you may already run, which helps with staff AI use. Protecting the AI apps you build usually needs a product made for AI, such as HiddenLayer or Check Point AI Agent Security.
Why do so many products have few customer reviews?
Most AI security products launched or changed hands in the last two years. Reviews of a vendor's older products do not tell you how its AI features work, so ask for references for the AI product itself.
Sources
These are the pages we reviewed for each pick: the vendor's own product page and website, its market data on Mandos, and every review page we read for customer feedback.
1.Palo Alto Networks AI Access Security · Palo Alto Networks
Product page · Palo Alto Networks website · Market data on Mandos · Gartner Peer Insights · Reddit: can i inspect what users are typing into genai · Reddit: url block for ai site gemini · Reddit: restriction for generative ai application · Reddit: how to prevent employees from submitting
2.CrowdStrike Falcon Guardian · CrowdStrike
Product page · CrowdStrike website · Market data on Mandos · PeerSpot · Reddit: has anyone tried crowdstrike falcon aidr ai · Reddit: crowdstrike ai dr · Reddit: help building a case for aidr
3.Check Point AI Agent Security · Lakera
Product page · Lakera website · Market data on Mandos · G2 · Reddit: is it just me or is nobody building security for · Reddit: for defending ai systems is lakera still
4.Zscaler Security for AI · Zscaler
Product page · Zscaler website · Market data on Mandos · Gartner Peer Insights · Reddit: zscaler ai security capabilities · Reddit: how to block upload in ai platform for zscaler · Reddit: bypassing zscaler to access ai tools at work need
5.HiddenLayer AI Runtime Security · HiddenLayer
Product page · HiddenLayer website · Market data on Mandos · Gartner Peer Insights
6.WitnessAI Platform · WitnessAI
Product page · WitnessAI website · Market data on Mandos · Gartner Peer Insights
