Head-to-head · updated 13 September 2026
DataShield vs Protect AI: scanning the model, or proving what the agent did?
Protect AI made ML supply-chain security a real category. They coined MLSecOps. Guardian shipped next, to scan model artifacts for embedded code. They built Recon to red-team AI systems. They ran huntr, the first bug bounty platform for AI and ML. Palo Alto Networks bought them for $634.5M in July 2025. Today protectai.com redirects to the Prisma AIRS page. Guardian and Recon live on as AI Model Security and AI Red Teaming.
We don't scan models. Nor do we red-team them. We govern what an agent may do with your data, and we keep proof. We tokenize datasets at ingest. Agents query tokenized data over MCP. Detokenization is a checked, special step. Below is where the two fit together, and the rows where they win.
The short version
Pick DataShield when
- An examiner, or the EU AI Act's Article 12, will ask you to prove an agent's access log wasn't edited. A scan report says the model was clean in March. It doesn't say what the agent read in June. Run the verifier.
- You need to pull an agent's authority mid-session and have the very next tool call fail, not wait for a token to expire.
- The data the agent touches is PII or PHI, and you'd rather it query tokens than raw values. How that works.
- You want a vendor you can buy on its own, self-host, and price from a public page.
Pick Protect AI when
- You're pulling models off Hugging Face and need to know none of them carry a malicious payload. Palo Alto scans 35+ model file types for 25+ threat categories. We do none of that.
- You want adversarial testing, not just controls. Their red teaming runs 50+ techniques mapped to OWASP Top 10 and NIST AI RMF, with multi-turn attacks added in 2026.
- You already run Palo Alto. The AI security line rides your existing contract, channel, and support relationship.
- You want the huntr researcher community and Advanced WildFire threat intel feeding your model scans. That's scale we can't match.
Bottom line: Protect AI tests whether your AI can be broken. DataShield decides whether the agent was allowed and proves it afterwards. Those are different jobs, and plenty of teams should buy both.
Feature by feature
Competitor cells describe what Palo Alto's public site and Protect AI's surviving docs say. This is as of the date above. Did we get something wrong? Email support@myorg.ai. We will correct it, and credit you.
| What matters | DataShield | Protect AI | Edge |
|---|---|---|---|
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints. The checkpoints are chained too. The check names the failure: tampering, insertion, deletion, or truncation. Try the verifier. | Scan reports and findings history. We found no public cryptographic tamper evidence for runtime logs. | ◆ |
| Agent authorization | Every checked tool call passes a scope ceiling, an access tier, and a revoke check. This happens before dispatch. | Red teaming tells you which agent behaviours are reachable. Per-call access checks are not named in the Protect AI lineage. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It auto-revokes and can't be quietly deleted from the log. | Not offered. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material, plus ISO 27560 consent receipts. The audit chain still checks out after erasure. | Not a data-subject product. No erasure method is named. | ◆ |
| Tokenization and data handling | We tokenize datasets at ingest. Agents query tokenized data over MCP. Detokenization is a checked, special step. Tokens are deterministic, join-preserving, and vault-reversible. We generalize quasi-identifiers too. Dates go to year, decade, or age band. ZIPs go to 3 or 4 digits. Phones, SSNs, and emails get partially masked. Each quasi-identifier column gets a measured cardinality-reduction score. | Scans model artifacts, not your records. No tokenization layer in this lineage. | ◆ |
| Model supply-chain scanning | None. We assume you got the model from somewhere sensible. | Guardian's heir scans models in place. It runs at selection or predeployment, across 35+ file types, for 25+ threat categories. It is backed by Advanced WildFire and huntr intel. | ◇ |
| Red teaming | None. We publish a threat model and a verifier you can attack yourself. | Recon's heir stress tests agents against thousands of scenarios. It uses 50+ methods, mapped to OWASP Top 10 and NIST AI RMF. | ◇ |
| MCP and agents | Native MCP endpoints on Auth, Ontology, and Lighthouse. MCP tool tokens carry scope ceilings. Per-call metering ties back to the agent. | MCP threat research and webinar content. Clear per-tool-call controls were not detailed on the pages we read. | ◆ |
| Open source | No open-source product today. A public verifier and a public threat model instead. | ModelScan is Apache-2.0 and still up. LLM Guard, the Layer lineage, got archived on 9 July 2026. It is no longer maintained. | ◇ |
| Deployment | Self-hosted, in your own cloud or data center. Or a dedicated single-tenant server we operate. Your keys. | Delivered as part of Prisma AIRS. Palo Alto's SaaS and hybrid options apply. Standalone Protect AI deployment is gone. | ◆ |
| Independence | Buy one module. Run it yourself. Design-partner terms include source escrow. | Protectai.com now redirects to Palo Alto's Prisma AIRS page. There is no separate Protect AI product, brand, or SKU to buy. | ◆ |
| Maturity signals | Auth, Guardian, and Lighthouse are live in production. Guardian and Lighthouse have run since April 2026. SOC 2 not yet certified, and we say so. | Founded 2022. Acquired for $634.5M by a public company with a global enterprise sales force. Nobody gets fired for this one. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | No public pricing at any point. The Prisma AIRS page still leads with "Get preview and early access". | ◆ |
◆ DataShield leads◇ Protect AI leads◈ comparable
Protect AI claims come from Palo Alto Networks' AI security pages, and the July 2025 acquisition release. Also the surviving Protect AI open-source repositories. Last checked 13 September 2026. We link them below rather than paraphrase from memory.
Three things you get here that you won't get from a model scanner
Proof that survives an audit
A clean scan report tells you the artifact was safe. It says nothing about the call an agent made last Tuesday. Our log is a hash chain with signed checkpoints. The verifier names what went wrong, not just that something did. That's the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser. No signup.
Authority that can change mid-flight
An analyst leaves. Their agent is still running a 40-minute job. With DataShield, we re-check the next governed tool call against current access. It fails closed. Red teaming would have found that the agent could make the call. It can't stop it. How Auth does it.
An erasure you can defend
GDPR says delete. Your auditor says keep the log. Crypto-shred settles it. We destroy the subject's key material. The data becomes unreadable. The chain still checks out. See the diagram.
Where Protect AI is genuinely stronger
We would rather you hear this from us. Protect AI did the unglamorous work first. Pickle files can run code. Almost nobody was checking. Guardian checked. They built huntr and paid researchers to break AI systems in public. That produced real threat intel, not a marketing deck. Recon turned that into automated red teaming. Inside Palo Alto it now runs 50+ methods, mapped to OWASP and NIST. That's a scale a startup can't fund. Say your risk is the model you just downloaded. Go buy that. We have nothing to sell you there.
The push-back is about what a finding does next. Red teaming ends with a report. It says an agent can be talked into calling a tool it shouldn't. Somebody still has to make that call fail. Somebody still has to prove, months later, which calls were allowed. Gartner expects most unauthorized agent transactions through 2028 to be internal policy violations, not attacks. A policy violation looks perfectly normal to a scanner. Here is the other thing worth naming. The version of Protect AI you liked is not for sale any more. Protectai.com redirects to a platform page with an early-access button. LLM Guard was archived in July 2026. If you came here searching for a Protect AI alternative, that's probably why.
Questions worth asking both of us
These are the questions we'd want answered if we were buying. Ask them on each vendor call, including ours.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it. Checkpoints are signed and chained. The check tells deletion from truncation from tampering. Run it on a sample chain at /verify. Protect AI: their lineage is scanning and testing. We found no public tamper-evidence method for runtime logs. Ask Palo Alto to show one.
What happens to a revoked agent mid-session?
DataShield re-checks access on each checked tool call. So a revoke lands on the next call. Protect AI's heritage products don't sit in the call path. So the answer there depends on whatever Prisma AIRS agent security does today. Ask how long a compromised agent keeps working after you pull its access.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed. The evidence still checks out after the subject is gone. Protect AI does not hold subject data. So this question really goes to whoever stores your records.
Can I still buy Protect AI on its own?
Not as far as we can tell. Protectai.com 301-redirects to Palo Alto's Prisma AIRS page. The names Guardian, Recon, and Layer no longer appear in the product line. The functions survive as AI Model Security and AI Red Teaming inside the platform. If a standalone SKU exists, ask your rep to put the line item in writing. Our page on Prisma AIRS covers the platform itself.
Is DataShield a replacement for model scanning?
No, and anyone who tells you otherwise is selling. We never look inside a model file. That's not our job. We govern the data an agent can reach. We record the decision. Most teams shipping agents on regulated data need both. A scanner at build time. An authorization layer at run time.
Does DataShield have SOC 2?
Not yet, and we will not imply otherwise. Auth is live, with a public threat model and a verifier anyone can run. Guardian and Lighthouse have run in production since April 2026. Design-partner terms include source escrow. A small vendor is then not a single point of failure. Details on the security page.
- Palo Alto Networks completed its acquisition of Protect AI on 22 July 2025. The technology becomes "a cornerstone of Palo Alto Networks' Prisma AIRS". - Palo Alto Networks press release, 22 Jul 2025
- Total consideration for Protect AI was $634.5M ($607.4M cash plus $27.1M in replacement awards). - Palo Alto Networks FY2025 Form 10-K, SEC
- Protectai.com now returns a 301 redirect to Palo Alto's Prisma AIRS page. The Protect AI brand no longer has a product site. - protectai.com, checked 13 Sep 2026
- AI Model Security scans 35+ model file types, for 25+ categories of threats. It uses intel from Advanced WildFire and the huntr community. - paloaltonetworks.com, 13 Sep 2026
- AI Red Teaming covers "50+ techniques mapped to OWASP Top 10 and NIST AI RMF". This is the Recon lineage. - paloaltonetworks.com, 13 Sep 2026
- LLM Guard was archived on 9 July 2026 and is "no longer under active development or maintained". - github.com/protectai/llm-guard, 13 Sep 2026
- At least 80% of unauthorized agent transactions through 2028 will be internal policy violations rather than attacks. - Gartner, 2026
Other head-to-heads
DataShield vs Prisma AIRS
The platform Protect AI was folded into, scored on its own terms.
AdjacentDataShield vs HiddenLayer
Model threat detection above. Agent authorization underneath.
AdjacentDataShield vs Lakera
Guardrails catch the prompt. We decide the call and keep the proof.
AllEvery comparison
One honest scorecard per vendor, sources at the bottom.
See both mechanisms run in your browser. Break a live audit chain. Revoke an agent mid-session. Then decide what your scanner still leaves open. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →