AgentShield vs Lakera - Agent Control Plane vs Guardrails
Both AgentShield and Lakera protect AI applications, but they sit at different scopes. Lakera focuses on LLM input and output guardrails, especially prompt-injection detection. AgentShield is a runtime control plane for agents that take actions, unifying a firewall with tool and data permissions, monitoring, human approval, and an immutable audit trail. Here is an honest side by side.
| Capability | AgentShield | Lakera |
|---|---|---|
| Prompt-injection firewall | Core strength | |
| Tool and data permissions | × Not the focus | |
| Real-time action monitoring | Partial Around guardrails | |
| Human-approval gates | × | |
| Immutable audit trail | Partial Decision logs | |
| Stack-neutral control plane | Partial SDK/API guardrails | |
| Transparent self-serve pricing | Partial Mixed |
The verdict
Choose Lakera if you primarily need strong LLM input and output guardrails. Choose AgentShield if your agents call tools and take actions and you want firewall, least-privilege permissions, monitoring, human approval, and an audit trail in one self-serve control plane.
This comparison is meant to be fair and reflects publicly available information. Both products evolve; verify the latest before deciding.
What you are actually buying now that Lakera is Check Point
Check Point announced the acquisition of Lakera on September 16, 2025 and said the transaction was expected to close in the fourth quarter of 2025, subject to customary closing conditions. The press release did not disclose a price, and the figures reported afterward do not agree with each other, so we do not print one. What the release did name is where the technology went: Lakera anchors what Check Point calls its Global Center of Excellence for AI Security, and the products built from it were announced as Check Point AI Red Teaming and Check Point AI Agent Security.
A year later the Lakera brand is still live. Its site still lists AI Agent Security, AI Red Teaming and Workforce AI Security under the Lakera name, with a Check Point copyright in the footer. So this is not a case where a product you shortlisted quietly disappeared. It is the more common case, where the product survives and the roadmap starts answering to a platform. That second part is what belongs in your evaluation, not the logo.
Lakera earned its reputation honestly. Gandalf taught a generation of builders what prompt injection feels like from the attacker side, and its runtime guardrails against prompt attacks and data leakage are strong work. We overlap there with our own prompt injection firewall, and we are not going to claim we inspect text better than the team that wrote Gandalf.
Where the overlap stops
Both products sit in the request path and both will reject a crafted prompt. The overlap really is the firewall. The divergence is everything that happens after the text passes inspection, because a clean-looking request can still ask an agent to do something it was never scoped to do.
| What you are trying to prevent | Lakera and Check Point | AgentShield |
|---|---|---|
| A crafted prompt steering the model | Core strength | Core strength |
| Sensitive data surfacing in a response | Core strength | Covered |
| An agent calling a tool it was never scoped for | Coarse platform policy | Core strength, per-agent permissions |
| An irreversible action running with nobody watching | Not a stated surface | Built in, with resumable state |
| Reconstructing months later why an action was allowed | Guardrail decision logs | Immutable attributed action trail |
| Deploying it without adopting a security platform | Increasingly no | Yes, self-serve |
A quick way to test which side of that table you are on: if your agent produces text, a guardrail is the right shape of control and buying an action-control plane means paying for a layer you will not use. If your agent produces consequences, you need something that can say no to a specific call, and that is a different control even when it runs in the same request. We set out the distinction at length on AI agent guardrails, and the enforcement side of it on per-agent tool permissions.
Cases where we would tell you to buy Check Point
We would rather you buy the right thing than buy from us, because a bad fit turns into a refund and a bad review. Three of the five situations below favor them, which is about what we would expect from an honest read of a much larger vendor.
| Situation | Better fit | Why |
|---|---|---|
| You already run Check Point Infinity | Check Point and Lakera | AI controls arrive inside a deployment you operate, under a contract you already signed. No feature comparison outweighs skipping a vendor onboarding |
| Your risk is a chat or RAG application rather than a tool-calling agent | Lakera | Guardrails on model inputs and outputs are the correct control when the model produces text. The action layer would sit unused |
| Pre-deployment adversarial testing matters more to you than runtime enforcement | Lakera red teaming | Testing before release is a different discipline from blocking in production. We cover the distinction on AI penetration testing rather than pretending to compete |
| Your agents call tools, move money or change records | AgentShield | The exposure is what executes after the text passes, which needs permission scopes and human approval gates at the action boundary |
| You run several frameworks and need one audit record across all of them | AgentShield | An independent control point produces one trail across Claude, OpenAI, LangChain and custom agents instead of logs shaped around one platform |
If you want the wider picture before shortlisting anyone, most of the independent vendors in this market have been acquired in the last two years, and we keep that list current in AI agent security companies. The longer form of this comparison, including what changed commercially after the deal, is on Lakera alternatives.
FAQ
Common questions about this comparison.
What is the difference between AgentShield and Lakera?
Scope. Lakera inspects text: model inputs and outputs, prompt injection, data leakage and content violations, and it does that very well. AgentShield governs what the agent does once the text passes, with per-agent tool and data permissions, human approval gates on irreversible actions, and an immutable audit trail. The two overlap on the injection firewall and diverge completely at the action boundary.
Did Check Point acquire Lakera?
Yes. Check Point announced the acquisition on September 16, 2025 and said it expected to close in the fourth quarter of 2025. The press release did not disclose a price and reported figures since then have not agreed, so treat any single number with caution. Lakera anchors Check Point Global Center of Excellence for AI Security, and the announced products were Check Point AI Red Teaming and Check Point AI Agent Security.
Is Lakera still available as a separate product?
Yes, at the time of writing. The Lakera brand and site are still live, listing AI Agent Security, AI Red Teaming and Workforce AI Security, with a Check Point copyright in the footer. The practical change for buyers is commercial rather than technical: expect evaluation and packaging to run through Check Point, and expect roadmap priorities to follow the platform.
Can Lakera stop an AI agent from calling a tool?
Not in the per-agent, least-privilege sense. Lakera decides whether text entering or leaving a model is safe. Deciding whether this specific agent is permitted to call this specific tool with these arguments is a different control, enforced on the action path rather than the text path. That is the gap AgentShield is built to close.