Category
AI red teaming vendors and services
Red teaming for AI stress-tests models with adversarial prompts, prompt injections, jailbreaks, data exfiltration probes, and safety-policy circumvention. It is required or heavily encouraged by the EU AI Act (Article 15, robustness and cybersecurity), NIST AI RMF (Measure 2, adversarial testing), ISO/IEC 42001 (clause 8.3, AI system risk treatment), and the OWASP LLM Top 10.
Directory
10 AI red-teaming vendors
| Vendor | HQ | Founded | Size | Pricing | Last verified |
|---|---|---|---|---|---|
| HiddenLayer | Austin, United States | 2022 | 51-200 | Enterprise-only, contact sales for pricing. No public pricing listed on website. | Apr 22, 2026 |
| Protect AI | Seattle, United States | 2022 | 51-200 | Now integrated into Palo Alto Networks Prisma AIRS. Original standalone Protect AI pricing was enterprise-only, contact sales. Current pricing through Palo Alto Networks. | Apr 22, 2026 |
| Lakera | Zurich, Switzerland | 2021 | 51-200 | Enterprise-focused SaaS. No public pricing listed. API-based pricing model expected. Contact sales. | Apr 22, 2026 |
| Robust Intelligence | San Francisco, United States | 2019 | 11-50 | Now integrated into Cisco AI Defense / Cisco Security Cloud. Standalone Robust Intelligence is no longer sold independently. Pricing through Cisco. | Apr 22, 2026 |
| CalypsoAI | Dublin, Ireland | 2018 | 51-200 | Enterprise licensing; contact sales for quote, depending on deployment (SaaS/on-prem/hybrid) and plan. | Apr 26, 2026 |
| TrojAI | Saint John, Canada | 2019 | 11-50 | Enterprise-only, no public pricing. Contact sales at troj.ai. | Apr 22, 2026 |
| Pillar Security | Tel Aviv, Israel | 2023 | 11-50 | Enterprise pricing only. Not publicly listed. | Apr 27, 2026 |
| Cranium | Short Hills, United States | 2023 | 51-200 | Contact for pricing | Apr 27, 2026 |
| Lasso Security | Tel Aviv, Israel | 2023 | 11-50 | Enterprise pricing only. Not publicly listed. | Apr 27, 2026 |
| Luminos.Law (ZwillGen AI Division) | Washington, DC, United States | 2019 | 51-200 | Contact for pricing | Apr 24, 2026 |
Buying criteria
What actually matters when picking a red team
- Attack coverage. Does the vendor publish which OWASP LLM Top 10 categories (LLM01 prompt injection through LLM10 model theft) and MITRE ATLAS techniques they exercise? Ask for a public test-suite index, not marketing copy.
- Manual vs automated. Continuous automated red teaming catches drift; expert human red teams find creative bypass chains. Enterprise-grade programs run both. Confirm what percentage of test cases are human-authored.
- Model coverage. Frontier LLMs (GPT-4o, Claude, Gemini, Llama), open weights, RAG pipelines, tool-using agents, image and multimodal, embedded classifiers. If you deploy agents, insist on tool-use adversarial testing.
- Deliverable format. A signed report that maps findings to EU AI Act Article 15, NIST AI RMF Measure 2, and ISO/IEC 42001 clause 8.3 is worth more than raw findings.
- Retest and remediation. One-shot audits are theatre. Confirm scoping for post-fix retesting and a rate card for follow-up rounds.
- Data handling. Your prompts and outputs contain PII, IP, and safety-relevant data. Confirm SOC 2, ISO 27001, data-residency, and whether test payloads are used to train the vendor's own models. Get this in the MSA.
- Independence. For high-risk EU AI Act systems, keep red teaming outside the same provider selling the model or governance platform to avoid conflicts of interest.
Framework mapping
Where red teaming shows up in regulation
| Framework | Requirement |
|---|---|
| EU AI Act | Article 15 mandates appropriate accuracy, robustness, and cybersecurity for high-risk systems. Recital 76 explicitly references adversarial testing. GPAI models with systemic risk face Article 55 obligations including adversarial testing. |
| NIST AI RMF | Measure 2 (2.7 red-team exercises, 2.8 adversarial resilience). NIST AI 600-1 (GAI Profile) explicitly calls for red-team testing across CBRN, cyber, and misuse risks. |
| ISO/IEC 42001 | Clause 8.3 (AI system risk treatment) and Annex A control A.6.2.4 (AI system testing) require documented adversarial testing as part of the AIMS. |
| OWASP LLM Top 10 | Direct threat taxonomy — LLM01 prompt injection, LLM02 insecure output handling, LLM07 system-prompt leakage, LLM08 excessive agency. Most red-team reports index findings to this list. |
| US Executive Order 14110 (rescinded) | Original dual-use foundation model reporting rule was rescinded in January 2025, but the red-teaming reporting cadence it established remains a de-facto industry norm for frontier labs. |
Next steps
Related buying resources
Sources. OWASP LLM Top 10 (2025) · MITRE ATLAS · NIST AI 600-1 GAI Profile · EU AI Act Article 15. Editorial coverage — no paid placement on this page. Contact us to correct any inaccuracy.
Free vendor matchmaking
Ready to run AI red teaming?
Get matched with vendors that run adversarial testing, jailbreak evaluation, and prompt-injection assessments for EU AI Act Article 15, NIST AI RMF Measure 2, and ISO/IEC 42001 clause 8.3.
No credit card. Independent directory — we do not sell software ourselves.