Leaderboard · updated 17 September 2026
Tools are ranked inside their own form factor and never against another, so there are 4 tables and no combined order. The top scores are 79 for an SDK, 72 for a proxy, 44 for an edge firewall, and 58 for a managed cloud gateway, as of September 2026. The board covers 15 guardrails over 23 documented features. Of the 345 cells, 132 are documented, 69 are unclear and 114 are not documented, and every one links the page it was checked against. A mark is what a vendor documents, not what a product does. Detection accuracy is out of scope, because no independent machine-readable benchmark exists for this category. Last change 17 September 2026.
Guardrails and defences, ranked on what their own documentation says. One table a form factor, and never one ranking across them. The controls above the table choose the table, the view and what the score is made of.
We went through each tool’s own documentation, feature by feature, on 16 September 2026, and recorded what we found against every column on the table. Each link, star count and corporate fact was then checked again against the live source on 17 September 2026.
15 tools · 345 cells · last verified 17 September 2026
A tick is a page in the vendor’s own documentation that shows the feature. A cross is a page that does not. A question mark is a feature the documentation leaves unclear. Only a tick counts, and only 14 of the 23 columns reach the score: operational and compliance are there to read, not to do arithmetic. Open any mark to see the page it was checked against. The jailbreak column answers two of the audit's questions at once: a tool that documents either kind documents it.
Every figure was checked against its source on 17 September 2026. Move a weight and the order moves with it.
Every feature of every tool, with the page each mark was checked against.
5 tools · ranked only against each other
Runs inside the application process. Documentation read 16 September 2026; every link, star count and corporate fact re-checked 17 September 2026. A rank here is a rank within this form factor and nothing wider.
| Attack coverage8 scored | Integration6 scored | Operationalnot scored | Verification and compliancenot scored | |||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Rank | Tool | Score | Evidence | Direct injection | Indirect injection | Jailbreak | PII | Secrets | DoS / token flooding | Tool-call inspection | Output moderation | Schema validation | Policy language | LiteLLM hook | OpenAI-compatible proxy | Self-host | Streaming | Latency published | Pricing | License | SOC 2 Type II | ISO 27001 | ISO 42001 | FedRAMP | Third-party audit | Benchmark methodology |
| 1 | NeMo GuardrailsNVIDIA★ 7,151 | 79 of 100 | Vendor-reportedattack coverage 88%, integration 67% | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ | ? | ✓ | ✗ | ✓ | ✓ | ✓ | ✓ | Free | Apache | ✗ | ✗ | ✗ | ✗ | ? | ? |
| 2 | Guardrails AIGuardrails AI★ 7,424 | 78 of 100 | Vendor-reportedattack coverage 63%, integration 100% | ✓ | ? | ✓ | ✓ | ✓ | ✗ | ? | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ? | Free+Pro | Apache | ✗ | ✗ | ✗ | ✗ | ✗ | ? |
| 3 | LLM GuardProtect AI (Palo Alto Networks, acquisition completed 22 Jul 2025)★ 3,207archived, archived read-only 9 Jul 2026 | 72 of 100 | Vendor-reportedattack coverage 75%, integration 67% | ✓ | ✓ | ? | ✓ | ✓ | ✓ | ? | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ✓ | ✓ | Free | MIT | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| 4 | Llama Guard and Prompt GuardMeta★ 4,398 | 50 of 100 | Public methodologyattack coverage 50%, integration 50% | ✓ | ✓ | ✓ | ? | ✗ | ✗ | ✗ | ✓ | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | ✗ | Free | Llama | ✗ | ✗ | ✗ | ✗ | ? | ✓ |
| 5 | ProtectFuture AGI | 36 of 100 | Vendor-reportedattack coverage 38%, integration 33% | ✓ | ? | ? | ✓ | ? | ✗ | ✗ | ✓ | ✗ | ✗ | ? | ✓ | ✗ | ✓ | ? | Usage | Mixed | ✗ | ✗ | ✗ | ✗ | ✗ | ? |
✓ documented? unclear✗ not documented✓ documented, but the only link recorded is the vendor’s documentation home rather than the page that shows itEvery mark opens the page it was checked against.
The table above is what came out of reading each vendor’s own documentation and comparing the features they state. These are the other names in this form factor, taken from vendor integration catalogues, so the placement here is a first guess from a product description rather than one we have checked. Coverage is uneven because the market is uneven, not because a category was filled to a quota. Plenty of candidates; eight or more is reachable.
Microsoft Presidio, NVIDIA GLiNER-PII, Patronus Lynx, Cleanlab, AutoAlign, Rebuff.
5 tools · ranked only against each other
Called over the network, sits between app and model. Documentation read 16 September 2026; every link, star count and corporate fact re-checked 17 September 2026. A rank here is a rank within this form factor and nothing wider.
| Attack coverage8 scored | Integration6 scored | Operationalnot scored | Verification and compliancenot scored | |||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Rank | Tool | Score | Evidence | Direct injection | Indirect injection | Jailbreak | PII | Secrets | DoS / token flooding | Tool-call inspection | Output moderation | Schema validation | Policy language | LiteLLM hook | OpenAI-compatible proxy | Self-host | Streaming | Latency published | Pricing | License | SOC 2 Type II | ISO 27001 | ISO 42001 | FedRAMP | Third-party audit | Benchmark methodology |
| 1 | LiteLLM built-in guardrailsBerriAI★ 58,947 | 72 of 100 | Vendor-reportedattack coverage 75%, integration 67% | ✓ | ? | ? | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ | ✓ | ✓ | ? | ✗ | Free+Ent | MIT* | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| 2 | AI Guardrails (formerly Lakera Guard)Check Point (Lakera acquisition announced 16 Sep 2025) | 72 of 100 | Vendor-reportedattack coverage 75%, integration 67% | ✓ | ✓ | ✓ | ✓ | ? | ✗ | ✓ | ✓ | ✗ | ✓ | ✓ | ✗ | ✓ | ✓ | ✓ | Tiered | — | ? | ? | ✗ | ✗ | ✗ | ? |
| 3 | AI DefenseCisco (Robust Intelligence, acquired October 2024) | 66 of 100 | Vendor-reportedattack coverage 88%, integration 33% | ✓ | ✓ | ✓ | ✓ | ? | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ? | ? | Sub | — | ? | ? | ? | ? | ✗ | ? |
| 4 | Prisma AIRSPalo Alto Networks | 57 of 100 | Vendor-reportedattack coverage 63%, integration 50% | ✓ | ? | ? | ✓ | ? | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ | ✗ | ✓ | ? | ? | Sub | — | ? | ? | ? | ? | ✗ | ✗ |
| 5 | Prompt SecuritySentinelOne (Prompt Security; acquisition announced 5 Aug 2025, completed September 2025) | 52 of 100 | Vendor-reportedattack coverage 75%, integration 17% | ✓ | ? | ✓ | ✓ | ? | ✓ | ✓ | ✓ | ✗ | ? | ? | ✗ | ✓ | ? | ? | Quote | — | ? | ? | ✗ | ✗ | ✗ | ✗ |
✓ documented? unclear✗ not documented✓ documented, but the only link recorded is the vendor’s documentation home rather than the page that shows itEvery mark opens the page it was checked against.
The table above is what came out of reading each vendor’s own documentation and comparing the features they state. These are the other names in this form factor, taken from vendor integration catalogues, so the placement here is a first guess from a product description rather than one we have checked. Coverage is uneven because the market is uneven, not because a category was filled to a quota. The deepest category by far; eight or more is easy.
Aporia, HiddenLayer AIDR, Arthur Shield, Galileo Protect, Portkey, Pangea AI Guard, Enkrypt AI, DynamoAI, Lasso, Noma, CrowdStrike AIDR, Trend Micro, ActiveFence, Clavata, Fiddler, PolicyAI, Polygraf, Private AI, Zenity.
2 tools · ranked only against each other
Runs at the CDN or ingress, in front of the app. Documentation read 16 September 2026; every link, star count and corporate fact re-checked 17 September 2026. A rank here is a rank within this form factor and nothing wider.
| Attack coverage8 scored | Integration6 scored | Operationalnot scored | Verification and compliancenot scored | |||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Rank | Tool | Score | Evidence | Direct injection | Indirect injection | Jailbreak | PII | Secrets | DoS / token flooding | Tool-call inspection | Output moderation | Schema validation | Policy language | LiteLLM hook | OpenAI-compatible proxy | Self-host | Streaming | Latency published | Pricing | License | SOC 2 Type II | ISO 27001 | ISO 42001 | FedRAMP | Third-party audit | Benchmark methodology |
| 1 | Firewall for AIAkamai | 44 of 100 | Vendor-reportedattack coverage 63%, integration 17% | ✓ | ? | ✓ | ✓ | ? | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ | ✗ | ? | ? | ✗ | Quote | — | ? | ? | ✗ | ? | ✗ | ✗ |
| 2 | Firewall for AI (AI Security for Apps)Cloudflare | 29 of 100 | Vendor-reportedattack coverage 38%, integration 17% | ✓ | ✗ | ✗ | ✓ | ? | ✓ | ✗ | ? | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | Plan | — | ? | ? | ✗ | ? | ✗ | ✗ |
✓ documented? unclear✗ not documented✓ documented, but the only link recorded is the vendor’s documentation home rather than the page that shows itEvery mark opens the page it was checked against.
The table above is what came out of reading each vendor’s own documentation and comparing the features they state. These are the other names in this form factor, taken from vendor integration catalogues, so the placement here is a first guess from a product description rather than one we have checked. Coverage is uneven because the market is uneven, not because a category was filled to a quota. Realistically caps around four. Injection detection at CDN ingress requires being a CDN, so eight is not reachable without admitting tools that are not edge products.
F5 AI Guardrails, Zscaler.
3 tools · ranked only against each other
Hyperscaler-native, tied to a model platform. Documentation read 16 September 2026; every link, star count and corporate fact re-checked 17 September 2026. A rank here is a rank within this form factor and nothing wider.
| Attack coverage8 scored | Integration6 scored | Operationalnot scored | Verification and compliancenot scored | |||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Rank | Tool | Score | Evidence | Direct injection | Indirect injection | Jailbreak | PII | Secrets | DoS / token flooding | Tool-call inspection | Output moderation | Schema validation | Policy language | LiteLLM hook | OpenAI-compatible proxy | Self-host | Streaming | Latency published | Pricing | License | SOC 2 Type II | ISO 27001 | ISO 42001 | FedRAMP | Third-party audit | Benchmark methodology |
| 1 | Model ArmorGoogle Cloud | 58 of 100 | Vendor-reportedattack coverage 75%, integration 33% | ✓ | ✓ | ✓ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✓ | ✓ | ✗ | ✗ | ? | ✗ | Free+ | — | ✓ | ✓ | ? | ✓ | ✗ | ✗ |
| 2 | Bedrock GuardrailsAWS | 50 of 100 | Vendor-reportedattack coverage 50%, integration 50% | ✓ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | ✓ | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | $0.15/1k | — | ✓ | ✓ | ? | ✓ | ✗ | ✗ |
| 3 | Prompt Shields (AI Content Safety)Microsoft Azure | 43 of 100 | Vendor-reportedattack coverage 50%, integration 33% | ✓ | ✓ | ✓ | ? | ✗ | ✗ | ? | ✓ | ✗ | ✓ | ✓ | ✗ | ✗ | ? | ? | Per call | — | ✓ | ✓ | ? | ✓ | ✗ | ✗ |
✓ documented? unclear✗ not documented✓ documented, but the only link recorded is the vendor’s documentation home rather than the page that shows itEvery mark opens the page it was checked against.
The table above is what came out of reading each vendor’s own documentation and comparing the features they state. These are the other names in this form factor, taken from vendor integration catalogues, so the placement here is a first guess from a product description rather than one we have checked. Coverage is uneven because the market is uneven, not because a category was filled to a quota. Bounded by the number of model platforms; five or six is a realistic ceiling.
IBM watsonx.governance / Granite Guardian, OpenAI Moderation API, Databricks guardrails.
The same figures as a bar, split by what each scored group contributed.
Runs inside the application process. Ranked within this form factor only.
Attack coverageIntegrationOperational and compliance are in the matrix and excluded from the score.
Called over the network, sits between app and model. Ranked within this form factor only.
Attack coverageIntegrationOperational and compliance are in the matrix and excluded from the score.
Runs at the CDN or ingress, in front of the app. Ranked within this form factor only.
Attack coverageIntegrationOperational and compliance are in the matrix and excluded from the score.
Hyperscaler-native, tied to a model platform. Ranked within this form factor only.
Attack coverageIntegrationOperational and compliance are in the matrix and excluded from the score.
Which tools have a benchmark behind them, as distinct from documentation.
Every mark on this board is read from vendor documentation, so on feature presence alone every tool is vendor-reported. This view says only whether anyone has published a benchmark of the thing that ships. SOC 2 and ISO 27001 are controls audits and never count as one.
A benchmark of the version that ships today, published in a peer-reviewed venue or by someone other than the vendor, disclosing both a false-positive and a detection rate.
The vendor publishes a dataset, a false-positive rate and a detection rate for the artefact that ships, but no independent party has run it.
The only tool on the board whose model cards publish dataset, FPR and detection for the shipping artifact, versioned with the models (Prompt Guard 2 carries its own numbers). The numbers are vendor-authored and no peer-reviewed venue for the paper was found, so this is public methodology, not an independent or peer-reviewed benchmark [Certain].
github.com/meta-llama/PurpleLlamaPrompt Guard model cardPrompt Guard 2 model card
Feature presence is taken from the vendor's own documentation and no benchmark of the tool is published. This is a judgement about transparency, not about quality.
Vendor-reported. The EMNLP 2023 paper is the only peer-reviewed evaluation and it is stale: since October 2023 NeMo shipped Colang 2.0, the IORails engine, a model-based jailbreak detector and tool-calling rails, so the benchmarked artifact is not the one that ships. It also measured topical-rail accuracy, not injection FPR and detection [Certain].
NeMo Guardrails docs overviewJailbreak Protection (catalog)Guardrails configuration (rails)github.com/NVIDIA-NeMo/GuardrailsarXiv:2310.10501
Benchmark announced but methodology not verified; no third-party audit found.
Guardrails Hub (catalogue)guardrails-hub-monorepo (validators)github.com/guardrails-ai/guardrailsGuardrails Index
No third-party audit or vendor methodology found on an official page.
Docs (repo, archived)github.com/protectai/llm-guardSecrets scanner docRendered docs (GitHub Pages, live)Palo Alto Networks completes acquisition of Protect AI (22 Jul 2025)
No audit or published methodology found.
Protect overviewRun Protect from the SDKAgent Command Center quickstartGuardrails module (streaming)
Every mark on this board is read from vendor documentation, so on feature presence alone every tool is vendor-reported. This view says only whether anyone has published a benchmark of the thing that ships. SOC 2 and ISO 27001 are controls audits and never count as one.
A benchmark of the version that ships today, published in a peer-reviewed venue or by someone other than the vendor, disclosing both a false-positive and a detection rate.
The vendor publishes a dataset, a false-positive rate and a detection rate for the artefact that ships, but no independent party has run it.
Feature presence is taken from the vendor's own documentation and no benchmark of the tool is published. This is a judgement about transparency, not about quality.
Aggregator; no detection claims of its own.
Marketing cites a 0.01% false positive rate with no published methodology.
Guard APIQuickstart (AI Guardrails)PoliciesSelf-hostingData Leakage PreventionLiteLLM integrationFall '25 blog (latency)Check Point acquires Lakera (16 Sep 2025)
Claims without published methodology; much detail is datasheet-level.
Cisco AI DefenseDatasheetRobust Intelligence is now part of Cisco
No public methodology or third-party product audit found.
AI Runtime Security docsPrisma AIRS API referenceAI Runtime API release notes (rate limits)LiteLLM integrationJailbreak, single turn
No methodology, audit or compliance evidence on public pages.
Prompt for Homegrown AI AppsAgentic AI Security (MCP)SentinelOne acquires Prompt SecurityPortkey integration (third party, feature list)
Every mark on this board is read from vendor documentation, so on feature presence alone every tool is vendor-reported. This view says only whether anyone has published a benchmark of the thing that ships. SOC 2 and ISO 27001 are controls audits and never count as one.
A benchmark of the version that ships today, published in a peer-reviewed venue or by someone other than the vendor, disclosing both a false-positive and a detection rate.
The vendor publishes a dataset, a false-positive rate and a detection rate for the artefact that ships, but no independent party has run it.
Feature presence is taken from the vendor's own documentation and no benchmark of the tool is published. This is a judgement about transparency, not about quality.
Much detail lives in product briefs rather than developer docs.
No methodology published; platform compliance lives at the Cloudflare org level.
Every mark on this board is read from vendor documentation, so on feature presence alone every tool is vendor-reported. This view says only whether anyone has published a benchmark of the thing that ships. SOC 2 and ISO 27001 are controls audits and never count as one.
A benchmark of the version that ships today, published in a peer-reviewed venue or by someone other than the vendor, disclosing both a false-positive and a detection rate.
The vendor publishes a dataset, a false-positive rate and a detection rate for the artefact that ships, but no independent party has run it.
Feature presence is taken from the vendor's own documentation and no benchmark of the tool is published. This is a judgement about transparency, not about quality.
No product-level methodology or third-party efficacy audit.
Model Armor overviewModel Armor complianceNetworking integration (Service Extensions)
No product-level methodology or third-party efficacy audit.
No product-level methodology or third-party efficacy audit.
Where the documentation runs out, counted across the tools in one form factor.
Each bar counts the 5 tools in this form factor. A marked row is one at most one of them documents.
Each bar counts the 5 tools in this form factor. A marked row is one at most one of them documents.
Each bar counts the 2 tools in this form factor. A marked row is one at most one of them documents.
Each bar counts the 3 tools in this form factor. A marked row is one at most one of them documents.
Where marketing and documentation disagree, or where numbers look comparable and are not.
Protect AI is Palo Alto Networks (completed 22 Jul 2025). Robust Intelligence is Cisco (October 2024). Prompt Security is SentinelOne (announced 5 Aug 2025, completed September 2025 per SentinelOne). Lakera is Check Point (announced 16 Sep 2025); its docs are now branded Check Point AI Security and the product is AI Guardrails.
The Llama Guard paper (arXiv:2312.06674) has no journal reference and no peer-reviewed venue was found. The model cards still publish dataset, FPR and detection for the shipping artifact, so Meta is the only tool with public methodology, but by the board's own definition that is vendor-reported, not independent.
Lakera's SOC 2 Type I announcement and security page now redirect to generic Check Point pages. Check Point publishes company-level ISO 27001 and SOC 2 attestations; nothing product-level for AI Guardrails was found. Both cells stay unclear.
Check Point's figures come from a vendor blog (sub-40 ms, under about 200 ms); its sizing guide with p95 figures is gone. Prisma AIRS publishes rate limits, tiered from 50 RPS to a 150 RPS cap, not latency. SDK tools run in-process so latency depends on your own hardware. The board never ranks on latency, only on whether a figure is published.
HIPAA and FedRAMP High are on the product compliance page (updated 16 Sep 2026); SOC 1/2/3 and ISO 27001 are infrastructure-level statements on the overview. ISO 42001 is Google-Cloud-org-level, not product-level.
LiteLLM's Secret Detection is Enterprise-only (its Presidio PII masking is not). Cloudflare's AI detection fields are a paid Enterprise add-on. Cisco and Palo Alto runtime protection sit behind commercial tiers. The free or open-source surface differs materially from the marketed capability set.
Since 6 Jul 2026 validators install as PyPI packages and hosted remote inferencing is discontinued (cutoff 25 Aug 2026). The old docs Hub paths return 404; the Hub catalogue still lists 65 validators and the code lives in guardrails-hub-monorepo.
Cloudflare's is now AI Security for Apps (formerly Firewall for AI): discovery, PII and inbound prompt scoring documented, indirect injection and output moderation not documented. Akamai's documents inbound and outbound inspection, mostly in briefs and blog posts rather than developer docs.
The prompt-attack page states tool results and tool definitions are not assessed, and no document or RAG detector is documented. A meaningful gap versus Azure's Documents shield and Model Armor's MCP sanitization.
Repository archived by the owner on 9 Jul 2026; last release v0.3.16 on 19 May 2025; Protect AI's acquisition by Palo Alto Networks completed 22 Jul 2025. The rendered docs still serve from GitHub Pages even though llm-guard.com fails DNSSEC validation.
protect() runs inline in your process but every check runs in Future AGI's cloud with an API key. It sits in the SDK table because it is called in-process; it is not self-hostable.
One table a form factor. A row is a guardrail, and it is ranked only against the others that run where it runs. There are 4 tables: SDK, in-process, 5 of them, Proxy and gateway, 5 of them, Edge and WAF, 2 of them, and Managed cloud gateway, 3 of them. Nothing on this page adds them together, because a firewall at CDN ingress and a library inside your process are not two answers to one question.
The score. The weighted mean of documented cells across attack coverage and integration, scaled to 100. It opens at 60 and 40 and the reader moves it. Operational and verification stay on the matrix as reference columns and never reach the arithmetic: a compliance certificate is inherited from a cloud platform or is structurally unavailable to an open-source library, and the only operational cell that could have been scored was whether a latency figure had been published at all.
An unclear cell earns nothing unless the reader says otherwise, and the control above the table offers a quarter and a half. Unclear is not the same as absent: it means the documentation describes an outcome without a mechanism, or hides one behind a sales call. There are 69 of them.
The jailbreak column is two of the audit’s questions, joined. One asked about a detector that reads a single prompt, the other about one that carries state across turns. The board asks whether the tool documents jailbreak detection at all, so a tool that documents either documents it, and where one answer is documented and the other unclear the column reads documented. Both answers stay in the data, both are named on the cell, and the merge is a line in the rule rather than an edit to the audit.
Ties. Scores are compared as displayed, because the data underneath is 14 binary cells a tool and a sub-point gap is not real precision. A tie goes to GitHub stars, then to fewest unclear cells, then to the name.
Every cell links the page it was checked against, and the two kinds of link are not the same claim. 117 of the 345 cells link a page of their own; the rest link the documentation root that was searched. The glyph carries the mark and the colour carries the evidence, so a copper tick has a page behind it and a grey one has only the root. A link on a cross means the page was checked and the feature is not there. It never means proof.
What a mark rests on. Detection accuracy has no column because no independent, machine-readable benchmark exists for this category, so there is nothing every tool could be measured against the same way. SOC 2 and ISO 27001 are controls audits and are never treated as efficacy evidence. The documentation was read on 16 September 2026 from each vendor's own documentation, API references, vendor-owned repositories and trust pages, and every link, star count and corporate fact was re-checked against the live source on 17 September 2026.
That the vendor's own documentation shows the feature. It does not mean the feature was installed, exercised or found to work, and it says nothing about how often the detector is right. Nothing on this board was run. A question mark means the documentation is unclear: marketing-only, gated behind a sales call, or describing an outcome without a mechanism. A cross means a page was checked and the feature is not documented there.
Because no independent, machine-readable benchmark exists for this category. Every efficacy figure a vendor publishes is its own, on its own test set, and there is no neutral party running the same prompts through all fifteen. Inventing a column out of vendor claims would be the one thing this board exists not to do. Where a vendor does publish a dataset with a false-positive and a detection rate, that shows in the Evidence column and never in the score.
No. They are controls audits: they say an organisation follows the processes it claims to follow. They are not efficacy audits and say nothing about whether a detector catches an injection. Both stay on the matrix as reference columns, because a buyer often has to have them, and neither reaches the score.
It is the weighted mean of documented cells across attack coverage and integration only, scaled to 100. Attack coverage opens at 60 and integration at 40, and the controls above the table move both. There are 14 scored features. An unclear cell earns nothing unless you say otherwise, and the same control offers a quarter or a half.
Operational and verification and compliance are there to read, not to do arithmetic. A compliance certificate is inherited from a cloud platform or is structurally unavailable to an open-source library, so scoring it would rank company size. The only operational cell that could be scored was whether a latency figure had been published at all, which is a fact about a vendor's writing rather than about its product.
The audit asked separately about a detector that reads a single prompt and one that carries state across turns. The board asks whether a tool documents jailbreak detection at all, so the two are one column and a tool that documents either documents it. Both answers are still in the data and both are named when you hover the cell, so splitting the column again would change no mark. Where one is documented and the other unclear, the column reads documented: unclear is the weaker answer and the stronger one is the fact.
Because a web application firewall at CDN ingress and a library that runs inside your process are not two answers to one question. They see different traffic, fail in different ways and are bought by different people. There are 4 tables, each ranked only within itself, and nothing on this page adds them together.
Scores are compared as displayed, because the data underneath is 14 binary cells and a sub-point gap is not real precision. Two tools that round to the same figure are ordered by GitHub stars, then by fewest unclear cells, then by name. A proprietary tool has no star count and sorts last inside a tie, which is a licensing fact and not a quality one.
Never. They are shown for the 5 open-source tools because attention is worth knowing, they break a tie, and they do nothing else. A count on an archived repository is struck through, because a star count and a maintenance status have to be read together or not at all. One of the repositories on the board is archived.
No, and the rest of the field is on the page. Each table is what came out of reading vendor documentation and comparing the features each vendor states; beneath it, "Also in this form factor" lists the other names we know of. Coverage is uneven because the market is uneven: the proxy category is the deepest by far, and edge products cap out low because detecting an injection at CDN ingress requires being a CDN.
Because that is all the audit recorded for it. 41 of the 132 documented cells link the documentation root that was searched rather than a page proving the feature. Those ticks are drawn grey rather than copper and say so when you hover them. The mark is the auditor's and stands; the link is weaker evidence, and the board would rather show that than dress a root link up as proof.
There is no fixed schedule. The date at the top is the last time the data changed, not the last time the page was built. A weekly job checks every source link still resolves and opens an issue when one does not; it never edits a mark.