Head-to-head · updated 13 September 2026

DataShield vs Lakera: a detector and a control plane are not the same purchase

Lakera built the best prompt-injection classifier on the market. Sub-50ms screening. A false-positive rate near 0.01%. Its training set comes from Gandalf, a game. It has collected 80 million-odd community attack prompts. Check Point bought Lakera in September 2025. A year on, they've kept the Lakera name. It's on Guard, Red, and Gandalf. They didn't fold them into Infinity branding. Is your question 'is this input malicious'? They answer it better than we ever will.

We answer a different question. Was this action allowed? On what data? By which agent? Can you prove it later? We tokenize datasets at ingest. Agents query tokenized data over MCP. We check each tool call against the agent's current access. Then it seals into a chain. You can check it yourself. This page is mostly about where the two fit together. For most buyers, the answer isn't one or the other.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

Your agents act through MCP tool calls, not just chat. Lakera's public hookup covers /v1/chat/completions. It states that MCP and A2A aren't supported. So that surface is unguarded, right now.
Someone will eventually ask you to prove an access record wasn't edited. Detection dashboards are telemetry. Ours is a hash chain with signed checkpoints and a verifier you can run yourself. Try it.
You need to pull an agent's authority mid-session and have the next tool call fail closed, rather than waiting out a token.
The failure you actually fear is an agent that looks perfectly authorized doing something it shouldn't. A classifier trained on attacks won't flag that.

Pick Lakera when

You need prompt-injection and jailbreak detection, direct or indirect. This is best-in-class and we don't have a classifier at all. Don't buy governance hoping it filters inputs.
Latency in the model path matters. Sub-50ms screening with a very low false-positive rate is hard to build and they've built it.
You want pre-deployment red-teaming. Lakera Red probes your app before launch. We offer nothing comparable.
You're already a Check Point shop and Infinity procurement is the path of least resistance for getting AI security funded this quarter.

Bottom line: these stack. Lakera on top as the attack filter at the model edge, DataShield underneath as the authorization and evidence layer around tool calls. If you can only fund one, ask which failure would hurt more: an injected prompt you didn't catch, or an authorized agent you can't account for.

Feature by feature

Competitor cells describe what Lakera's and Check Point's public materials say. We use the date above. Did we get a thing wrong? Email support@myorg.ai. We'll fix it, and credit you.

What matters	DataShield	Lakera	Edge
Prompt-injection detection	None, by design. We're not a detection product. Nor do we pretend otherwise. We constrain what an injected agent can reach. We log what it did.	Core strength. It screens inputs and outputs at runtime. Direct and indirect injection, both. Public catch and false-positive figures.	◇
Red-teaming	Not offered. We publish a threat model and a public verifier instead.	Lakera Red does pre-deployment adversarial testing. No equal on our side.	◇
Latency in the model path	We don't sit in the model path. So there's nothing to measure. Authorization happens at tool dispatch.	Sub-50ms inline screening. Roughly 0.01% false positives. Trained on the Gandalf attack corpus.	◇
MCP and agents	Native MCP endpoints on Auth, Ontology, and Lighthouse. MCP tool tokens carry scope ceilings. Per-tool-call dispatch. Metering attributed to the agent.	Their documented LiteLLM hookup supports chat completions only. It explicitly does not cover MCP or A2A traffic.	◆
Agent authorization	Each checked tool call passes a scope ceiling. Plus a declared authority tier. Plus a revocation re-check before dispatch. Cedar governs admin, config, and token decisions.	No identity plane. Guard screens content. It doesn't know which agent is calling. It doesn't know what that agent may do.	◆
Break-glass	Scoped, time-boxed emergency access for agents. It auto-revokes. It can't be quietly removed from the log.	Not offered.	◆
Audit evidence	SHA-256 hash chain with Ed25519-signed checkpoints. We chain the checkpoints too. Verification names the failure: tampering, insertion, deletion, or truncation. Try the verifier.	Detection events land in a dashboard. We found no published tamper-evidence method for those logs.	◆
PII handling	Classification catalog. Plus quasi-identifier generalization. Dates to year, decade or age band. ZIPs to 3 or 4 digits. Partial phones, SSNs and emails. Each column gets a measured cardinality-reduction score. Deterministic tokenization at ingest. We tokenize datasets at ingest. Agents query tokenized data over MCP. Detokenization is a privileged, audited step.	Inline catch with masking or blocking, using placeholders such as `<EMAIL_ADDRESS>`. One-way by design. No vault. No checked reversal.	◆
GDPR erasure	Crypto-shred of per-subject key material. Plus ISO 27560 consent receipts. Actor identities are HMAC commitments. So the log survives the erasure intact.	Not a data-residency or erasure product. We couldn't find an erasure story in their public docs.	◆
Deployment	Self-hosted in your own cloud or data center. Or on a dedicated single-tenant server we operate. Your keys.	SaaS API. A self-hosted option for big firms. Plus Check Point Infinity bundling.	◈
Maturity signals	Auth, Guardian and Lighthouse are live in production. Guardian and Lighthouse since April 2026. SOC 2 not yet certified, and we say so.	Founded 2021. Acquired by Check Point for roughly $300M in September 2025. Now the base of their AI Security Center of Excellence. Enterprise distribution we can't match.	◇
Pricing	Published model, scoped instant quote, no sales wall.	Legacy standalone pricing started around $99/month, usage-based. Post-acquisition, it's routed through Check Point procurement. We couldn't find a current published figure.	◆

◆ DataShield leads◇ Lakera leads◈ comparable

Lakera claims come from Lakera's and Check Point's public materials. Also from their LiteLLM hookup docs. Also a June 2026 third-party review. Last checked 13 September 2026. We link the sources below.

Three things you get here that you won't get from a detection layer

Coverage of the surface agents actually use

Chat is where people talk to models. Tool calls are where agents touch systems. Lakera's hookup covers the first. It says it doesn't cover the second. Our MCP tool tokens carry scope ceilings. Dispatch re-checks them on each call. How Auth does it.

Proof, not telemetry

A detection dashboard tells you what it flagged. It says nothing about whether someone changed the record after. An EU AI Act Article 12 reviewer asks that second question. So does a HIPAA §164.312(b) reviewer. Ours is a hash chain, with signed checkpoints. The verifier says what went wrong. Not just that a thing did. Run it in your browser.

Pseudonymization you can reverse under policy

Masking to a placeholder is one-way. That's fine for a log line. It's useless when an analyst legitimately needs the real value. Our tokens are deterministic, join-preserving, and vault-reversible. We log detokenization like the privileged operation it is. The data model.

Where Lakera is genuinely stronger

Their classifier is the real thing. The Gandalf flywheel gives them a rare thing. Most security vendors can only wish for it. A steady stream of tricky prompts. Humans write them, trying to win a game. It retrains the models daily. Independent reviews put them at or near the top. On precision. Sub-50ms. A false-positive rate near 0.01%. That mix makes inline screening survivable in production. Lakera Red covers pre-deployment testing, which we don't do. And Check Point's reach helps. A CISO can often get Guard funded faster than a line item. It's faster than funding an unknown firm. Those are all good reasons to buy them. A page that said no wouldn't be worth your time.

The push-back is about scope, not quality. Gartner expects at least 80% of bad agent moves, through 2028. These are internal policy breaks. Not attacks. A classifier trained on attacks is blind, by design. Blind to the agent that looks entirely legit. It's also blind to one that does something it shouldn't. Even on the attack side, a 98% detector still misses. Two tries in a hundred get through. The question then is: what limits the damage? That's scope ceilings. Mid-session cut-off. A log you can prove. Add the MCP gap. Their own docs are candid about it. The shape of the pairing gets clear. Catches on top. Rules underneath.

Questions worth asking both of us

Ask both of us these. The answers diverge more than the marketing does.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Records commit forward. Checkpoints are Ed25519-signed and chained too. Verification names the failure: tampering, insertion, deletion, truncation. Go break the sample chain at /verify. Lakera: it writes detections to a dashboard. We found no public tamper-evidence method. Relying on those records for EU AI Act Article 12 logging? Ask them what stops an edit.

What happens to a revoked agent mid-session?

We re-check access at dispatch, on each checked tool call. A pulled grant takes effect one call later. Not one token later. Lakera has no identity plane. The question doesn't really apply to them. Guard screens the content of a request. It doesn't know which agent sent it. It doesn't know what that agent may do. Worth asking both of us: how long does a compromised agent keep working? That's after you pull its access.

How does GDPR erasure interact with the audit trail?

We destroy the subject's key material. We issue an ISO 27560 receipt too. The chain keeps verifying. Why? The actors in it are HMAC commitments, not names. Lakera's masking is one-way placeholders. That's a different kind of privacy control. There's no vault. So there's nothing to shred. Nothing to re-identify under policy, either. We found no erasure documentation on their side.

Does Lakera Guard screen MCP tool calls?

Not by their own docs. The LiteLLM hookup supports /v1/chat/completions. It says MCP and A2A traffic aren't covered. That matters. Agents cause harm through tool calls, not through the chat box. Ask them directly. Ask for a roadmap date, if they say it's coming. Our dispatch line is per-tool-call, by design.

Should we run both, or is this an either/or?

Run both, in most cases. There's almost no overlap. Lakera classifies content at the model edge. We authorize actions and seal evidence around tool calls. The only place we touch is basic PII catches. Even there, the methods differ. Their masking is one-way. Our tokenization is vault-reversible. Does someone tell you a detection tool and a governance tool are the same buy? They're not the same buy. Push back on that, whichever vendor says it.

Does DataShield have SOC 2?

No. Auth is live. It has a public threat model. And a verifier anyone can run. Guardian and Lighthouse have run since April 2026. Design-partner terms include source escrow. Lakera sits inside Check Point. So they bring the record of a large public security firm. Weigh that against a vendor you hadn't heard of last month. It's a fair thing to do. Security page.

Lakera Guard, Lakera Red, and Gandalf still run under the Lakera name. That's a year after the deal. Folding them into Check Point's AI Security Center of Excellence is still underway. - AppSecSanta, 18 Jun 2026
Check Point acquired Lakera for roughly $300M. News outlets reported the deal in September 2025. - AppSecSanta retrospective, 18 Jun 2026
Lakera Guard's public figures: 98%+ catch rate. Sub-50ms latency. ~0.01% false-positive rate. Models fed by 80M+ Gandalf attack prompts. - Lakera Guard 2026 review, AppSecSanta, 18 Jun 2026
Lakera's LiteLLM hookup covers /v1/chat/completions only. No MCP traffic. No A2A traffic either. - Lakera v2 LiteLLM integration docs, 13 Sep 2026
≥80% of unauthorized agent transactions through 2028 will be internal policy breaks, not attacks. - Gartner, 2026
EDPB names pseudonymization as a GDPR risk mitigation for AI models. - EDPB Opinion 28/2024

Other head-to-heads

Complement

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →