Head-to-head · updated 13 September 2026
DataShield vs Prisma AIRS: the firewall says the call was clean, but was it allowed?
Prisma AIRS is Palo Alto's AI security platform. It is a real one. Six modules ship under that name. AI Gateway, Agent Security, AI Red Teaming. AI Runtime Security, AI Model Security, and AI Posture Management. Their own line is "Discover, assess and protect your entire AI ecosystem from one, unified platform". They scan models. Same for simulated attacks. They block prompt injection inline. They do it at a scale we cannot match. A threat may move through your AI traffic. They are very good at catching it.
We work one floor down. We tokenize data at ingest. Agents query that tokenized data over MCP. Detokenization is a privileged, audited step. We check each tool call against the agent's authority. That check lands at that moment. We seal the decision into a hash chain. You can verify that chain without trusting us. Detection asks one thing: was the call dangerous? We answer a different question: was it allowed? We prove it later, too. Most buyers end up wanting both.
The short version
Pick DataShield when
- An examiner may ask you to prove an agent's access log wasn't edited. So might the EU AI Act's Article 12. A logging service cannot answer that. Our chain answers it with math. Run the verifier.
- You need to pull an agent's access mid-session. You want the very next tool call to fail. You do not want a token that just ages out.
- Your rule is simple. The policy engine, the tokens, and the proof all stay on your own system. You hold the keys.
- You would rather not get funnelled into one vendor's whole stack. You would like to see a price first.
Pick Prisma AIRS when
- You want inline blocking. Their runtime firewall sits in the path. It stops prompt injection, data leakage, and bad output. We have no inline product. We will not pretend otherwise.
- You need AI red teaming. Their module simulates real attacks against your agents and apps. It finds gaps. We do not do offensive testing at all.
- You need ML model and supply-chain scanning. That is the Protect AI lineage, and it is mature. We never built it.
- You already run Palo Alto. Adding AIRS to an existing deal is a line item, not a new buying cycle. That is a genuinely good reason.
Bottom line: Prisma AIRS inspects the traffic and the artifacts. DataShield decides whether the agent was allowed to touch the data. We keep proof of that call. Run the firewall. Just do not file its logs as your audit trail.
Feature by feature
Competitor cells describe what Palo Alto says. Their public site and docs. We use the date above. If we got something wrong, email support@myorg.ai. We will fix it, and credit you.
| What matters | DataShield | Prisma AIRS | Edge |
|---|---|---|---|
| Audit evidence | A SHA-256 hash chain. Ed25519-signed checkpoints, chained too. It names the failure: tampering, insertion, deletion, or truncation. Try the verifier. | Scan results and violations flow to Strata Logging Service. You get transaction IDs, session views, and threat snippets. We found no public tamper-evidence system for those logs. | ◆ |
| Agent authorization | Each checked tool call passes a scope ceiling. It also passes a set authority tier. We re-check for revocation before dispatch, each time. Revocation lands mid-session. | Agent Security "verifies every agent identity". It also flags misuse of privilege. That is ID, not a per-call authority check. Mid-session revocation is not in the docs we read. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It auto-revokes. No one can quietly delete it from the log. | Not in their public docs. Worth asking about, though. CyberArk brings a long privileged-access lineage into the group. | ◆ |
| GDPR erasure | We crypto-shred per-subject key material. Consent receipts too, per ISO 27560. We HMAC-commit actor identities. The chain still checks out, even after erasure. | Log retention in Strata Logging Service. We found no per-subject erasure story. We also found no note on older scan records. What happens to those after erasure? | ◆ |
| Tokenization and data handling | We tokenize data at ingest. Agents query that tokenized data over MCP. Detokenization is a privileged, audited step. Tokens are deterministic, join-preserving, and vault-reversible. We also generalize quasi-identifiers. Dates become year, decade, or age band. ZIPs shrink to 3 or 4 digits. Phones, SSNs, and emails go partial. Each column gets a measured score. | Sensitive-data-leakage checks run on traffic in flight. That is detection, not tokenization at rest. Raw values stay in the source data. | ◆ |
| Inline runtime blocking | No traffic proxy, by design. What we do have is a fail-closed gate. It blocks each value bound for a prompt. That value never leaves the checked dataset. A PHI dataset refuses any AI endpoint not marked BAA-approved. We tokenize data at ingest. The model works on tokens only. | Two documented modes. API Intercept embeds security in your code. Network Intercept runs via an AI Runtime Firewall, with autoscaling. This is their home turf. | ◇ |
| AI red teaming | Not offered. We publish a threat model and a verifier. You can attack it yourself. That is not the same thing. | A dedicated module simulates real-world attacks. It finds gaps across AI agents and apps. | ◇ |
| Model and supply-chain security | Not offered. We control data and tool calls, not model artifacts. | AI Model Security. Built on the Protect AI deal that closed in July 2025. It scans models and artifacts for tampering and hidden code. | ◇ |
| MCP and agents | Native MCP endpoints on Auth, Ontology, and Lighthouse. MCP tool tokens carry scope ceilings. We attribute per-call metering to the agent. | MCP threat detection is in the taxonomy. The docs describe a standalone MCP server for securing agents. It is threat detection on MCP, not tool-level access. | ◈ |
| Deployment | Self-hosted in your own cloud or data center. Or on a dedicated single-tenant server we run. Either way, you hold the keys. | Fully managed SaaS is the headline. Palo Alto sells on-prem tools elsewhere in its line-up. We could not confirm a self-hosted AIRS option, though. Their public docs do not show one. | ◆ |
| Maturity signals | Auth, Guardian and Lighthouse are live. Guardian and Lighthouse have run since April 2026. SOC 2 is not yet certified. We say so, plainly. | A public company. FY2026 revenue: $11.48B. Next-Generation Security ARR: $9.10B, up 63% year on year. This row is not close. | ◇ |
| Pricing | A public model. A scoped instant quote. No sales wall. | The platform is quote-only. Its call to action reads "Get preview and early access." Even so, the AI Gateway does publish real numbers. A free developer tier. $49 a month for the production tier. Enterprise is custom. | ◈ |
◆ DataShield leads◇ Prisma AIRS leads◈ comparable
Prisma AIRS claims come from paloaltonetworks.com. Also docs.paloaltonetworks.com, and portkey.ai. We also used Palo Alto's FY2026 results release. That check ran on 13 September 2026. We link the sources below. We do not work from memory.
Three things you get here that you won't get from a runtime security platform
Proof that survives an audit
A log an admin can edit has no value. Not as evidence. A logging service stores logs. It does not defend them. Ours is a hash chain with signed checkpoints. The verifier names what went wrong. Not just that something did. That is what EU AI Act Article 12 reviewers care about. Also HIPAA §164.312(b) reviewers. Try it in your browser. No signup needed.
Access that can change mid-flight
An analyst resigns at 2pm. Their agent is 20 minutes into a 40-minute job. With DataShield, we re-check the next tool call. It runs against current access. It fails closed. Identity checks alone will not catch that. The identity is still perfectly valid. How Auth does it.
An erasure you can defend
GDPR says delete. Your auditor says keep the log. Crypto-shred settles it. We destroy the subject's key material. The data becomes unreadable. The chain still checks out. See the diagram.
Where Prisma AIRS is genuinely stronger
We would rather you hear this from us. Not from their rep. Palo Alto has spent real money to build this. Protect AI cost them $634.5M, closed in July 2025. Portkey came in May 2026. CyberArk gave them the identity backbone. The Prisma AIRS AI Gateway went generally available in August 2026. It now carries Portkey's numbers. 3,000-plus GenAI teams. 1,600-plus models. Their inline firewall is not our product. Neither is red teaming, or model scanning. We are not going to build them. Behind all of it is a company. It just posted big numbers. Its Next-Generation Security ARR hit $9.10B. Maybe your board wants one vendor with a phone number. That is fair. It is a defensible choice.
The push-back is narrow, but it matters. Detection tells you a call looked dangerous. It does not tell you who could make that call. It does not tell you under what authority. Or at what moment. Gartner expects a shift by 2028. Most unapproved agent actions will be internal policy breaks. Not attacks. A policy break looks like normal traffic to a firewall. That is because it is normal traffic. Then there is a second problem. The examiner asks for March. You hand over logs from a logging service. The only thing backing those logs is your word. Nobody edited them, you say.
Questions worth asking both of us
These are the questions we'd want answered. If we were buying. Ask them on each vendor call, including ours.
Can you prove with math that an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it. We sign and chain the checkpoints. Verification tells deletion apart from truncation, and from tampering. Run it against a sample chain at /verify. Prisma AIRS: their docs describe scan results and violations. They also describe session views in Strata Logging Service. We found no public tamper-evidence system. Ask them to show you one. Watch whether the answer is about access controls, not cryptography.
What happens to a revoked agent mid-session?
DataShield re-checks access on each checked tool call. Revocation takes effect on the very next call. Prisma AIRS says Agent Security verifies every agent identity. It also flags misuse of privilege. That is a different question. A revoked agent still has a valid identity. Someone has to tear it down. Ask how many minutes a pulled agent keeps working.
We already run Prisma AIRS. Why add DataShield?
Because the layers do not overlap much. Their firewall controls what flows through the pipe. We control what the data is. We control who may act on it. Tokenized at ingest. Authorized per tool call. Sealed into a chain. Most of our design talks start with a given. A gateway, or a runtime firewall, is already in place. We are the proof and authorization layer underneath it. We are not a replacement for it.
Agents can bypass DataShield entirely. Doesn't that break the model?
Fair, and here is the straight answer. We are not an inline proxy. We do not intercept prompt traffic. Our control point is the data. Also the MCP tool boundary. An agent reaches data through our MCP surface. It sees tokens. Only tokens. That comes under scope-ceiling authorization, with sealed audit. An agent that bypasses everything still finds no raw values. None sit in the dataset. The protection lives in the data, not the pipe. For inline blocking and model routing, run a gateway. Prisma AIRS is a good one. But it cannot give you protected data at rest. It cannot give you reversible tokens. It cannot give you tamper-evident proof, or crypto-shred erasure.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject key material. We issue an ISO 27560 consent receipt. We also HMAC-commit actor identities in the chain. That way, the subject can vanish. The proof still checks out. For Prisma AIRS we found log retention settings. But we found no per-subject erasure story. Ask what happens to a year of scan records. Ask about ones holding a subject's data. Ones tied to an Article 17 request.
Does DataShield have SOC 2?
Not yet, and we will not imply otherwise. Palo Alto's compliance stance is far ahead of ours. It would be silly to argue. What we offer instead: a public threat model. Also a verifier anyone can run. Guardian and Lighthouse have run live since April 2026. Design-partner terms include source escrow. That way, a small vendor is not one point of failure. Details on the security page.
- Prisma AIRS hero: "Discover, assess and protect your entire AI ecosystem from one, unified platform." Six modules listed, primary CTA "Get preview and early access." - paloaltonetworks.com, 13 Sep 2026
- AI Runtime Security ships API Intercept and Network Intercept modes; detection covers prompt injection, data leakage, MCP threats, and agent privilege misuse. Results go to Strata Logging Service. - docs.paloaltonetworks.com, 13 Sep 2026
- Palo Alto FY2026: revenue $11.48B, Q4 revenue $3.41B up 34%, Next-Generation Security ARR $9.10B up 63%. The release also flags that Prisma AIRS AI Gateway is now generally available. - Palo Alto Networks press release, 1 Sep 2026
- The former Portkey site now serves the Prisma AIRS AI Gateway: "Observe, govern, and secure every AI interaction across your enterprise. Now generally available." 3,000+ GenAI teams, 1,600+ LLMs. - portkey.ai, 13 Sep 2026
- Gateway pricing is published: free developer tier at 10k logs a month, production at $49 a month, enterprise custom. The AIRS platform itself stays quote-only. - portkey.ai/pricing, 13 Sep 2026
- Palo Alto acquired Protect AI for $634.5M, closed 22 July 2025, folded into the Prisma AIRS platform. - GeekWire, 2025
Other head-to-heads
DataShield vs Protect AI
Model scanning was the deal. Agent access is a different question.
ComplementDataShield vs AI gateways
The gateway controls the pipe. We control the data.
PlatformDataShield vs Cisco AI Defense
Another network incumbent aiming its stack at agent traffic.
AllEvery comparison
One honest scorecard per vendor, rows we lose included.
See both mechanisms run in your browser. Break a live audit chain. Revoke an agent mid-session. Then decide what your firewall logs are really worth. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →