AI Agent Security Vendor Visibility Index
Which AI agent security vendors ChatGPT, Gemini and Perplexity name when buyers ask what to buy
October 2026 edition
Findings (12 sections)
Two AI Agent Security Vendors Lead; the Specialists Diverge by Engine
Share of answers naming each AI agent security vendor, by engine. The grey line spans the three engines; the dark tick is all three combined.
Source: Ranking Atlas, AI Agent Security Vendor Visibility Index, October 2026 edition. 112 buyer questions, each asked twice on ChatGPT, Gemini and Perplexity, on 17 October 2026: 224 answers per engine, 672 in all. Right column: share of all 672 answers, with its 95% interval (Wilson). Data: ai-agent-security-vendor-visibility-index.csv
Show the data as a table
| Vendor | ChatGPT | Gemini | Perplexity | All engines | 95% interval |
|---|---|---|---|---|---|
| Palo Alto Networks (incl. Protect AI) | 80 of 224 (35.7%) | 50 of 224 (22.3%) | 87 of 224 (38.8%) | 217 of 672 (32.3%) | 28.9% to 35.9% |
| Check Point (incl. Lakera) | 81 of 224 (36.2%) | 63 of 224 (28.1%) | 54 of 224 (24.1%) | 198 of 672 (29.5%) | 26.1% to 33.0% |
| NVIDIA | 44 of 224 (19.6%) | 43 of 224 (19.2%) | 33 of 224 (14.7%) | 120 of 672 (17.9%) | 15.1% to 20.9% |
| Microsoft | 39 of 224 (17.4%) | 24 of 224 (10.7%) | 32 of 224 (14.3%) | 95 of 672 (14.1%) | 11.7% to 17.0% |
| HiddenLayer | 45 of 224 (20.1%) | 17 of 224 (7.6%) | 32 of 224 (14.3%) | 94 of 672 (14.0%) | 11.6% to 16.8% |
| Zenity | 25 of 224 (11.2%) | 25 of 224 (11.2%) | 43 of 224 (19.2%) | 93 of 672 (13.8%) | 11.4% to 16.7% |
| Promptfoo | 37 of 224 (16.5%) | 33 of 224 (14.7%) | 22 of 224 (9.8%) | 92 of 672 (13.7%) | 11.3% to 16.5% |
| Cisco (incl. Robust Intelligence) | 29 of 224 (12.9%) | 24 of 224 (10.7%) | 33 of 224 (14.7%) | 86 of 672 (12.8%) | 10.5% to 15.5% |
| SentinelOne (incl. Prompt Security) | 15 of 224 (6.7%) | 28 of 224 (12.5%) | 37 of 224 (16.5%) | 80 of 672 (11.9%) | 9.7% to 14.6% |
| Mindgard | 18 of 224 (8.0%) | 17 of 224 (7.6%) | 37 of 224 (16.5%) | 72 of 672 (10.7%) | 8.6% to 13.3% |
| NeuralTrust | 4 of 224 (1.8%) | 14 of 224 (6.3%) | 34 of 224 (15.2%) | 52 of 672 (7.7%) | 5.9% to 10.0% |
| Noma Security | 21 of 224 (9.4%) | 11 of 224 (4.9%) | 17 of 224 (7.6%) | 49 of 672 (7.3%) | 5.6% to 9.5% |
Key Findings
- Two vendors lead clearly. Palo Alto Networks (incl. Protect AI) was named in 32.3% of answers and Check Point (incl. Lakera) in 29.5%. No other core vendor reached 18%.
- Buyer type changes the leader. Palo Alto Networks leads for three of the eight buyer types. The other five are led by Check Point, Zenity, Promptfoo and LayerX, and LayerX is not in the main table at all.
- The engines disagree on the specialists. NeuralTrust was named in 1.8% of ChatGPT answers and 15.2% of Perplexity answers.
- The field has a long tail. The engines named 212 core products and companies. Only 22 cleared the main-table line, and 76 were named in a single answer.
- Adjacent products take almost half the mentions. Of 3,924 counted vendor mentions, 1,852 (47.2%) were adjacent products such as data security, identity and cloud platforms, and 134 of the 671 answers named no core vendor at all.
The Core Ranking
| Rank | Vendor | Visibility % | ChatGPT % | Gemini % | Perplexity % |
|---|---|---|---|---|---|
| 1 | Palo Alto Networks (incl. Protect AI) | 35.7 | 22.4 | 38.8 | |
| 2 | Check Point (incl. Lakera) | 36.2 | 28.2 | 24.1 | |
| 3 | NVIDIA | 19.6 | 19.3 | 14.7 | |
| 4 | Microsoft | 17.4 | 10.8 | 14.3 | |
| 6 | Zenity | 11.2 | 11.2 | 19.2 | |
| 7 | Promptfoo | 16.5 | 14.8 | 9.8 | |
| 8 | Cisco (incl. Robust Intelligence) | 12.9 | 10.8 | 14.7 | |
| 9 | SentinelOne (incl. Prompt Security) | 6.7 | 12.6 | 16.5 | |
| 10 | Mindgard | 8.0 | 7.6 | 16.5 | |
| 11 | NeuralTrust | 1.8 | 6.3 | 15.2 | |
| 12 | Noma Security | 9.4 | 4.9 | 7.6 | |
| 13 | Giskard | 6.2 | 6.3 | 4.9 | |
| 14 | Pillar Security | 1.3 | 6.7 | 8.9 | |
| 15 | F5 (incl. CalypsoAI) | 3.1 | 8.5 | 4.0 | |
| 16 | Confident AI | 4.5 | 3.1 | 5.8 | |
| 17 | Meta | 0.0 | 6.7 | 5.8 | |
| 18 | Lasso Security | 0.9 | 6.3 | 4.0 | |
| 19 | Radware | 0.0 | 2.2 | 6.7 | |
| 20 | WitnessAI | 0.9 | 1.3 | 5.8 | |
| 21 | Netskope | 4.5 | 0.0 | 3.1 | |
| 22 | Zscaler | 4.9 | 0.5 | 1.8 |
The top of the table is decided. Third place is not. Palo Alto Networks (incl. Protect AI) and Check Point (incl. Lakera) are 2.8 points apart and are both at least 11 points clear of everyone else. Below them, five vendors sit between 13.7% and 17.9%: NVIDIA, Microsoft, HiddenLayer, Zenity and Promptfoo. Their order changes by engine. HiddenLayer is third on ChatGPT (20.1%), Promptfoo is fourth on Gemini (14.8%) and Zenity is third on Perplexity (19.2%). That makes "third most visible" a question of which engine a buyer uses.
The Adjacent Ranking
| Rank | Vendor | Visibility % | ChatGPT % | Gemini % | Perplexity % |
|---|---|---|---|---|---|
| 1 | Microsoft | 38.8 | 18.4 | 32.1 | |
| 2 | Palo Alto Networks (incl. Talon) | 7.6 | 16.6 | 8.5 | |
| 3 | Wiz | 6.2 | 15.3 | 8.5 | |
| 4 | Netskope | 6.7 | 9.4 | 8.5 | |
| 5 | Nightfall AI | 4.9 | 5.4 | 12.5 | |
| 6 | CrowdStrike | 4.9 | 8.5 | 6.7 | |
| 7 | ServiceNow | 8.9 | 3.1 | 7.6 | |
| 8 | Zscaler | 4.5 | 8.1 | 6.7 | |
| 9 | IBM | 4.0 | 3.6 | 11.2 | |
| 10 | Amazon (AWS) | 7.6 | 2.2 | 4.9 | |
| 11 | Cyberhaven | 0.9 | 7.6 | 4.0 | |
| 12 | Nudge Security | 2.2 | 6.7 | 3.6 | |
| 13 | Reco | 2.2 | 4.5 | 5.8 | |
| 14 | Confident AI | 1.3 | 5.4 | 5.4 | |
| 15 | 4.9 | 2.2 | 4.5 | ||
| 16 | Forcepoint | 0.4 | 0.9 | 10.3 | |
| 17 | Cyera | 1.3 | 6.7 | 2.7 | |
| 18 | Okta | 1.8 | 1.3 | 7.6 | |
| 19 | Proofpoint | 1.8 | 2.7 | 5.8 | |
| 20 | Credo AI | 1.3 | 2.7 | 5.8 | |
| 21 | SailPoint (incl. Entro) | 1.8 | 1.3 | 4.9 |
One company dominates the adjacent answers. Microsoft was named in 29.8% of answers for adjacent products and came first on all three engines. The next adjacent vendor, Palo Alto Networks (incl. Talon), averaged 10.9%. For buyers, this means that answers about securing AI regularly lead to the AI and security platforms they may already own. For vendors, the competitive set in AI answers is wider than a typical shortlist: a data security or identity product can take the place a core vendor might expect.
Results by Buyer Type
Regulated enterprise (bank or insurer CISO)
- Palo Alto Networks (incl. Protect AI) 48.8
- Zenity 31.0
- Check Point (incl. Lakera) 29.8
- Cisco (incl. Robust Intelligence) 22.6
- SentinelOne (incl. Prompt Security) 20.2
The buyer type that most resembles the overall ranking. Zenity is second here. 69 of 84 answers named at least one core vendor outside the eleven multi-product companies defined below.
UK and EU regulated
- Check Point (incl. Lakera) 42.9
- Palo Alto Networks (incl. Protect AI) 23.8
- Cisco (incl. Robust Intelligence) 21.4
- NVIDIA 17.9
- NeuralTrust 16.7
Where two smaller core vendors do best. NeuralTrust ranks eleventh overall and fifth here, and 14 of its 52 counted mentions come from this buyer type. F5 (incl. CalypsoAI) takes 12 of its 35 here.
Customer-facing AI product
- Check Point (incl. Lakera) 72.3
- NVIDIA 43.4
- Palo Alto Networks (incl. Protect AI) 38.6
- Microsoft 22.9
- HiddenLayer 19.3
The highest single buyer-type score in the study. Check Point (incl. Lakera) was named in 60 of 83 answers about protecting a customer-facing AI application. This buyer type also has the highest share for the eleven multi-product companies (54.0% of core mentions).
AI red teaming
- Promptfoo 71.4
- NVIDIA 61.9
- Microsoft 58.3
- Mindgard 54.8
- Check Point (incl. Lakera) 35.7
The buyer type with the highest scores. Four vendors pass 50%, and 72 of 84 answers named a core vendor outside the multi-product group. Confident AI's position here is the most concentrated of any ranked vendor.
Model supply chain and AI posture
- Palo Alto Networks (incl. Protect AI) 58.3
- HiddenLayer 41.7
- Cisco (incl. Robust Intelligence) 17.9
- PickleScan / Veritensor / ModelScan family 8.3
- Check Point (incl. Lakera) 8.3
A two-vendor buyer type. Palo Alto Networks (incl. Protect AI) and HiddenLayer are nearly 24 points clear of third place. Open-source model scanners appear in the top five, which happens for no other buyer type.
Business-built agents (SaaS and business apps)
- Zenity 46.4
- Palo Alto Networks (incl. Protect AI) 40.5
- Check Point (incl. Lakera) 25.0
- SentinelOne (incl. Prompt Security) 15.5
- Radware 10.7
Zenity's strongest buyer type, and one of three led by a vendor outside the overall top five. Zenity takes 39 of its 93 counted mentions here.
Developer and coding agents
- Palo Alto Networks (incl. Protect AI) 21.4
- SentinelOne (incl. Prompt Security) 16.7
- Pillar Security 15.5
- Zenity 15.5
- Check Point (incl. Lakera) 14.3
The most open buyer type. No vendor reaches 25%, and the top five are within 7.1 points of each other. 24 of 84 answers named no core vendor.
Workforce AI use (mid-size IT and security)
- LayerX 28.6
- SentinelOne (incl. Prompt Security) 23.8
- Harmonic Security 22.6
- Netskope 14.3
- Zscaler 11.9
Led by vendors that do not appear in the main table. LayerX and Harmonic Security are first and third here, but neither was named in 7 questions in any single engine run, so both sit in the appendix. This buyer type has the most answers naming no core vendor (25 of 84).
Results by Engine
| ChatGPT | Gemini | Perplexity | |
|---|---|---|---|
| 1 | Check Point (incl. Lakera) 36.2 | Check Point (incl. Lakera) 28.2 | Palo Alto Networks (incl. Protect AI) 38.8 |
| 2 | Palo Alto Networks (incl. Protect AI) 35.7 | Palo Alto Networks (incl. Protect AI) 22.4 | Check Point (incl. Lakera) 24.1 |
| 3 | HiddenLayer 20.1 | NVIDIA 19.3 | Zenity 19.2 |
| 4 | NVIDIA 19.6 | Promptfoo 14.8 | SentinelOne (incl. Prompt Security) 16.5 |
| 5 | Microsoft 17.4 | SentinelOne (incl. Prompt Security) 12.6 | Mindgard 16.5 |
| Core vendors named | 129 | 89 | 101 |
| Core vendors per answer | 2.98 | 2.67 | 3.61 |
| Answers naming no core vendor | 42 of 224 | 50 of 223 | 42 of 224 |
The engines agree on the top two and on little else. All three put the same two vendors first and second, though in a different order on Perplexity. From third place down, each engine has a different list. Perplexity names the most vendors per answer and gives the specialists more room: in the adjacent table, Forcepoint gets 10.3% on Perplexity against 0.4% on ChatGPT. Three ranked core vendors were never named by one engine: Meta and Radware on ChatGPT, and Netskope on Gemini.
What the Data Shows
Two vendors lead, and both leads include acquired products
Between them, the two leaders head five of the eight buyer types. Each total includes a product the company bought (Protect AI and Lakera), so the positions describe the companies as buyers can purchase from them today, not the parent brands alone. At the level of individual mentions, the top two hold 20.0% of all core mentions and the top ten hold 55.4%.
Buyer type changes the answer more than anything else
Zenity ranks sixth overall and first for business-built agents (46.4%). Promptfoo ranks seventh overall and first for AI red teaming (71.4%). LayerX is first for workforce AI use (28.6%). Several vendors depend heavily on one buyer type: Confident AI takes 29 of its 30 core mentions from red-teaming questions, Promptfoo 60 of 92 and Mindgard 46 of 72. For a vendor, the overall rank can hide a strong position with one buyer and almost none with the rest. For a buyer, how the question is framed decides which names come back.
The three engines are not measuring the same market
Each engine names a different number of core vendors (Table 3), and Gemini's ranking was the least stable between its two runs (Table 4). Individual vendors move sharply: Mindgard is named in 16.5% of Perplexity answers and 7.6% of Gemini answers. Visibility measured on one engine is not a proxy for the other two.
The question type shifts answers between multi-product companies and everyone else
Eleven of the 22 ranked core vendors are multi-product security or technology companies: Palo Alto Networks, Check Point, NVIDIA, Microsoft, Cisco, SentinelOne, F5, Meta, Radware, Netskope and Zscaler. Together they took 44.0% of core mentions. Their share depends on how the question is asked. On open questions about the problem, they took 66.7%. On shortlist questions it was 49.8%, and on questions about a specific capability 37.5%. When a buyer describes a precise requirement, the engines reach further into the field. When a buyer asks broadly, they return to the large names.
Adjacent products take almost half the answers, and the tail is long
One answer in five named no core vendor at all. The buyer's choice in AI answers is wider than the core category, and most named vendors are mentioned too rarely to rank.
How to Read the Tables
The four views answer different questions: Tables 1 and 2 rank vendors overall, the buyer-type view shows the top five for each buyer type, and the engine view shows each engine's own top five. A vendor's position often differs between views, and that difference is usually the most useful thing to know.
Why the Line Is 7 Questions
A vendor is ranked only if it was named in 7 or more of the 112 questions in at least one engine run. Below that, the difference between one appearance and two reflects run-to-run variation more than a real gap. 190 further core entries and 230 further adjacent entries were named at least once but fell below the line. All of them are in the appendix and the CSV. Three core entries came close, with a best single run of 5 or 6 questions: LayerX, Harmonic Security and LLM Guard (open source). If a product was never named, that is a result rather than an omission.
How We Measured
Questions. 112 questions written in the voice of real buyers: 14 for each of eight buyer types, covering shortlist, capability and open problem questions. No question names a brand. Every question was reviewed for wording that would favour one kind of vendor, and the set was fixed before collection.
Collection. Each question was asked twice on ChatGPT, Gemini and Perplexity on 10 October 2026, through the ChatGPT and Gemini consumer apps and the Perplexity API (sonar, web search on), with no system message or prior conversation, set to US location and English. 671 of 672 answers were collected. One Gemini answer in run 2 failed and is recorded as missing, not as zero.
Counting. A company counts once per answer, however many times it is named. A mention counts when the answer recommends or lists the product as an option. Products named only as something to avoid, as existing context, or as the thing being secured do not count.
Classes. Core and adjacent are defined under Tables 1 and 2.
Score. Visibility % is the mean of the six engine-run percentages, so each engine counts equally.
Acquired products. A product bought by another company counts under its owner on the collection date, and the label says so: Check Point (incl. Lakera), Palo Alto Networks (incl. Protect AI), Cisco (incl. Robust Intelligence), SentinelOne (incl. Prompt Security), F5 (incl. CalypsoAI), SailPoint (incl. Entro) and, in the adjacent table, Palo Alto Networks (incl. Talon).
How Consistent Each Engine Was Between Runs
| Engine | Core: rank correlation | Core: top-10 overlap | Adjacent: rank correlation | Adjacent: top-10 overlap |
|---|---|---|---|---|
| ChatGPT | 0.914 | 9 of 10 | 0.546 | 8 of 10 |
| Gemini | 0.493 | 7 of 10 | 0.627 | 9 of 10 |
| Perplexity | 0.951 | 10 of 10 | 0.867 | 8 of 10 |
Perplexity and ChatGPT returned almost the same core ranking twice. Gemini's core ranking changed noticeably between runs, which is why the index averages two runs per engine and does not rely on one.
Limitations
This is one collection window, so answers can change week to week. Real users with their own history, location or settings may see different answers. Coding was done by a single coder against a fixed codebook, with every judgement call logged. Counts measure how often a vendor is named, not whether the recommendation is favourable. Results for a buyer type rest on 14 questions.
The 112 buyer questions, grouped by buyer type
Regulated enterprise (CISO or security architecture lead, bank or insurer, 5,000+ staff)
| ID | Stage | Question |
|---|---|---|
| FS01 | Shortlist | We are a bank with 20,000 employees rolling out AI agents that can act in internal systems. Which AI agent security platforms should be on our shortlist? Compare the leading vendors. |
| FS02 | Vendor selection | I am CISO at a large insurer. We need one product to discover, monitor and control every AI agent and AI application across the business. Which vendors should we evaluate? |
| FS03 | Vendor selection | Which AI security software should a global financial services firm buy to protect customer-facing generative AI applications in production? Recommend specific products. |
| FS04 | Shortlist | Our board has asked for an enterprise AI security platform before we scale AI agents beyond pilots. Which vendors are the strongest options for a heavily regulated enterprise, and why? |
| FS05 | Shortlist | We have budget this year for AI runtime protection across several hundred internal AI applications. Which enterprise vendors should we put on an RFP shortlist? |
| FS06 | Requirements | Which AI agent security vendors suit a large enterprise that needs on-premises or private-cloud deployment and strict data residency? Name specific products. |
| FS07 | Solution exploration | Which products can build an inventory of every AI agent, model and AI application running across a large enterprise, including ones deployed without security approval? |
| FS08 | Requirements | Which security platforms enforce policy on what actions an AI agent may take in production systems, and block or require human approval for high-risk actions? |
| FS09 | Requirements | Which AI security tools map their controls to the OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework, with reporting suitable for auditors? |
| FS10 | Requirements | Which products detect prompt injection and sensitive data leakage in AI applications in real time and send alerts into an existing SIEM? |
| FS11 | Requirements | Which vendors offer AI security posture management that scores the risk of each AI deployment and tracks remediation across business units? |
| FS12 | Requirements | Which AI security platforms keep a tamper-evident audit trail of AI agent decisions and tool calls that a financial regulator would accept as evidence? |
| FS13 | Problem framing | How should a large bank secure AI agents that can take actions in core systems without slowing down adoption? |
| FS14 | Problem framing | What does a mature AI security programme look like at a regulated enterprise, and what tooling does it rely on? |
Customer-facing AI product (product or application security lead, 200-2,000 person software company)
| ID | Stage | Question |
|---|---|---|
| PS01 | Shortlist | We are a 400-person software company launching a customer-facing AI assistant inside our product. Which AI application security tool should we buy to protect it? Give a shortlist. |
| PS02 | Shortlist | Which guardrail products should a mid-size software company evaluate to stop prompt injection and jailbreaks in a production chatbot? Compare the leading options. |
| PS03 | Shortlist | I lead product security at a growth-stage software company. Which vendors should we look at to secure the AI agent we are shipping to customers? |
| PS04 | Vendor selection | What is the best AI firewall or runtime protection product for a software company exposing a large language model feature to thousands of customers? Recommend specific products. |
| PS05 | Vendor selection | Our engineers want an AI security tool they will actually adopt for our customer-facing AI features. Which products are worth paying for? |
| PS06 | Shortlist | Which AI application security vendors fit a company with a small security team, a fast release cycle and a limited budget? |
| PS07 | Requirements | Which tools scan prompts and model responses in real time for prompt injection, sensitive data and harmful content, with latency low enough for a live product? |
| PS08 | Requirements | Which products protect a retrieval-augmented generation application from indirect prompt injection hidden in documents and web pages? |
| PS09 | Requirements | Which security tools can stop an AI agent in our product from being tricked into calling tools or APIs it should not use? |
| PS10 | Requirements | Which AI security products provide an SDK or API that drops into an existing application with a few lines of code? |
| PS11 | Validation | Which AI security products test a customer-facing AI feature before release and keep monitoring it in production, with reports a software vendor can share in enterprise customers' security reviews? |
| PS12 | Requirements | Which AI security products check a multi-tenant AI application's responses and block one customer's data from appearing in another customer's answers? |
| PS13 | Problem framing | How should a software company protect a customer-facing AI assistant from prompt injection? |
| PS14 | Problem framing | What is the right way to test and monitor a large language model feature before and after it goes live? |
Workforce AI use (head of IT or security, 300-3,000 staff)
| ID | Stage | Question |
|---|---|---|
| WU01 | Vendor selection | Which software should a 1,500-person company buy to see and control which generative AI tools employees are using? Recommend specific products. |
| WU02 | Shortlist | We want to let staff use public AI chat assistants without leaking customer data. Which AI usage security vendors should we evaluate? |
| WU03 | Shortlist | I am head of IT at a 600-person professional services firm. Which shadow AI discovery and control products are worth buying? |
| WU04 | Shortlist | Which vendors offer the best protection against employees pasting confidential data into AI chatbots, for a mid-market company? Compare the options. |
| WU05 | Shortlist | Which AI data protection tools should a company shortlist to govern employee use of AI browser extensions, AI note-takers and AI features inside SaaS apps? |
| WU06 | Vendor selection | What is the best product for a security team that wants to allow generative AI at work but coach employees in real time when they put sensitive data at risk? |
| WU07 | Solution exploration | Which tools give a full inventory of every AI app and AI feature employees use, including ones they sign into with personal accounts? |
| WU08 | Requirements | Which products inspect prompts sent to AI assistants in the browser and redact sensitive data before it leaves the device? |
| WU09 | Requirements | Which security products apply different AI usage policies by department, for example allowing engineers to use coding assistants while blocking file uploads from finance? |
| WU10 | Requirements | Which tools detect when AI agents or AI features inside approved SaaS apps gain access to company files, email or calendars? |
| WU11 | Requirements | Which AI usage control products deploy as a browser extension rather than a network proxy? |
| WU12 | Validation | Which products report how employees use generative AI across the company so security and legal teams can approve or block tools? |
| WU13 | Problem framing | How should a mid-size company manage the risks of employees using generative AI tools without banning them? |
| WU14 | Problem framing | What is the best way to find out which AI tools employees are already using without slowing them down? |
Business-built agents (SaaS or business-apps security lead)
| ID | Stage | Question |
|---|---|---|
| LC01 | Vendor selection | Our business teams build their own AI agents in the low-code agent builders that come with our productivity suite and CRM. Which security products should we buy to govern them? |
| LC02 | Shortlist | Which vendors secure AI agents and automations built by business users at an enterprise where thousands of employees build their own? Give a shortlist. |
| LC03 | Vendor selection | I run SaaS security at a 5,000-person company. Which product should we buy to monitor the AI agents built inside our business applications? |
| LC04 | Shortlist | Which AI agent security platforms suit enterprises whose agents are mostly built by non-developers on low-code platforms? Compare the leading options. |
| LC05 | Shortlist | We need to find and fix risky AI agents that employees have built in our collaboration and CRM platforms. Which vendors should we evaluate? |
| LC06 | Vendor selection | Which security tools should a company buy to govern the AI copilots and agents embedded across its SaaS applications? |
| LC07 | Requirements | Which products discover AI agents built in low-code platforms and show what data, connectors and permissions each one has? |
| LC08 | Requirements | Which tools detect when a business-built AI agent is shared too widely or exposes sensitive data to people who should not see it? |
| LC09 | Requirements | Which security platforms stop a low-code AI agent from being manipulated by prompt injection hidden in the emails or documents it reads? |
| LC10 | Requirements | Which products monitor the actions AI agents inside SaaS applications take, such as sending emails, updating records or moving files? |
| LC11 | Requirements | Which tools enforce security policies on AI agents and automations built by business users without blocking them from building? |
| LC12 | Requirements | Which products map the connections between AI agents, SaaS apps and the identities they act as, to find over-permissioned agents? |
| LC13 | Problem framing | How should a security team keep up with hundreds of AI agents built by business users in low-code tools? |
| LC14 | Problem framing | What are the main security risks of letting employees build their own AI agents, and how do companies manage them? |
Developer and coding agents (platform security or DevSecOps lead)
| ID | Stage | Question |
|---|---|---|
| DA01 | Vendor selection | Our engineers use AI coding agents and connect them to internal MCP servers. Which security products should we buy to control what those agents can do? Recommend specific products. |
| DA02 | Shortlist | Which MCP security or MCP gateway products should a company with 300 engineers evaluate? Compare the leading options. |
| DA03 | Shortlist | I lead platform security. Which vendors secure autonomous coding agents that can run commands, open pull requests and access production credentials? |
| DA04 | Vendor selection | Which product should we buy to approve, monitor and block the MCP servers, plugins and agent skills our developers install? |
| DA05 | Shortlist | Which agent security platforms suit a company building its own AI agents in code with open-source agent frameworks? Give a shortlist. |
| DA06 | Vendor selection | Which tools should a software company buy to secure AI agents and MCP servers running on developer laptops? |
| DA07 | Requirements | Which tools discover every AI agent, AI coding assistant and MCP server in use across our code repositories and developer machines, including ones security never approved? |
| DA08 | Requirements | Which products detect malicious or vulnerable MCP servers and agent plugins before developers install them? |
| DA09 | Requirements | Which security tools monitor the terminal commands and file changes made by AI coding agents on developer machines? |
| DA10 | Requirements | Which products stop AI agents from leaking secrets or credentials through tool calls or generated code? |
| DA11 | Requirements | Which products put a security proxy between AI agents and the tools and APIs they call, with logging and policy enforcement? |
| DA12 | Requirements | Which tools enforce least-privilege permissions for AI agents running in CI/CD pipelines and cloud environments? |
| DA13 | Problem framing | How should a platform team secure the use of MCP servers across an engineering organisation? |
| DA14 | Problem framing | What controls do companies put around AI coding agents that can run commands on developer machines? |
AI red teaming (AI red team or ML security lead)
| ID | Stage | Question |
|---|---|---|
| RT01 | Shortlist | Which automated AI red teaming product should we buy to test our large language model applications before release? Give a shortlist with strengths and weaknesses. |
| RT02 | Shortlist | We need continuous adversarial testing for the AI agents we deploy. Which vendors should we evaluate? |
| RT03 | Vendor selection | I run an AI red team at a large enterprise. Which commercial tools are worth paying for alongside open-source testing frameworks? |
| RT04 | Shortlist | Which AI security testing platforms are best for testing multi-step AI agents with tool access, not just single chat prompts? |
| RT05 | Vendor selection | Which vendors offer AI red teaming as a product plus expert services for a company preparing a high-risk AI system for launch? Compare the options. |
| RT06 | Vendor selection | Which tools suit a small ML team that wants to test its models and agents for jailbreaks and prompt injection on every release? |
| RT07 | Requirements | Which tools automatically generate adversarial prompts to test an AI application for jailbreaks, prompt injection and data leakage? |
| RT08 | Requirements | Which products test AI agents for unsafe tool use, privilege escalation and goal hijacking? |
| RT09 | Requirements | Which AI red teaming tools map their findings to MITRE ATLAS and the OWASP Top 10 for LLM Applications? |
| RT10 | Requirements | Which products run AI security tests inside CI/CD so a model or prompt change cannot ship if it fails? |
| RT11 | Requirements | Which tools test multilingual and multimodal AI applications, including images and audio, for safety and security failures? |
| RT12 | Solution exploration | Which open-source tools are used for red teaming large language models, and which commercial products build on them? |
| RT13 | Problem framing | How should a company red team an AI agent before giving it access to production systems? |
| RT14 | Problem framing | How often should AI applications be security tested, and what should the testing cover? |
Model supply chain and AI-SPM (cloud or ML platform security lead)
| ID | Stage | Question |
|---|---|---|
| MS01 | Shortlist | We run open-weight models and custom ML pipelines in our cloud accounts. Which AI security posture management products should we evaluate? Recommend specific products. |
| MS02 | Vendor selection | Which product should a data science organisation buy to scan machine learning models for malicious code and backdoors before they are deployed? |
| MS03 | Shortlist | I lead cloud security at a company that trains and hosts its own models. Which vendors secure the AI model supply chain end to end? |
| MS04 | Shortlist | Which AI security platforms are best for discovering AI services, models and training data across several cloud providers? Give a shortlist. |
| MS05 | Shortlist | Which vendors should a company evaluate to protect its proprietary models from theft, extraction and tampering? |
| MS06 | Vendor selection | Which AI security posture products fit a company that already uses a cloud security platform and wants AI-specific coverage? |
| MS07 | Requirements | Which tools scan models downloaded from public model hubs for unsafe serialisation, malware and hidden backdoors? |
| MS08 | Requirements | Which products generate an AI bill of materials listing every model, dataset and dependency used in production? |
| MS09 | Requirements | Which tools detect misconfigured AI services in the cloud, such as public model endpoints or overly broad access to training data? |
| MS10 | Requirements | Which products detect adversarial attacks against deployed machine learning models, such as evasion or model extraction? |
| MS11 | Requirements | Which tools verify the origin and integrity of open-weight models before deployment, for example by checking signatures and detecting tampered model files? |
| MS12 | Requirements | Which AI security products detect poisoned or tampered training and fine-tuning data before it is used to train or update a model? |
| MS13 | Problem framing | How should a company secure its machine learning supply chain when it relies on open-weight models? |
| MS14 | Problem framing | What does AI security posture management cover, and how is it different from cloud security posture management? |
UK and EU regulated (CISO or risk lead, European regulated organisation)
| ID | Stage | Question |
|---|---|---|
| EU01 | Shortlist | We are a European bank deploying AI agents under the EU AI Act and DORA. Which AI security vendors should we evaluate? Give a shortlist. |
| EU02 | Vendor selection | Which AI security platforms are best for a UK financial services firm that needs its data to stay in the UK or EU? Recommend specific products. |
| EU03 | Shortlist | I am CISO at a European insurer. Which vendors can secure our generative AI applications and give us evidence for regulators? |
| EU04 | Shortlist | Which European AI security companies should a public-sector organisation in the EU consider for protecting its AI systems? |
| EU05 | Shortlist | Which AI security products should a UK company with 800 staff buy to secure AI agents while meeting GDPR obligations? Compare the options. |
| EU06 | Shortlist | Which vendors provide AI red teaming and runtime protection for high-risk AI systems as defined by the EU AI Act? |
| EU07 | Requirements | Which tools help meet the EU AI Act requirements for accuracy, robustness and cybersecurity of high-risk AI systems? |
| EU08 | Requirements | Which AI security products can be self-hosted in an EU data centre so prompts and responses never leave the region? |
| EU09 | Validation | Which products produce documentation of AI security testing suitable for an EU AI Act conformity assessment? |
| EU10 | Requirements | Which AI security products provide runtime controls and security test evidence that a European company can map to its ISO/IEC 42001 AI management system? |
| EU11 | Requirements | Which products detect personal data in prompts and AI outputs and help a company meet GDPR when using generative AI? |
| EU12 | Requirements | Which tools give a DORA-regulated financial firm visibility and control over the third-party AI services its staff and systems use? |
| EU13 | Problem framing | How should a European company approach AI security to meet the EU AI Act? |
| EU14 | Problem framing | What cybersecurity measures do regulators expect for AI systems used in European financial services? |
Appendix: 420 other vendors named
| Vendor | Table | ChatGPT r1 / r2 | Gemini r1 / r2 | Perplexity r1 / r2 |
|---|---|---|---|---|
| 1Password | Adjacent | 1 / 1 | 0 / 0 | 2 / 2 |
| 1stProtect (AgentProtect) | Core | 1 / 1 | 0 / 0 | 0 / 0 |
| A10 Networks | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| AccuKnox | Core | 0 / 0 | 3 / 2 | 0 / 0 |
| Adaptive Shield | Adjacent | 0 / 0 | 2 / 1 | 1 / 1 |
| Adeptiv.AI | Adjacent | 0 / 0 | 0 / 1 | 0 / 0 |
| Adversa AI | Core | 1 / 0 | 0 / 1 | 3 / 1 |
| Aegis Trace | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| Aembit | Adjacent | 1 / 0 | 0 / 2 | 0 / 0 |
| Aevum | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| Agent Gate | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| AgentAudit | Core | 0 / 0 | 0 / 0 | 1 / 0 |
| AgentDojo | Core | 2 / 0 | 0 / 0 | 0 / 0 |
| Agentmetry | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| AgentOps | Adjacent | 0 / 0 | 1 / 1 | 1 / 1 |
| AgentReceipt | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| AgentsFlow | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| AgentShield (MCP gateway) | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| Aguara | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| AI Act Companion | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| AI EdgeLabs / Parallax / LockLLM | Core | 0 / 0 | 1 / 0 | 0 / 0 |
| AI Verify Moonshot | Core | 1 / 0 | 0 / 0 | 1 / 1 |
| AI-Infra-Guard | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| AIBound | Adjacent | 0 / 0 | 0 / 0 | 0 / 1 |
| AIControls (shadow-AI discovery) | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| AIR Blackbox | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| Airia | Core | 1 / 1 | 2 / 0 | 1 / 1 |
| Airside Labs | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| AiRysk | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| AIShield (Bosch) | Core | 0 / 0 | 0 / 0 | 2 / 2 |
| Akamai | Adjacent | 1 / 2 | 3 / 3 | 2 / 2 |
| Akamai | Core | 0 / 0 | 2 / 2 | 3 / 3 |
| Akeyless | Adjacent | 0 / 0 | 0 / 0 | 1 / 0 |
| Akto | Core | 1 / 0 | 0 / 2 | 4 / 3 |
| Algenta | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Alibaba | Core | 0 / 0 | 1 / 0 | 0 / 0 |
| Alice (ActiveFence) | Core | 1 / 0 | 0 / 0 | 1 / 1 |
| Amazon (AWS) | Core | 3 / 0 | 0 / 2 | 3 / 4 |
| Anjuna | Adjacent | 1 / 1 | 0 / 0 | 0 / 0 |
| Anzenna | Adjacent | 0 / 0 | 0 / 1 | 0 / 0 |
| Aona AI | Core | 1 / 1 | 0 / 0 | 2 / 2 |
| Apache APISIX | Adjacent | 0 / 0 | 0 / 1 | 0 / 0 |
| Apono | Adjacent | 0 / 0 | 0 / 1 | 0 / 1 |
| Aporia | Adjacent | 0 / 0 | 2 / 1 | 0 / 0 |
| AppOmni | Adjacent | 2 / 2 | 3 / 4 | 1 / 1 |
| AQtive Guard | Core | 0 / 0 | 1 / 0 | 0 / 0 |
| Aqua Security | Adjacent | 0 / 0 | 1 / 0 | 0 / 0 |
| Aquila (Alterion) | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Arcade.dev | Adjacent | 0 / 0 | 0 / 1 | 1 / 0 |
| Archer | Adjacent | 1 / 2 | 0 / 0 | 0 / 0 |
| Arcjet | Core | 2 / 1 | 0 / 0 | 4 / 4 |
| Areebi | Adjacent | 0 / 0 | 1 / 0 | 1 / 1 |
| Arize (Phoenix) | Adjacent | 1 / 0 | 5 / 4 | 1 / 1 |
| ARMO | Adjacent | 0 / 0 | 0 / 2 | 0 / 0 |
| ArmorIQ | Core | 0 / 0 | 0 / 1 | 0 / 0 |
| Arthur | Adjacent | 0 / 1 | 2 / 5 | 1 / 1 |
| Arthur | Core | 0 / 0 | 2 / 3 | 0 / 0 |
| ARTKIT | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Asenion | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Assay | Adjacent | 1 / 1 | 0 / 0 | 0 / 0 |
| Assury | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| Astrix Security | Adjacent | 2 / 1 | 2 / 3 | 4 / 4 |
| Auditant | Adjacent | 1 / 1 | 0 / 0 | 0 / 0 |
| Aurascape | Core | 0 / 0 | 1 / 0 | 0 / 0 |
| AvePoint | Adjacent | 0 / 0 | 1 / 2 | 0 / 1 |
| Averta | Core | 0 / 0 | 1 / 0 | 1 / 1 |
| AXEC | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| Beam (AgentBeam) | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| BenchBot | Core | 1 / 1 | 0 / 0 | 0 / 0 |
| Benchspan | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Bifrost (Maxim AI) | Adjacent | 2 / 1 | 1 / 0 | 3 / 2 |
| BigID | Adjacent | 1 / 1 | 3 / 4 | 5 / 5 |
| Bishop Fox | Core | 0 / 0 | 0 / 1 | 1 / 2 |
| Bitdefender | Core | 1 / 1 | 0 / 0 | 1 / 1 |
| Braintrust | Adjacent | 0 / 0 | 4 / 1 | 1 / 1 |
| BreezyAI | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Burrow | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Casco | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Cato Networks | Adjacent | 0 / 0 | 0 / 1 | 0 / 0 |
| Cato Networks | Core | 0 / 1 | 0 / 1 | 0 / 0 |
| Caviard.ai | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Cequence | Adjacent | 1 / 0 | 1 / 0 | 1 / 1 |
| Cerbos | Adjacent | 0 / 0 | 1 / 0 | 0 / 0 |
| CERTavia | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| CertiGraph | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| Chainstack | Adjacent | 0 / 0 | 1 / 1 | 0 / 0 |
| Check Point | Adjacent | 1 / 2 | 0 / 2 | 0 / 2 |
| Checkmarx | Core | 1 / 1 | 0 / 1 | 0 / 0 |
| Cisco | Adjacent | 1 / 3 | 4 / 2 | 3 / 1 |
| Cleanlab | Adjacent | 1 / 1 | 0 / 1 | 0 / 0 |
| CleverHans | Core | 0 / 0 | 1 / 0 | 0 / 0 |
| CloudEagle | Adjacent | 0 / 0 | 0 / 0 | 2 / 1 |
| Cloudflare | Adjacent | 3 / 4 | 1 / 1 | 2 / 3 |
| Cloudflare | Core | 0 / 1 | 0 / 0 | 3 / 3 |
| Code42 (Incydr) | Adjacent | 0 / 0 | 1 / 1 | 0 / 0 |
| Codenotary | Adjacent | 0 / 0 | 1 / 0 | 1 / 1 |
| Collibra | Adjacent | 0 / 0 | 0 / 1 | 1 / 1 |
| CollieAi | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| ComplyLock | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| Complyze | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Composio | Adjacent | 0 / 0 | 0 / 2 | 2 / 0 |
| ConcealBrowse | Adjacent | 0 / 0 | 1 / 0 | 0 / 0 |
| Concentric AI | Adjacent | 0 / 0 | 0 / 2 | 0 / 1 |
| ConductorOne | Adjacent | 1 / 0 | 1 / 0 | 0 / 0 |
| Containment.AI | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| ContextQA | Core | 0 / 0 | 0 / 1 | 0 / 0 |
| Control Zero | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Counterfit | Core | 1 / 0 | 0 / 0 | 1 / 0 |
| Cranium | Core | 0 / 1 | 1 / 1 | 0 / 0 |
| CrowdStrike | Core | 2 / 2 | 0 / 3 | 2 / 3 |
| Crucible | Core | 1 / 1 | 0 / 0 | 0 / 0 |
| Curity | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| CurrentWare | Adjacent | 0 / 0 | 0 / 0 | 3 / 3 |
| Cyata | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| Cybeats | Adjacent | 0 / 0 | 1 / 0 | 0 / 0 |
| CyberArk (Idira) | Adjacent | 1 / 2 | 2 / 3 | 4 / 3 |
| CyBox | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| Cycore | Adjacent | 0 / 0 | 0 / 1 | 0 / 0 |
| Cygeniq | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Cynsta | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| Darktrace | Adjacent | 0 / 0 | 0 / 0 | 0 / 1 |
| Data Guard (Info Inlet) | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| Datadog | Adjacent | 0 / 0 | 3 / 0 | 0 / 0 |
| DataKrypto | Adjacent | 0 / 0 | 0 / 0 | 0 / 1 |
| Datawiza | Adjacent | 0 / 0 | 2 / 0 | 1 / 1 |
| Daylite | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Deepchecks | Adjacent | 0 / 0 | 0 / 2 | 0 / 0 |
| Deflected.ai | Core | 1 / 1 | 0 / 0 | 0 / 0 |
| Delinea | Adjacent | 2 / 1 | 0 / 0 | 0 / 0 |
| Docker MCP Gateway | Adjacent | 1 / 1 | 0 / 1 | 3 / 3 |
| DoControl | Adjacent | 0 / 0 | 1 / 2 | 0 / 0 |
| Doppler | Adjacent | 0 / 0 | 1 / 0 | 0 / 0 |
| Drata | Adjacent | 0 / 0 | 1 / 1 | 0 / 0 |
| Dreadnode | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Drel | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| DSX Guard | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| Duality / Enveil / Honeypotz | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| Dynatrace | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| EDAMAME Security | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| Elastic | Adjacent | 0 / 0 | 0 / 0 | 2 / 2 |
| EnforceAuth | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| Enforgate | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Enkrypt AI | Core | 0 / 0 | 1 / 0 | 2 / 4 |
| Enoki | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| Envoy AI Gateway | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| EvalGuard | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| EverShade | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Evidently AI | Adjacent | 1 / 1 | 0 / 0 | 0 / 0 |
| Exabeam | Adjacent | 0 / 0 | 0 / 0 | 2 / 2 |
| F5 AI Gateway | Adjacent | 2 / 3 | 1 / 0 | 3 / 2 |
| FERZ | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| Fiddler AI | Adjacent | 1 / 0 | 4 / 3 | 4 / 3 |
| FireTail | Core | 1 / 1 | 1 / 0 | 0 / 0 |
| Fluxforce | Core | 0 / 0 | 0 / 1 | 0 / 0 |
| Foolbox | Core | 0 / 0 | 0 / 1 | 0 / 0 |
| Fortanix | Adjacent | 1 / 1 | 1 / 0 | 1 / 1 |
| FortifAI | Core | 1 / 1 | 0 / 0 | 0 / 0 |
| Fortinet (FortiAIGate) | Adjacent | 0 / 0 | 1 / 3 | 0 / 1 |
| Future AGI (evaluation) | Adjacent | 0 / 0 | 0 / 0 | 1 / 0 |
| Future AGI Guardrails | Core | 0 / 0 | 0 / 1 | 0 / 0 |
| FuzzyAI (CyberArk) | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Galileo | Adjacent | 0 / 0 | 6 / 2 | 1 / 1 |
| GenAI Protect | Core | 0 / 0 | 0 / 1 | 0 / 0 |
| Geordie AI | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Gera Tools | Core | 1 / 1 | 0 / 0 | 0 / 0 |
| Core | 1 / 1 | 1 / 2 | 4 / 4 | |
| Granica | Adjacent | 0 / 0 | 0 / 1 | 0 / 0 |
| Gravitee | Adjacent | 0 / 0 | 1 / 1 | 0 / 0 |
| Gray Swan | Core | 1 / 0 | 0 / 0 | 1 / 1 |
| Grip Security | Adjacent | 0 / 0 | 5 / 2 | 3 / 2 |
| Group-IB | Adjacent | 0 / 0 | 0 / 0 | 2 / 2 |
| GuardEntry | Core | 1 / 1 | 0 / 0 | 0 / 0 |
| Guardrails AI | Core | 1 / 2 | 1 / 2 | 1 / 3 |
| HackerOne | Core | 0 / 1 | 0 / 1 | 1 / 2 |
| Harmonic Security | Core | 4 / 3 | 2 / 5 | 5 / 4 |
| Harmony (AI tool discovery) | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| Harness | Core | 0 / 0 | 1 / 0 | 0 / 0 |
| HashiCorp (Vault, Sentinel) | Adjacent | 3 / 4 | 2 / 0 | 1 / 0 |
| Holistic AI | Adjacent | 2 / 1 | 3 / 1 | 5 / 5 |
| Humanbound | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| Hyperproof | Adjacent | 0 / 0 | 1 / 1 | 0 / 0 |
| IBM ContextForge | Adjacent | 0 / 0 | 0 / 0 | 0 / 1 |
| Identra | Core | 3 / 0 | 0 / 0 | 0 / 0 |
| iDox.ai | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Impart Security | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| Infopercept (Invinsense) | Adjacent | 0 / 0 | 0 / 1 | 0 / 0 |
| InputGuard | Core | 0 / 1 | 0 / 1 | 0 / 0 |
| Intric | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| Island | Adjacent | 1 / 0 | 5 / 3 | 3 / 2 |
| JFrog | Core | 0 / 1 | 0 / 0 | 1 / 1 |
| Jozu | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Katonic AI | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| KERN MCP Security Scanner | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| Keycard | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| Knostic | Core | 0 / 0 | 1 / 1 | 0 / 0 |
| Kong | Adjacent | 2 / 2 | 4 / 1 | 2 / 2 |
| Kosmoy | Adjacent | 1 / 0 | 1 / 1 | 1 / 2 |
| Kovrr | Adjacent | 0 / 0 | 0 / 1 | 1 / 1 |
| Kraken AI | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| Langfuse | Adjacent | 1 / 0 | 1 / 2 | 1 / 1 |
| LangProtect | Core | 0 / 0 | 2 / 0 | 0 / 0 |
| LangSmith (LangChain) | Adjacent | 1 / 0 | 4 / 6 | 1 / 1 |
| LayerX | Core | 3 / 3 | 4 / 5 | 6 / 6 |
| Lelu | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| Levo | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| LILT Safety | Core | 0 / 1 | 0 / 0 | 1 / 1 |
| Linux Foundation AI (IBM ART) | Core | 2 / 2 | 2 / 3 | 0 / 0 |
| LiteLLM | Adjacent | 0 / 0 | 6 / 3 | 2 / 3 |
| LLM Guard (open source) | Core | 2 / 2 | 5 / 6 | 2 / 2 |
| Luminos.AI | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| Lunar.dev | Adjacent | 0 / 0 | 1 / 0 | 1 / 2 |
| Lyzr | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| Mage Data | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| ManageEngine SecureAI | Adjacent | 0 / 0 | 0 / 1 | 0 / 0 |
| MCP Doctor | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| mcp-audit | Core | 1 / 1 | 0 / 0 | 0 / 0 |
| mcp-gate | Core | 1 / 1 | 0 / 0 | 0 / 0 |
| MCPGuard | Core | 0 / 0 | 0 / 0 | 0 / 1 |
| MCPScan.ai | Core | 1 / 1 | 0 / 1 | 0 / 0 |
| MCPShield | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| Meandr | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| MEDUSA (Pantheon Security) | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Mem0 / Cognee / vector stores | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| Mend.io | Core | 0 / 0 | 0 / 0 | 1 / 2 |
| Menlo Security | Adjacent | 0 / 0 | 0 / 1 | 0 / 1 |
| Metadefender Aether (OPSWAT) | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Metomic | Adjacent | 1 / 0 | 0 / 1 | 0 / 0 |
| MIND | Adjacent | 0 / 0 | 1 / 0 | 0 / 0 |
| miniOrange | Adjacent | 0 / 0 | 1 / 0 | 0 / 0 |
| MintMCP | Adjacent | 0 / 0 | 5 / 6 | 2 / 1 |
| Mirror Security | Core | 0 / 0 | 1 / 1 | 0 / 1 |
| Mitiga | Adjacent | 0 / 0 | 0 / 1 | 0 / 0 |
| Mittr | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| MLflow (Databricks) | Adjacent | 0 / 3 | 4 / 3 | 1 / 1 |
| Model Safety Checker | Core | 1 / 1 | 0 / 0 | 0 / 0 |
| ModelOp | Adjacent | 0 / 0 | 0 / 0 | 2 / 1 |
| Modulate | Adjacent | 0 / 0 | 1 / 0 | 0 / 0 |
| Modulos | Adjacent | 0 / 1 | 1 / 0 | 1 / 1 |
| Mondoo | Adjacent | 2 / 2 | 0 / 0 | 1 / 1 |
| MongoDB (Atlas Agent Engine Policy Engine) | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| Montro | Adjacent | 1 / 0 | 0 / 0 | 1 / 1 |
| MoorAI | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| NeonCyber | Adjacent | 0 / 0 | 1 / 0 | 0 / 0 |
| Netwrix | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| New Relic | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| NextLabs | Adjacent | 0 / 0 | 1 / 0 | 0 / 0 |
| NVIDIA (platform) | Adjacent | 3 / 5 | 0 / 1 | 2 / 3 |
| Oasis Security | Adjacent | 1 / 0 | 2 / 1 | 2 / 3 |
| Obot | Adjacent | 0 / 0 | 0 / 1 | 1 / 1 |
| Obsidian Security | Adjacent | 5 / 4 | 2 / 4 | 5 / 4 |
| Offsend | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| OneCompliant | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| OneTrust | Adjacent | 2 / 4 | 3 / 2 | 4 / 5 |
| Open Policy Agent Gatekeeper | Adjacent | 1 / 1 | 0 / 0 | 0 / 0 |
| OpenAgent | Adjacent | 1 / 1 | 0 / 0 | 0 / 0 |
| OpenAI | Core | 1 / 0 | 1 / 0 | 0 / 1 |
| Openlayer | Adjacent | 0 / 1 | 0 / 0 | 3 / 3 |
| OpenLeash | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| OpenRT | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| Operant AI | Core | 0 / 1 | 0 / 2 | 1 / 1 |
| Opper | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| Opsin | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| OpsMx AI-BOM | Adjacent | 1 / 0 | 1 / 0 | 0 / 0 |
| Orca Security | Adjacent | 2 / 3 | 3 / 4 | 5 / 5 |
| Origin (agent activity monitoring) | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| Ory | Adjacent | 1 / 0 | 0 / 0 | 1 / 1 |
| OvalEdge | Adjacent | 0 / 0 | 0 / 0 | 0 / 1 |
| Palma.ai | Adjacent | 0 / 0 | 1 / 0 | 0 / 0 |
| Parsias | Adjacent | 1 / 1 | 0 / 0 | 0 / 0 |
| PasteSecure | Core | 0 / 0 | 0 / 1 | 0 / 0 |
| Patronus AI | Adjacent | 1 / 2 | 1 / 0 | 0 / 0 |
| Penaxtra | Core | 0 / 2 | 0 / 0 | 0 / 0 |
| Permit.io | Adjacent | 1 / 1 | 0 / 0 | 0 / 0 |
| PickleScan / Veritensor / ModelScan family | Core | 1 / 1 | 3 / 2 | 0 / 0 |
| PlayCISO | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| PointGuard AI | Core | 0 / 0 | 0 / 0 | 1 / 2 |
| Portkey | Adjacent | 1 / 1 | 6 / 4 | 0 / 1 |
| Praesidia | Core | 1 / 1 | 0 / 0 | 0 / 0 |
| Praetorian | Core | 0 / 0 | 2 / 2 | 0 / 1 |
| Prediction Guard | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| PrismGuard | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| PrivacyScrubber | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Private AI | Adjacent | 1 / 1 | 2 / 1 | 0 / 0 |
| ProcessUnity | Adjacent | 0 / 0 | 1 / 0 | 0 / 0 |
| Prompt Seal | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| PromptFence | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| PromptHalo | Core | 0 / 0 | 2 / 2 | 0 / 0 |
| PromptMask | Core | 1 / 1 | 0 / 0 | 0 / 0 |
| PromptProtect | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| Protecto | Adjacent | 0 / 0 | 0 / 1 | 1 / 1 |
| Protectt.ai | Core | 0 / 0 | 0 / 0 | 1 / 0 |
| Proximity (MCP scanner) | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Purser | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| Push Security | Adjacent | 1 / 0 | 1 / 2 | 1 / 1 |
| Qualys | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| QuilrAI | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| Realm Labs (RealmGuard) | Core | 0 / 0 | 1 / 1 | 0 / 0 |
| Rebuff | Core | 0 / 0 | 4 / 1 | 0 / 0 |
| RedactGate | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Redactifi | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Redactprompt | Core | 0 / 1 | 1 / 1 | 0 / 0 |
| Rein Security | Core | 0 / 0 | 0 / 1 | 0 / 0 |
| Relyance AI | Core | 0 / 0 | 2 / 3 | 0 / 0 |
| Repello AI | Core | 1 / 1 | 1 / 1 | 1 / 1 |
| Requesty | Adjacent | 0 / 0 | 1 / 0 | 0 / 0 |
| Respan | Adjacent | 0 / 0 | 1 / 1 | 1 / 0 |
| ReversingLabs | Core | 0 / 0 | 0 / 2 | 0 / 0 |
| Roder AI | Adjacent | 2 / 0 | 0 / 0 | 0 / 0 |
| Rogue Security | Core | 1 / 1 | 0 / 0 | 0 / 0 |
| Rubrik Agent Cloud | Adjacent | 0 / 0 | 0 / 0 | 2 / 2 |
| Runfile | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| Runlayer | Core | 1 / 1 | 1 / 0 | 1 / 1 |
| Runplane | Core | 1 / 1 | 0 / 0 | 0 / 0 |
| Safeguard AI | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| SafePrompt | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Safetica | Adjacent | 0 / 0 | 1 / 0 | 1 / 1 |
| Saidot | Adjacent | 0 / 0 | 1 / 0 | 1 / 1 |
| Salesforce | Adjacent | 6 / 3 | 0 / 1 | 2 / 1 |
| SamaLogic | Core | 0 / 0 | 0 / 0 | 1 / 0 |
| Sanitized Ai | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| SAPL | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| Saviynt | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| Scrut Automation | Adjacent | 0 / 0 | 0 / 1 | 0 / 0 |
| SecML | Core | 0 / 0 | 0 / 1 | 0 / 0 |
| Secorvia | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| Securden AI Agent Governance | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Securiti | Adjacent | 0 / 0 | 3 / 2 | 2 / 3 |
| Securiti | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| SentiGuard | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Sentinel MCP | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| SentinelOne | Adjacent | 0 / 1 | 1 / 2 | 0 / 0 |
| Sentra | Adjacent | 0 / 0 | 0 / 0 | 0 / 1 |
| SentraSuite | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| SentriqAI | Core | 1 / 1 | 0 / 0 | 0 / 0 |
| Shadow Span | Adjacent | 1 / 1 | 0 / 0 | 0 / 0 |
| ShadowIQ | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| ShadowLock | Core | 0 / 0 | 1 / 0 | 0 / 0 |
| Silverfort | Core | 0 / 0 | 0 / 1 | 0 / 0 |
| Singulr AI | Core | 1 / 0 | 0 / 0 | 1 / 1 |
| SkillTotal | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Skyhigh Security | Adjacent | 0 / 0 | 0 / 1 | 1 / 0 |
| Skyld | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Snyk | Core | 3 / 2 | 3 / 1 | 3 / 3 |
| Sonny Labs | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Sonrai Security | Adjacent | 0 / 0 | 1 / 1 | 1 / 1 |
| Sovara | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| Speakeasy | Adjacent | 1 / 1 | 2 / 1 | 1 / 1 |
| SpiderRating RuntimeGuard | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Spin.AI | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| Splunk | Adjacent | 3 / 2 | 2 / 0 | 1 / 1 |
| StackOne | Adjacent | 0 / 0 | 0 / 0 | 1 / 0 |
| Stihia | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| Strac | Adjacent | 0 / 0 | 6 / 5 | 2 / 3 |
| Straiker | Core | 2 / 1 | 0 / 3 | 4 / 4 |
| Styra / Open Policy Agent | Adjacent | 2 / 1 | 1 / 2 | 1 / 1 |
| supply-chain-guard | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Sweet Security | Core | 0 / 0 | 2 / 0 | 1 / 1 |
| Sybilla Technologies | Adjacent | 0 / 0 | 1 / 0 | 0 / 0 |
| Synack | Core | 0 / 0 | 1 / 1 | 3 / 3 |
| TameFlare | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| TaoQ AI | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| TapPass | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| TeamPrompt | Core | 0 / 0 | 1 / 0 | 0 / 0 |
| Teleport | Adjacent | 0 / 0 | 1 / 0 | 1 / 0 |
| Tenable | Adjacent | 1 / 1 | 1 / 0 | 2 / 3 |
| Teramind | Adjacent | 0 / 0 | 0 / 1 | 1 / 2 |
| Terminal 3 | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| TextAttack | Core | 0 / 0 | 0 / 0 | 1 / 0 |
| Thales | Adjacent | 0 / 0 | 0 / 1 | 1 / 1 |
| Threatstealth | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| Tigera Lynx | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| ToolHive (Stacklok) | Adjacent | 0 / 0 | 0 / 2 | 0 / 0 |
| Torii / Zluri / Stitchflow / Auvik / BetterCloud | Adjacent | 1 / 0 | 4 / 2 | 1 / 1 |
| Tracehold | Core | 1 / 0 | 0 / 0 | 1 / 1 |
| Traceloop | Adjacent | 0 / 0 | 0 / 0 | 1 / 0 |
| Traefik Hub MCP Gateway | Adjacent | 0 / 0 | 1 / 1 | 0 / 0 |
| trail (AI governance, Germany) | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| Trampolyne AI | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Transcend | Adjacent | 0 / 0 | 0 / 1 | 0 / 0 |
| TrojAI | Core | 0 / 1 | 1 / 1 | 2 / 3 |
| TrueFoundry | Adjacent | 0 / 0 | 4 / 5 | 5 / 5 |
| Trusera AI-BOM | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| Trust3 AI | Adjacent | 2 / 1 | 0 / 0 | 0 / 0 |
| Trustible | Adjacent | 0 / 0 | 1 / 2 | 0 / 0 |
| Trustlogix | Adjacent | 0 / 0 | 0 / 1 | 0 / 0 |
| Tumeryk | Core | 0 / 0 | 2 / 0 | 0 / 0 |
| Tyk | Adjacent | 0 / 0 | 0 / 1 | 0 / 0 |
| Unbound AI | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Uptycs / Kosmic Eye | Adjacent | 0 / 0 | 0 / 1 | 0 / 0 |
| Upwind | Adjacent | 0 / 0 | 0 / 1 | 0 / 0 |
| VAHTOR | Adjacent | 1 / 1 | 0 / 0 | 0 / 0 |
| Valence Security | Adjacent | 0 / 0 | 4 / 4 | 0 / 0 |
| Vanta | Adjacent | 0 / 0 | 2 / 0 | 1 / 1 |
| Varonis | Adjacent | 1 / 1 | 1 / 2 | 2 / 2 |
| VDF AI | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| Vectra AI | Adjacent | 0 / 0 | 1 / 0 | 0 / 0 |
| Vendorica | Adjacent | 0 / 0 | 1 / 0 | 0 / 0 |
| Venturalitica | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| VerifyWise | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| Verity AI | Core | 0 / 0 | 1 / 0 | 0 / 0 |
| Vero | Core | 1 / 1 | 0 / 0 | 0 / 0 |
| Vertias AI | Adjacent | 1 / 0 | 0 / 0 | 0 / 0 |
| Veza | Adjacent | 0 / 0 | 0 / 0 | 1 / 1 |
| Vigil LLM | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Visera | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Vorlon | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| Vynox Security | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Wald.ai | Core | 0 / 0 | 0 / 0 | 1 / 1 |
| Wallarm | Core | 0 / 1 | 1 / 0 | 0 / 0 |
| WalledAI | Core | 0 / 0 | 1 / 1 | 0 / 0 |
| Waxell | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| Webrix / Willow | Adjacent | 1 / 0 | 0 / 0 | 1 / 1 |
| Weights & Biases | Adjacent | 0 / 0 | 1 / 1 | 0 / 0 |
| Wingback Security | Adjacent | 2 / 0 | 0 / 1 | 0 / 0 |
| WorkOS | Adjacent | 0 / 0 | 0 / 1 | 0 / 0 |
| XeroML | Adjacent | 0 / 1 | 0 / 0 | 0 / 0 |
| Zactonics | Core | 1 / 0 | 0 / 0 | 0 / 0 |
| Zafin | Core | 0 / 0 | 1 / 0 | 0 / 0 |
| ZeroLeaks | Core | 0 / 1 | 0 / 0 | 0 / 0 |
| ZioSec | Core | 0 / 0 | 0 / 1 | 0 / 0 |
FAQ
Where does my company rank?
Find it in Table 1 or Table 2 and use the row link to share its position. Then check the buyer-type and engine views, because a vendor's position often differs from one buyer type or engine to the next.
Why is my company missing?
It was named in fewer than 7 of the 112 questions in every engine run, or it was never named. Every vendor named at least once is in the appendix and the CSV with its exact figures.
How can a smaller vendor rank ahead of a larger one?
Because this measures how often AI engines name a vendor, not market share or deployments. A widely deployed product can be named rarely, and a smaller one can be named often. Both are accurate descriptions of what the engines said on the collection date.
Why do Lakera, Protect AI, Robust Intelligence and Prompt Security not have their own rows?
Each was owned by another company on the collection date, so its mentions count under the owner, with the label shown in the table. Where one answer named both the product and its owner, it counts once.
Why are buyer-type scores higher than overall scores?
A buyer-type score is out of 84 answers (14 questions, six engine runs), and those questions are written for that buyer, so the relevant vendors appear more often. Compare buyer-type scores with each other and overall scores with each other, but not across the two.
Why are platforms like Microsoft in both tables?
Because the engines named them in both roles. Microsoft's AI security tooling counts as core and its broader cloud, identity and data products count as adjacent. Each table counts the company once per answer.
Data and Citation
Download the vendor data (CSV) and the 112 questions (CSV). Both are free to reuse under CC BY 4.0 with credit to Ranking Atlas. Suggested citation: Ranking Atlas, AI Agent Security Vendor Visibility Index, October 2026 edition. Corrections and methodology questions: contact@ranking-atlas.com.
Research updates
Get New Ranking Atlas Research by Email.
One email when a new study, Index edition or working paper goes live.
By subscribing you agree we may email you updates about new Ranking Atlas research. Unsubscribe any time.
Thanks, you are on the list.
That did not go through. Please try again.