Head-to-head · updated 13 September 2026
DataShield vs F5 AI Guardrails: who proves the agent was allowed to do that?
F5 bought CalypsoAI for $180 million. They turned it into a real product. AI Guardrails checks prompts and replies inline. It blocks injection. It blocks jailbreaks. It filters output. It flags PII before it gets out. Their red team adds over 10,000 attack patterns a month. Outside tests put success at 98.2%. F5 already sits in the data path. Half the banks you can name use it. So the setup story writes itself. Is your problem bad traffic reaching a model? Then they're a strong answer.
DataShield sits under that, not beside it. We tokenize data sets at ingest. Agents query tokenized data over MCP. Detokenization is locked. It's checked. We check every governed tool call. That check runs against the agent's live rights. We seal every call into a hash chain. You can check it yourself. Most teams who talk to both of us end up running both. Here's the honest split. It names the rows F5 wins outright.
The short version
Pick DataShield when
- You need to prove an agent's access record was not edited after the fact. F5 names the EU AI Act in three press notes. We map to Article 12 and Article 26. Then we hand you a verifier. Run it.
- You want to pull an agent's rights mid-session. The very next governed tool call should fail closed. It shouldn't wait out a token.
- The data itself is the risk. Tokenize at ingest. The agent's query never held the raw value. There's nothing for a scanner to miss.
- You'd like a price before you book a call. Ours is published.
Pick F5 AI Guardrails when
- Your risk is prompt injection, jailbreaks and toxic output. That's their home turf. We don't compete there at all.
- You already run F5 in the data path. Guardrails become one more rule on kit you own. There's no new proxy hop. The MuleSoft Agent Fabric work makes that point well.
- You want steady red teaming. Thousands of fresh attack patterns feed back into your guardrail rules each month.
- You need one vendor across air-gapped, on-prem and three public clouds. A public firm with thirty years of enterprise support stands behind it.
Bottom line: F5 checks the traffic. We check the actor and keep proof of what it did. Is your board question "did we block the attack"? Buy theirs. Is it "can you show the examiner the March logs and prove nobody touched them"? Start here.
Feature by feature
Competitor cells state what F5's product pages and press say. We use the date above. Did we get something wrong? Email support@myorg.ai and we'll fix it, credited.
| What matters | DataShield | F5 AI Guardrails | Edge |
|---|---|---|---|
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints, chained too. A check names the fault: tampering, insertion, deletion or a cut. Try the verifier. | "Audit-ready logging" that traces every block with guardrail tags, plus SIEM export. We found no signed tamper-proof design in their public docs. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling. It also carries a set rights tier. It gets a pull check before dispatch. | Secure AI Agents guardrails aim to "prevent excessive agency and privilege escalation" on agent moves and tool use. That's a rule on traffic. They list no rights tier. They list no agent ID model. | ◆ |
| Break-glass | Scoped, time-boxed access, just for a crisis, just for agents. It auto-revokes on its own. It can't be quietly wiped from the log. | Not offered, as far as we can tell from public docs. | ◆ |
| GDPR erasure | Crypto-shred of per-person key parts, plus ISO 27560 consent receipts. The chain still checks out after the person is gone. | They name GDPR as a goal. We found no erasure method. Nor any word on what erasure does to the audit history. | ◆ |
| Data handling | We tokenize data sets at ingest. Agents query tokenized data over MCP. Detokenization is a locked, checked step. Tokens are fixed, join-safe and vault-reversible. | Runtime detect and redact of sensitive data in prompts and replies. Day 1 Compliance Controls ship as expert-built guardrails for PII, PCI and PHI. | ◈ |
| Inline inspection | No traffic proxy, by design. What we do have: a fail-closed gate. It sits on every value that leaves a governed data set for a prompt. A PHI data set blocks any AI endpoint not marked BAA-approved. We tokenize data sets at ingest. So the model works on tokens. | Yes, and it's the core of the product. F5 checks inbound prompts and outbound replies. That happens before it calls the model, or sends back the response. | ◇ |
| Red teaming | We don't do it. We publish a threat model and a verifier instead. | F5 AI Red Team runs a swarm of attack agents. Over 10,000 new attack patterns feed back into guardrail rules each month. | ◇ |
| MCP and agents | Native MCP endpoints on Auth, Ontology and Lighthouse. MCP tool tokens carry scope ceilings. Per-call logs tie back to the agent. | F5 AI Gateway added an MCP Gateway in August 2026. It has a server list. It has access rules. It has audit trails of which agent called which tool. Workforce AI Security checks tool calls before they run. It's live to all from October 2026. | ◈ |
| Deployment | Self-hosted or single-tenant. Your keys, including the detokenization keys. | Public cloud, private cloud, on-prem and air-gapped. Red Hat OpenShift certified operator. Hard to beat on reach. | ◇ |
| EU AI Act posture | We map the audit chain to Article 12 logging and Article 26 deployer record-keeping. We say plainly that this map is our design goal, not a certification. | Named in three press notes and a product video. Bundled as a Day 1 Compliance Control. We found no tie to a specific Article anywhere on their site. | ◆ |
| Maturity signals | Auth, Guardian and Lighthouse are live and in use (Guardian and Lighthouse since April 2026). SOC 2 not yet in place, and we say so. | NASDAQ-listed. Founded 1996. Two AI security buys in a year. 98.2% success in SecureIQLab tests. Global support. | ◇ |
| Pricing | Published price, a quick quote, no sales wall. | No figures shown. A free trial and a "Play demo" button, then a talk. | ◆ |
◆ DataShield leads◇ F5 AI Guardrails leads◈ comparable
We draw F5 claims from f5.com product pages. Also F5's own press notes. We checked them on 13 September 2026. We link them below, not just our take.
Three things you get here that you won't get from an inline guardrail
Logs an examiner can't argue with
F5 promises audit-ready logs with guardrail tags. That tells you why F5 blocked a request. Handy. But it doesn't tell you one thing. Does the record still say what it said in March? Our chain ties each record to the one before it. It signs checkpoints. The verifier names the fault instead of a shrug. EU AI Act Article 12 asks for auto logging over the system's life. Article 26 puts the keeping of those logs on you. That's the deployer. It's at least six months. Recording is the easy half. Break a live chain in your browser.
Authority that changes mid-flight
A guardrail asks if this request looks risky. It does not ask if this agent is still let to make it. An analyst quits at 2pm. Their agent is forty minutes into a job. We re-read scope ceiling, rights tier and revocation at every governed dispatch. So the next call fails closed. How Auth does it.
Nothing raw to catch in the first place
Inline catching is a race between a scanner and the data. Win it 98.2% of the time. You still lose eighteen requests in a thousand. We take the data out of the race. Tokens are fixed and join-safe, so analysis still works. The vault holds the map under a rule. The data model.
Where F5 AI Guardrails is genuinely stronger
Reach and detection, and it isn't close. F5 spent $180 million on CalypsoAI. Then they bought SurePath AI. Then they shipped an AI Gateway. It has an MCP gateway inside it. Then they linked guardrails into Salesforce's Agent Fabric. No extra proxy hop needed. That's four moves in twelve months. It comes from a firm that already ends traffic. Half the Fortune 500 relies on it. Their red team makes over 10,000 fresh attack patterns a month. Findings feed straight back into rules. They run air-gapped. They run on OpenShift. We do none of that. A small vendor pretending otherwise would insult your smarts.
The push-back is narrow, and it matters. Gartner has a forecast here. Through 2028, at least 80% of bad agent moves will be inside jobs. Not outside attacks. A tool trained on attacks is blind by build. It can't see the agent that acts normal. Even when that agent does something it was never let to do. Their own chief product officer put it well. He said firms run AI "across agents that authenticate and act on their own". Quite. So ask who checked the agent's rights. Ask when they checked it. Ask what stops someone from editing the log. F5 names the EU AI Act loudly. Louder than anyone else in this space. We respect that. We just noticed one thing. They never name an Article.
Questions worth asking both of us
Ask both of us these. The answers separate faster than the marketing does.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Records tie forward. Checkpoints are Ed25519-signed and chained too. A check returns a named fault: tampering, insertion, deletion or a cut. The sample chain at /verify exists to be broken. F5: their pages promise audit-ready logs, guardrail tags and SIEM export. We found no tamper-proof method spelled out. Ask what stops an edit. Ask for the method, not the log format.
What happens to a revoked agent mid-session?
We re-read rights at dispatch on every governed tool call. So revoke lands on the next call. F5's MCP Gateway applies access rules to agent-to-tool traffic. Workforce AI Security checks tool calls before they run, from October 2026. We could not find anything on pulling one agent's rights mid-job. Ask both of us: how long does a bad agent keep working after you pull its access? Ask to see it, not hear it.
How does GDPR erasure interact with the audit trail?
We crypto-shred the person's key parts. We send an ISO 27560 receipt. The chain keeps checking out. Actors in it are HMAC locks, not names. F5 lists GDPR among the regimes their logs support. We found no erasure method. No word on what erasure does to audit history, either. It's a fair question for any vendor. Especially one whose answer to compliance is "more logs".
F5 says it aligns AI deployments to the EU AI Act. Doesn't that cover us?
Partly. We'd rather be exact than snide about it. Article 12 asks for auto recording of events over the system's life. Article 26 makes you, the deployer, keep those logs for at least six months. Inline guardrail logs meet the recording half. Neither we nor F5 can hand you a certificate. Anyone offering one is selling something. What we add is integrity. A record's edit is spottable, by a third party who trusts neither of us. We read every F5 page and release on 13 September 2026. The EU AI Act is named. No Article is cited. Ask them which duty their logging meets.
Is F5 AI Guardrails an alternative to DataShield?
Not really. The overlap is smaller than the names suggest. They govern the pipe: what enters the model and what comes back. We govern the data and the actor. Which tokenized data set may a named agent query? Under what ceiling? What gets sealed after? Say a coder drops a database key into a script. An inline checker sees nothing, and our data sets stay tokenized. Say someone slips a jailbreak past our tokenized query surface. We have no view on the prompt, and F5 does. Run both. We'd rather say that here than have you find out in month four.
Does DataShield have SOC 2?
No, and we won't say otherwise. F5 is a public firm with decades of marks. We're not going to win that row. What we offer instead: Auth is live. It ships with a public threat model. It ships with a verifier anyone can run. Guardian and Lighthouse have run live since April 2026. You self-host the setup, with your keys. Design-partner terms include source escrow. So one small vendor isn't a single point of failure. Details on the security page.
- F5 acquired CalypsoAI for $180 million in cash consideration, citing "centralized observability, policy control, and audit logs for GDPR/EU AI Act compliance". - F5 press release, 11 Sep 2025
- F5 AI Security Platform launch bundles AI Guardrails, AI Red Team and SurePath AI, with 98.2% security efficacy in independent testing and guardrails deployed "at the point of interaction". - F5 press release, 22 Jun 2026
- F5 AI Gateway ships a Model Gateway, an MCP Gateway with agent-to-tool audit trails, and Guardrails, with token spend attributed by team and user. - F5 press release, 18 Aug 2026
- F5 Workforce AI Security inspects tool calls across MCP servers before execution and attributes interactions to users and agents. Generally available October 2026. - F5 press release, 9 Sep 2026
- AI Guardrails lists Day 1 Compliance Controls for PII, EU AI Act, PCI and PHI, plus audit-ready logging with guardrail attribution and a threat library adding 10,000+ patterns monthly. - f5.com/products/ai-guardrails, 13 Sep 2026
- ≥80% of unauthorized agent transactions through 2028 will be internal policy violations rather than attacks. - Gartner, 2026
- EDPB names pseudonymization as a GDPR risk mitigation for AI models. - EDPB Opinion 28/2024
Other head-to-heads
DataShield vs HiddenLayer
Model-layer threat defence versus authorization and sealed evidence around tool calls.
ComplementDataShield vs Lasso Security
Fast classifiers on top. The same question: which layer carries the obligation?
ComplementDataShield vs AI gateways
The gateway governs the pipe. We govern the data moving through it.
AllEvery comparison
One honest scorecard per vendor, including the rows we lose.
See the two moves F5 doesn't describe. Break a live audit chain. Then revoke an agent mid-session and watch the next tool call fail. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →