F5 AI Guardrails vs Protect AI

F5 AI Guardrails is F5's runtime security product for AI models, applications and agents. F5 sells it alongside F5 AI Red Team, its automated adversarial testing product, and presents the two as a pair: findings from Red Team can be turned into guardrail policies. Both come from CalypsoAI, the AI security company F5 announced it would acquire on September 11, 2025 for $180 million in purchase consideration, mostly cash. The deal closed on September 26, 2025. F5 introduced both products when it announced the deal had closed, and made them generally available in January 2026 as part of its Application Delivery and Security Platform. F5, Inc. was incorporated in 1996 and is based in Seattle; this profile lists the company's founding year and headquarters, as the directory does for other big-company products. F5 AI Guardrails blocks prompt injection and jailbreaks, detects and prevents leakage of personal data and custom data categories, filters toxic or harmful output, and audits or blocks unauthorized tool calls and actions by agents. Policies can be written in natural language. Every enforcement action is logged with attribution, and logs can be exported to third-party SIEMs. It works with any model and runs in AWS, Azure or Google Cloud, in private clouds, or on premises, including fully air-gapped environments. F5 AI Red Team sends a swarm of attacker agents to run static, prompt-based and multi-turn attacks, including indirect prompt injection and data-leakage tests on RAG applications. F5 says its attack library grows by more than 10,000 patterns a month. Red Team runs in the major public clouds or on premises as a certified Red Hat OpenShift operator. A feature called F5 AI Remediate drafts guardrails from Red Team findings, and a person approves each one before it goes live. **Gateway and platform** On June 22, 2026 F5 launched the F5 AI Security Platform, which groups AI governance, AI discovery, testing with AI Red Team and runtime protection with AI Guardrails, plus an audit trail across AI interactions. At the same time it announced the acquisition of SurePath AI, which adds network-based discovery of AI use, including shadow AI. F5's AI Gateway now combines a model gateway, an MCP gateway (with an MCP server registry and per-tool allow and deny controls) and AI Guardrails under one control plane. **Compliance coverage** F5 says Guardrails has automated auditing templates for GDPR, HIPAA and the EU AI Act, out-of-the-box policy controls aligned to PCI, PHI and the EU AI Act's prohibited-risk categories, and audit-ready logs. It also says Red Team findings can support compliance programs aligned with the NIST AI RMF and the EU AI Act, and it publishes an infographic aligning its products with the OWASP Top 10 for LLMs. We found no article-by-article mapping to the EU AI Act. **Who it's for** Large enterprises, including regulated financial services and healthcare organizations, that need AI guardrails they can host themselves or run air-gapped. F5 says both products are deployed at Fortune 500 companies. It also suits F5 customers who want AI controls on the same platform as their application delivery and API security.

Protect AI was a Seattle AI security company founded in 2022 by Ian Swanson (CEO), Daryan Dehghanpisheh and Badar Ahmed, who had previously worked at AWS, Oracle and DataScience.com. It raised $108.5 million: a $13.5 million seed round co-led by Acrew Capital and Boldstart Ventures (December 2022), a $35 million Series A led by Evolution Equity Partners (July 2023) and a $60 million Series B led by Evolution Equity Partners (August 2024), with Salesforce Ventures and Samsung among the investors. GeekWire reported 75 employees and offices in Seattle, Berlin and Bangalore in August 2024. Protect AI bought huntr, Rebuff, Laiyer AI and SydeLabs. Palo Alto Networks announced its intent to acquire Protect AI on April 28, 2025, the same day it launched Prisma AIRS, and completed the deal on July 22, 2025. It did not disclose the price; SiliconANGLE cited GeekWire sources putting it above $500 million. Ian Swanson joined Palo Alto as VP, Product, Prisma AIRS, and Prisma AIRS 2.0 (October 28, 2025) "completes the native integration" of Protect AI. Protect AI is no longer sold separately: protectai.com now redirects to the Prisma AIRS page, although some old blog posts are still online. Buyers should evaluate Prisma AIRS. **What it sold** Protect AI sold AI security, not governance. Guardian, built on its open-source ModelScan tool, scanned machine learning models for unsafe or malicious code and enforced policies on which models could be used. In October 2024 Hugging Face added the Guardian scanner to its Hub, and by April 2025 Protect AI had scanned 4.47 million model versions there. Recon tested AI applications before deployment with a library of 450 simulated attacks, and Layer filtered malicious prompts in production. Its earlier AI Radar product built a machine learning bill of materials. The huntr community, with more than 15,000 members in August 2024, reported AI and ML vulnerabilities. Palo Alto says the deal brought model scanning, posture management, AI red teaming, runtime protection and AI agent security to Prisma AIRS, but it doesn't map each Protect AI product to a Prisma AIRS module. **Open source** LLM Guard, Protect AI's open-source library for scanning prompts and responses, is archived: its README says the project and its Hugging Face models are no longer developed or maintained. **Frameworks** The Protect AI pages still online don't document a mapping to an AI framework, so this profile lists none. Prisma AIRS maps its AI Red Teaming attacks to the OWASP Top 10 for LLMs, MITRE ATLAS and NIST.