Head-to-head · updated 13 September 2026
DataShield vs Lasso: a guardrail decides in 5ms, but who proves it a year later?
Lasso sells an AI security platform. Discovery, posture, red teaming, runtime rules, detection, and response. In September 2026 they shipped LEAP. A transformer-free guardrail that runs on plain CPUs. It decides in under five milliseconds. They raised $30M, led by ClearSky, on the back of it. They also publish an open-source MCP gateway. Plus a real MCP security use case. Is your question "is this content or this server dangerous"? They answer it faster and cheaper than we can. And they do it in an air-gapped rack.
We answer the next question. Who was the agent? Was it still allowed to act? Can you show a regulator the record wasn't edited later? We tokenize datasets at ingest. Agents query tokenized data over MCP. Turning a token back is a privileged, logged step. We check each tool call against the agent's current access. Then it seals into a hash chain. You can check it yourself. Most buyers who ask us about Lasso end up running both. So this page is mostly about which job lands in which layer.
The short version
Pick DataShield when
- Someone will ask you to prove an agent's access record wasn't changed. A SIEM export is a copy of a log. Not proof about it. Ours is a hash chain, with signed checkpoints and a verifier you can run. Try it.
- You need to pull an agent's access mid-session. The next tool call should fail closed. Not wait out a token.
- The data itself is the risk. We tokenize at ingest. The agent's queries never touch the raw value. Turning a token back is a logged, privileged act, not a masking rule.
- You want the policy plane, the vault, and the proof on your own infrastructure. With your keys. And a price you can read before a sales call.
Pick Lasso when
- You need prompt-injection, memory-poisoning, and jailbreak detection at runtime. Lasso publishes 98.6% accuracy at under 50ms. LEAP cuts that to under 5ms on a CPU. We have no classifier at all.
- Red teaming before launch matters to you. Their attack library claims over 3,000 types. We offer nothing like it.
- You run air-gapped or GPU-starved. A guardrail with no GPU footprint is genuinely hard to build. That's why DHS and defense buyers show up in their press release.
- You want AI-BOM discovery: a list of the models, prompts, tools, and MCP servers already in use. We assume you know what you deployed. That's optimistic of us.
Bottom line: these stack cleanly. Lasso sits on top, as the filter that judges content and servers. DataShield sits underneath, as the layer that decides what an identified agent may do. It keeps proof it did only that. If you can fund only one, ask which call you'd rather explain to an examiner: the attack you missed, or the agent you can't account for.
Feature by feature: AI guardrails and agent governance
Competitor cells describe what Lasso's site, press releases, and open-source repo say. We use the date above. Did we get something wrong? Email support@myorg.ai. We'll fix it and credit you.
| What matters | DataShield | Lasso | Edge |
|---|---|---|---|
| Threat detection | None, by design. We don't sort content. Nor do we pretend to. We limit what an agent can reach. We record what it did. | Core strength. Prompt injection, memory poisoning, and jailbreaks, mapped to MITRE and OWASP. Published figures: 98.6% accuracy, under 50ms per check. | ◇ |
| Guardrail cost and latency | Nothing sits in the model path. So there's no number to quote. Access checks happen at tool dispatch. | LEAP is transformer-free and CPU-only, under 5ms per call. RAPID is a self-hosted judge for the harder calls. They claim 570 times the cost efficiency of cloud-native guardrails. | ◇ |
| Red teaming and posture | Not offered. We publish a threat model and a public verifier instead. | Automated red teaming with 3,000+ attack types. Plus AI-BOM discovery and a posture view across models, prompts, tools, and MCP servers. | ◇ |
| Audit evidence | SHA-256 hash chain, with Ed25519-signed checkpoints. We chain those checkpoints too. Verification names the exact failure: tampering, insertion, deletion, or truncation. Try the verifier. | "Complete audit trails of every MCP connection and tool call" with SIEM export and compliance reports. We found no public tamper-proof method for those records. | ◆ |
| Agent authorization | Each checked tool call passes a token scope ceiling. Plus a declared access tier. Plus a revocation re-check before dispatch. Cedar governs admin, config, and token calls. | Access rules and permissions over MCP servers. Plus auto-blocking of untrusted or unapproved servers. Policy sits on the connection, not on an agent identity with an access tier. | ◆ |
| Mid-session revocation | Access gets re-read at dispatch. So a pull lands on the next tool call. An analyst leaves at 14:00. Their agent's 14:02 call fails. | We couldn't find a mid-session pull method in their public docs. Ask them what happens to a job already running. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It auto-revokes. It can't be quietly removed from the log. | Not described in their public docs. | ◆ |
| PII and tokenization | A sort catalog. Plus quasi-identifier generalization. Dates become year, decade, or age band. ZIPs become 3 or 4 digits. Phones, SSNs, and emails get partial masking. Each column gets a measured cardinality-reduction score. Plus deterministic, join-preserving, vault-reversible tokens. We tokenize datasets at ingest. Agents query tokenized data over MCP. Turning a token back is a privileged, logged step. | Inline DLP and masking. Their open-source gateway masks secrets and PII in requests and responses. A Presidio plugin option exists. One-way by design. No vault. No checked way back. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material. Plus ISO 27560 consent receipts. Actor identities in the chain are HMAC commitments. So the proof still checks out, even after the subject is gone. | GDPR appears as a framework they align to. We found no erasure method spelled out. | ◆ |
| MCP and agents | Native MCP endpoints on Auth, Ontology, and Lighthouse. MCP tool tokens carry scope ceilings. Per-call dispatch. Metering tied to the agent. | A real MCP story: an MIT-licensed open-source gateway. It proxies MCP servers. It scans server reputation. It cleans traffic. It covers Claude Code and Desktop, Cursor, Windsurf, and custom agents. | ◈ |
| Deployment | Self-hosted, in your own cloud or data center. Or on a dedicated single-tenant server we run. Your keys. | SaaS and self-hosted. AWS and Azure marketplace listings. A Cloudflare hookup. CPU-only guardrails, built for air-gapped networks. | ◈ |
| Maturity signals | Auth, Guardian, and Lighthouse are all live in production. Guardian and Lighthouse have run since April 2026. SOC 2 isn't certified yet, and we say so. | Founded 2023. $30M Series A, led by ClearSky, in September 2026. Gartner Cool Vendor 2024. Named customers include DHS, BMW, Leonardo, eToro, and Fiverr. Claimed revenue growth above 500% in a year. | ◇ |
| Pricing | Our pricing. A scoped instant quote. No sales wall. | Quote-only, demo-gated. Third-party write-ups on their pricing exist because Lasso doesn't publish any. | ◆ |
◆ DataShield leads◇ Lasso leads◈ comparable
Lasso claims come from lasso.security. Plus their September 2026 funding and LEAP news. Plus their public MCP gateway repo. Last checked 13 September 2026. Sources are linked below.
Three things you get here that you won't get from a guardrail layer
Proof, not a log export
"Compliance-ready audit trails" usually means logs you can ship to a SIEM. That proves someone wrote the records. It says nothing about whether someone edited one on Tuesday. Our chain commits each record to the one before it. It signs checkpoints. The verifier names the break, rather than shrugging. That's what an EU AI Act Article 12 or HIPAA §164.312(b) reviewer tests for. Run it in your browser.
Authority that can change mid-flight
A guardrail asks whether this request looks bad. It doesn't ask whether this agent still has access. We re-check scope, access tier, and pulled grants at each dispatch. Pulling access lands one call later. Not one token later. How Auth does it.
Pseudonymization you can reverse under policy
Masking a value to a placeholder is one-way. Fine for a log line. Useless when a fraud analyst needs the real customer record. Our tokens are deterministic and join-preserving. The vault holds the mapping. We log each reversal like the privileged act it is. The data model.
Where Lasso is genuinely stronger
Almost everything on the detection side. LEAP is the most interesting guardrail release of the year. Transformer-free. No GPU. Under five milliseconds a decision. It runs in an air-gapped network, where a cloud API just isn't allowed. Pair that with RAPID, a self-hosted judge for the hard calls. You get a routing story most guardrail vendors can't match on cost. Their red-team library claims over 3,000 attack types. Their AI-BOM finds the shadow agents and MCP servers. The ones your teams stood up without telling you. Their open-source MCP gateway is MIT-licensed and genuinely useful. Most vendors give away far less. DHS, BMW, and Leonardo are references. We can't answer that, except with an honest shrug.
The push-back is about scope. Gartner expects at least 80% of unauthorized agent calls through 2028 to be internal policy breaks. Not attacks. A classifier trained on attacks is blind, by design. Blind to the agent that looks completely legitimate. Blind to one doing something it was never entitled to do. Even on the attack side, 98.6% means fourteen in a thousand get through. The question then is what limits the blast radius. And what you can show later. Their own MCP page lists five pillars. Access rules and audit trails are two of them. That tells you they know the question matters. Our answer: a scope ceiling. A pull re-check. A chain you can verify. Theirs, as far as we can tell, is a policy proxy and a log shipper. Ask them to prove otherwise. Tell us if they do.
Questions worth asking both of us
Ask both of us these. The answers split faster than the marketing does.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Records commit forward. Checkpoints are Ed25519-signed and chained too. Verification returns a named failure: tampering, insertion, deletion, or truncation. The sample chain at /verify is there to be broken. Lasso: their MCP page promises complete audit trails, SIEM export, and compliance reports. We found no tamper-proof method described. Leaning on those records for EU AI Act Article 12 logging? Ask what stops an edit.
What happens to a revoked agent mid-session?
We re-read access at dispatch on each checked tool call. So the next call fails closed. Lasso can block an unapproved MCP server. It can enforce policy at the proxy. But we couldn't find anything about pulling one agent's access while a job runs. Ask both of us: how long does a compromised agent keep working, after you pull its access? Ask for the demo, not the slide.
How does GDPR erasure interact with the audit trail?
We crypto-shred the subject's key material. We issue an ISO 27560 receipt too. The chain keeps checking out, because actors in it are HMAC commitments, not names. Lasso lists GDPR among the frameworks they align to. We found no erasure method in their public docs. Their masking is one-way. So there's no vault to shred. And nothing to bring back under policy, either.
Is Lasso's MCP gateway an alternative to DataShield?
Not really. This is the most common mix-up we hear. Their gateway governs the pipe. Which MCP servers are allowed. What gets masked in transit. What looks like an injection. We govern the data and the actor. Which tokenized dataset can an identified agent query? Under what scope, with what recorded? Say a developer adds a direct database credential to a script. A gateway sees nothing. Our tokenized datasets stay tokenized either way. Most teams need both. That's why we say so here, rather than making you find out.
Do you tokenize PII before the model sees it, or detect it afterwards?
We tokenize datasets at ingest. Agents query tokenized data over MCP. Turning a token back is a privileged, logged step. So there's no raw value in the query surface to catch. Lasso works the other way. Inline DLP and masking on traffic. A Presidio plugin in the open-source gateway. That catches free-form text we never see. But it's one-way. Different methods, for different failure modes. Worth being clear which one your job needs.
Does DataShield have SOC 2?
No, and we won't fake it. Auth is live, with a public threat model and a verifier anyone can run. Guardian and Lighthouse have run in production since April 2026. Design-partner terms include source escrow. Lasso lists SOC 2 among frameworks they align to. We couldn't confirm an attestation report in their docs, though. So ask them for the letter, not the logo. Security page.
- Lasso's platform page publishes 98.6% threat detection accuracy and under 50ms per classification. Plus 570x cost efficiency versus cloud-native guardrails, and a 3,000+ attack library. - lasso.security/platform/ai-security, 13 Sep 2026
- LEAP is a transformer-free, CPU-only guardrail at under 5ms per decision. It was announced with a $30M Series A led by ClearSky, and customers including DHS, BMW, Leonardo, eToro and Fiverr. - Lasso Security announcement, 3 Sep 2026
- Lasso's MCP security page lists discovery, DLP, access management, audit trails and threat detection, covering Claude Code and Desktop, Cursor and Windsurf. - lasso.security/use-cases/mcp-security, 13 Sep 2026
- Lasso's MCP gateway is MIT-licensed. It masks secrets and PII in proxied MCP traffic, with basic, Presidio and Lasso plugin tiers. - lasso-security/mcp-gateway on GitHub, 13 Sep 2026
- Release history: open-source MCP gateway April 2025, Cloudflare integration July 2025, Intent Security framework February 2026, CPU-based guardrails September 2026. - lasso.security/resources, 13 Sep 2026
- ≥80% of unauthorized agent transactions through 2028 will be internal policy violations rather than attacks. - Gartner, 2026
- EDPB names pseudonymization as a GDPR risk mitigation for AI models. - EDPB Opinion 28/2024
Other head-to-heads
DataShield vs Lakera
The other best-in-class classifier. The same question about which layer the job lands in.
ComplementDataShield vs HiddenLayer
Model-layer threat defense, versus access checks and sealed proof around tool calls.
ComplementDataShield vs Docker MCP Gateway
The gateway governs the pipe. We govern the data moving through it.
AllEvery comparison
One honest scorecard per vendor, including the rows we lose.
Keep the guardrail. Then look at what sits under it. Break a live audit chain. Revoke an agent mid-session. Watch the next tool call fail. Demo Center access is free, with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →