Head-to-head · updated 13 September 2026
DataShield vs F5 AI Guardrails: who proves the agent was allowed to do that?
F5 bought CalypsoAI for $180 million and turned it into a real product. AI Guardrails inspects prompts and responses inline, blocks injection and jailbreaks, moderates output, and flags PII before it escapes. Their red team adds over 10,000 attack patterns a month. Independent testing put security efficacy at 98.2%. And because F5 already sits in the data path at half the banks you can name, the deployment story writes itself. If your problem is bad traffic reaching a model, they are a strong answer.
DataShield sits under that, not next to it. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Every governed tool call is checked against the agent's current authority, and every decision is sealed into a hash chain you can verify yourself. Most teams who talk to both of us end up running both. Here is the honest split, including the rows F5 wins outright.
The short version
Pick DataShield when
- You need to prove an agent's access record was not edited after the fact. F5 names the EU AI Act in three press releases. We map to Article 12 and Article 26 and hand you a verifier. Run it.
- You want to pull an agent's authority mid-session and have the very next governed tool call fail closed, not wait out a token.
- The data itself is the exposure. Tokenize at ingest and the agent's query never held the raw value, so there is nothing for a classifier to miss.
- You'd like a price before you book a call. Ours is published.
Pick F5 AI Guardrails when
- Your risk is prompt injection, jailbreaks and toxic output. That is their home turf and we do not compete there at all.
- You already run F5 in the data path. Guardrails become one more policy on kit you own, with no new proxy hop. The MuleSoft Agent Fabric work makes that point well.
- You want continuous red teaming, with thousands of fresh attack patterns a month feeding straight back into your guardrail policies.
- You need one vendor across air-gapped, on-prem and three public clouds, backed by a public company with thirty years of enterprise support behind it.
Bottom line: F5 inspects the traffic. We authorize the actor and keep proof of what it did. If your board question is "did we block the attack", buy theirs. If it is "can you show the examiner the March logs and prove nobody touched them", start here.
Feature by feature
Competitor cells describe what F5's product pages and press releases say as of the date above. If we've mischaracterised something, email support@myorg.ai and we'll correct it, credited.
| What matters | DataShield | F5 AI Guardrails | Edge |
|---|---|---|---|
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion or truncation. Try the verifier. | "Audit-ready logging" that traces every enforcement action with guardrail attribution, plus SIEM export. We found no cryptographic tamper evidence in their public material. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling, a declared authority tier and a revocation re-check before dispatch. | Secure AI Agents guardrails aim to "prevent excessive agency and privilege escalation" on agent actions and tool use. That is policy on traffic. No authority tier or agent identity model is described. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It auto-revokes and cannot be quietly deleted from the log. | Not offered, as far as we can tell from public docs. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. The chain still verifies after the subject is gone. | GDPR is named as a compliance target. We could not find an erasure mechanism, or any statement about what erasure does to the audit history. | ◆ |
| Data handling | Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Tokens are deterministic, join-preserving and vault-reversible. | Runtime detection and redaction of sensitive data in prompts and completions. Day 1 Compliance Controls ship as expert-built guardrails for PII, PCI and PHI. | ◈ |
| Inline inspection | No traffic proxy, by design. What we do have: a fail-closed gate on every value that leaves a governed dataset for a prompt, and a PHI dataset refuses any AI endpoint not marked BAA-approved. Datasets are tokenized at ingest, so the model works on tokens. | Yes, and it's the core of the product. Inbound prompts and outbound completions inspected before the model is called or the response returned. | ◇ |
| Red teaming | We don't do it. We publish a threat model and a verifier instead. | F5 AI Red Team runs a swarm of attacker agents, with over 10,000 new attack patterns a month feeding back into guardrail policy. | ◇ |
| MCP and agents | Native MCP endpoints on Auth, Ontology and Lighthouse. MCP tool tokens with scope ceilings, and per-call metering attributed to the agent. | F5 AI Gateway added an MCP Gateway in August 2026: server registry, access controls, and audit trails of which agent called which tool. Workforce AI Security inspects tool calls before execution, generally available October 2026. | ◈ |
| Deployment | Self-hosted or dedicated single-tenant. Your keys, including the detokenization keys. | Public cloud, private cloud, on-prem and air-gapped. Red Hat OpenShift certified operator. Hard to beat on reach. | ◇ |
| EU AI Act posture | We map the audit chain to Article 12 logging and Article 26 deployer record-keeping, and say plainly that mapping is our design intent, not a certification. | Named in three press releases and a product video, bundled as a Day 1 Compliance Control. We found no reference to a specific Article anywhere on their site. | ◆ |
| Maturity signals | Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so. | NASDAQ-listed, founded 1996, two AI security acquisitions in a year, 98.2% efficacy in SecureIQLab testing, global support. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | No figures published. A free trial and a "Play demo" button, then a conversation. | ◆ |
◆ DataShield leads◇ F5 AI Guardrails leads◈ comparable
F5 claims are drawn from f5.com product pages and F5's own press releases, last checked 13 September 2026. We link them below rather than paraphrase from memory.
Three things you get here that you won't get from an inline guardrail
Logs an examiner can't argue with
F5 promises audit-ready logging with guardrail attribution. That tells you why a request was blocked, which is useful. It does not tell you whether the record still says what it said in March. Our chain commits each record to the one before it, signs checkpoints, and the verifier names the failure instead of shrugging. EU AI Act Article 12 asks for automatic logging over the system's life. Article 26 puts the keeping of those logs on you, the deployer, for at least six months. Recording is the easy half. Break a live chain in your browser.
Authority that changes mid-flight
A guardrail asks whether this request looks dangerous. It does not ask whether this agent is still entitled to make it. An analyst resigns at 2pm. Their agent is forty minutes into a job. We re-read scope ceiling, authority tier and revocation at every governed dispatch, so the next call fails closed. How Auth does it.
Nothing raw to catch in the first place
Inline detection is a race between a classifier and the data. Win it 98.2% of the time and you still lose eighteen requests in a thousand. We take the data out of the race. Tokens are deterministic and join-preserving, so analytics still work, and the vault holds the mapping under policy. The data model.
Where F5 AI Guardrails is genuinely stronger
Reach and detection, and it isn't close. F5 spent $180 million on CalypsoAI, then bought SurePath AI, then shipped an AI Gateway with an MCP gateway inside it, then federated guardrails into Salesforce's Agent Fabric with no extra proxy hop. That is four moves in twelve months from a company that already terminates traffic for a large slice of the Fortune 500. Their red team generates over 10,000 fresh attack patterns a month and pipes the findings back into policy. They run air-gapped. They run on OpenShift. We do none of that, and a small vendor pretending otherwise would be insulting your intelligence.
The push-back is narrow and it matters. Gartner expects at least 80% of unauthorized agent transactions through 2028 to be internal policy violations, not attacks. An inspector trained on attacks is blind by construction to the agent that behaves perfectly normally and does something it was never entitled to do. Their own chief product officer put it well when he said enterprises run AI "across agents that authenticate and act on their own". Quite. So ask who checked that the agent still had authority at the moment of the call, and ask what stops someone editing the log that says it did. F5 names the EU AI Act more loudly than anyone else in this market, which we respect. We just noticed they never name an Article.
Questions worth asking both of us
Ask both of us these. The answers separate faster than the marketing does.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Records commit forward, checkpoints are Ed25519-signed and themselves chained, and verification returns a named failure: tampering, insertion, deletion or truncation. The sample chain at /verify exists to be broken. F5: their pages promise audit-ready logging, guardrail attribution and SIEM export. We found no tamper-evidence mechanism described. Ask what stops an edit, and ask for the mechanism rather than the log format.
What happens to a revoked agent mid-session?
We re-read authority at dispatch on every governed tool call, so revocation lands on the next call. F5's MCP Gateway applies access controls to agent-to-tool traffic, and Workforce AI Security inspects tool calls before execution from October 2026. We could not find anything about withdrawing one agent's authority while a job is running. Ask both of us how long a compromised agent keeps working after you pull its access, and ask to see it, not hear it.
How does GDPR erasure interact with the audit trail?
We crypto-shred the subject's key material and issue an ISO 27560 receipt. The chain keeps verifying because actors in it are HMAC commitments, not names. F5 lists GDPR among the regimes their telemetry supports. We found no erasure mechanism and no statement on what erasure does to audit history. It's a fair question for any vendor whose answer to compliance is "more logs".
F5 says it aligns AI deployments to the EU AI Act. Doesn't that cover us?
Partly, and we'd rather be precise than snide about it. Article 12 requires automatic recording of events over the system's lifetime. Article 26 makes you, the deployer, keep those logs for at least six months. Inline guardrail telemetry satisfies the recording half. Neither we nor F5 can hand you a certificate, and anyone offering one is selling something. What we add is integrity: a record whose alteration is detectable by a third party who doesn't trust either of us. Across every F5 page and release we read on 13 September 2026, the EU AI Act is named but no Article is cited. Ask them which obligation their logging discharges.
Is F5 AI Guardrails an alternative to DataShield?
Not really, and the overlap is smaller than the category names suggest. They govern the pipe: what enters the model and what comes back. We govern the data and the actor: which tokenized dataset an identified agent may query, under what ceiling, with what sealed afterwards. If a developer drops a database credential into a script, an inline inspector sees nothing and our datasets are still tokenized. If someone slips a jailbreak past our tokenized query surface, we have no opinion about the prompt and F5 does. Run both. We'd rather say that here than have you find out in month four.
Does DataShield have SOC 2?
No, and we won't imply otherwise. F5 is a public company with decades of certifications and we are not going to win that row. What we offer instead: Auth is live a published threat model and a verifier anyone can run, Guardian and Lighthouse have been in production since April 2026, deployment is self-hosted with your keys, and design-partner terms include source escrow so a small vendor isn't a single point of failure. Details on the security page.
- F5 acquired CalypsoAI for $180 million in cash consideration, citing "centralized observability, policy control, and audit logs for GDPR/EU AI Act compliance". — F5 press release, 11 Sep 2025
- F5 AI Security Platform launch bundles AI Guardrails, AI Red Team and SurePath AI, with 98.2% security efficacy in independent testing and guardrails deployed "at the point of interaction". — F5 press release, 22 Jun 2026
- F5 AI Gateway ships a Model Gateway, an MCP Gateway with agent-to-tool audit trails, and Guardrails, with token spend attributed by team and user. — F5 press release, 18 Aug 2026
- F5 Workforce AI Security inspects tool calls across MCP servers before execution and attributes interactions to users and agents. Generally available October 2026. — F5 press release, 9 Sep 2026
- AI Guardrails lists Day 1 Compliance Controls for PII, EU AI Act, PCI and PHI, plus audit-ready logging with guardrail attribution and a threat library adding 10,000+ patterns monthly. — f5.com/products/ai-guardrails, 13 Sep 2026
- ≥80% of unauthorized agent transactions through 2028 will be internal policy violations rather than attacks. — Gartner, 2026
- EDPB names pseudonymization as a GDPR risk mitigation for AI models. — EDPB Opinion 28/2024
Other head-to-heads
DataShield vs HiddenLayer
Model-layer threat defence versus authorization and sealed evidence around tool calls.
ComplementDataShield vs Lasso Security
Fast classifiers on top, and the same question about which layer the obligation lands in.
ComplementDataShield vs AI gateways
The gateway governs the pipe. We govern the data moving through it.
AllEvery comparison
One honest scorecard per vendor, including the rows we lose.
See the two mechanisms F5 doesn't describe: break a live audit chain, then revoke an agent mid-session and watch the next tool call fail. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →