Head-to-head · updated 13 September 2026

DataShield vs Lakera: a detector and a control plane are not the same purchase

Lakera built the best prompt-injection classifier on the market. Sub-50ms screening, a false-positive rate around 0.01%, and a training set fed by Gandalf, the game that has collected 80 million-odd community attack prompts. Check Point bought them in September 2025 and, a year on, has kept the Lakera name on Guard, Red, and Gandalf rather than folding them into Infinity branding. If your question is 'is this input malicious', they answer it better than we ever will.

We answer a different question: was this action allowed, on what data, by which agent, and can you prove it later. Datasets are tokenized at ingest, agents query tokenized data over MCP, and every governed tool call is authorized against the agent's current authority, then sealed into a hash chain you can check yourself. This page is mostly about where the two fit together, because for most buyers the answer isn't one or the other.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

Your agents act through MCP tool calls, not just chat. Lakera's published integration covers /v1/chat/completions and states that MCP and A2A aren't supported, so that surface is currently unguarded.
Someone will eventually ask you to prove an access record wasn't edited. Detection dashboards are telemetry. Ours is a hash chain with signed checkpoints and a verifier you can run yourself. Try it.
You need to pull an agent's authority mid-session and have the next tool call fail closed, rather than waiting out a token.
The failure you actually fear is an agent that looks perfectly authorized doing something it shouldn't. A classifier trained on attacks won't flag that.

Pick Lakera when

You need prompt-injection and jailbreak detection, direct or indirect. This is best-in-class and we don't have a classifier at all. Don't buy governance hoping it filters inputs.
Latency in the model path matters. Sub-50ms screening with a very low false-positive rate is hard to build and they've built it.
You want pre-deployment red-teaming. Lakera Red probes your app before launch. We offer nothing comparable.
You're already a Check Point shop and Infinity procurement is the path of least resistance for getting AI security funded this quarter.

Bottom line: these stack. Lakera on top as the attack filter at the model edge, DataShield underneath as the authorization and evidence layer around tool calls. If you can only fund one, ask which failure would hurt more: an injected prompt you didn't catch, or an authorized agent you can't account for.

Feature by feature

Competitor cells describe what Lakera's and Check Point's public materials say as of the date above. If we've mischaracterised something, email support@myorg.ai and we'll correct it, credited.

What matters	DataShield	Lakera	Edge
Prompt-injection detection	None, by design. We're not a detection product and won't pretend otherwise. We constrain what an injected agent can reach and log what it did.	Core strength. Runtime screening of inputs and outputs for direct and indirect injection, with published detection and false-positive figures.	◇
Red-teaming	Not offered. We publish a threat model and a public verifier instead.	Lakera Red does pre-deployment adversarial testing. No equivalent on our side.	◇
Latency in the model path	We don't sit in the model path, so there's nothing to measure. Authorization happens at tool dispatch.	Sub-50ms inline screening, roughly 0.01% false positives, trained on the Gandalf attack corpus.	◇
MCP and agents	Native MCP endpoints on Auth, Ontology, and Lighthouse. MCP tool tokens with scope ceilings, per-tool-call dispatch, metering attributed to the agent.	Their documented LiteLLM integration supports chat completions only and explicitly does not cover MCP or A2A traffic.	◆
Agent authorization	Every governed tool call passes a scope ceiling, a declared authority tier, and a revocation re-check before dispatch. Cedar governs admin, config, and token decisions.	No identity plane. Guard screens content; it doesn't know which agent is calling or what that agent is entitled to do.	◆
Break-glass	Scoped, time-boxed emergency access for agents that auto-revokes and can't be quietly removed from the log.	Not offered.	◆
Audit evidence	SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion, or truncation. Public verifier.	Detection events land in a dashboard. We found no published tamper-evidence mechanism for those logs.	◆
PII handling	Classification catalog, k-anonymity generalization of quasi-identifiers, and deterministic tokenization at ingest. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation.	Inline detection with masking or blocking, using placeholders such as `<EMAIL_ADDRESS>`. One-way by construction, with no vault and no governed reversal.	◆
GDPR erasure	Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor identities are HMAC commitments, so the log survives the erasure intact.	Not a data-residency or erasure product. We couldn't find an erasure story in their public docs.	◆
Deployment	Self-hosted, in your VPC, or BYOC. Your keys.	SaaS API with a self-hosted option for enterprise, plus Check Point Infinity bundling.	◈
Maturity signals	Auth v1.0 live. Guardian and Lighthouse v0.2, in production since April 2026. SOC 2 not yet certified, and we say so.	Founded 2021, acquired by Check Point for roughly $300M in September 2025, now the base of their AI Security Center of Excellence. Enterprise distribution we can't match.	◇
Pricing	Published model, scoped instant quote, no sales wall.	Legacy standalone pricing started around $99/month usage-based. Post-acquisition it's routed through Check Point procurement, and we couldn't find a current published figure.	◆

◆ DataShield leads◇ Lakera leads◈ comparable

Lakera claims are drawn from Lakera's and Check Point's public materials, their LiteLLM integration documentation, and a June 2026 third-party review, last checked 13 September 2026. Sources are linked below.

Three things you get here that you won't get from a detection layer

Coverage of the surface agents actually use

Chat is where people talk to models. Tool calls are where agents touch systems. Lakera's integration covers the first and says it doesn't cover the second. Our MCP tool tokens carry scope ceilings, and dispatch re-checks them on every call. How Auth does it.

Proof, not telemetry

A detection dashboard tells you what was flagged. It says nothing about whether the record was changed afterwards, and that second question is the one an EU AI Act Article 12 or HIPAA §164.312(b) reviewer asks. Ours is a hash chain with signed checkpoints, and the verifier says what went wrong rather than just that something did. Run it in your browser.

Pseudonymization you can reverse under policy

Masking to a placeholder is one-way. That's fine for a log line and useless when an analyst legitimately needs the real value. Our tokens are deterministic, join-preserving, and vault-reversible, and detokenization is logged like the privileged operation it is. The data model.

Where Lakera is genuinely stronger

Their classifier is the real thing. The Gandalf flywheel gives them something most security vendors can only wish for: a continuous stream of adversarial prompts written by humans trying to win a game, retraining the models daily. Independent reviews put them at or near the top on precision, and sub-50ms with a false-positive rate near 0.01% is the combination that makes inline screening survivable in production. Lakera Red covers pre-deployment testing, which we don't do. And Check Point's distribution means a CISO can often get Guard funded faster than a line item from a company they've never heard of. Those are all good reasons to buy them, and a page that pretended otherwise wouldn't be worth your time.

The push-back is about scope, not quality. Gartner expects at least 80% of unauthorized agent transactions through 2028 to be internal policy violations rather than attacks. A classifier trained on attacks is, by construction, blind to the agent that looks entirely legitimate and does something it shouldn't have been allowed to do. Even on the attack side, a 98% detector passes two attempts in a hundred, and the question then is what limits the damage. That's scope ceilings, mid-session revocation, and a log you can prove. Add the MCP gap, which their own integration docs are candid about, and the shape of the pairing becomes obvious: detection on top, governance underneath.

Questions worth asking both of us

Ask both of us these. The answers diverge more than the marketing does.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Records commit forward, checkpoints are Ed25519-signed and themselves chained, and verification comes back with a named failure: tampering, insertion, deletion, truncation. The sample chain at /verify is there to be broken. Lakera: detections are written to a dashboard. We found no published tamper-evidence mechanism. If you're relying on those records for EU AI Act Article 12 logging, ask them what stops an edit.

What happens to a revoked agent mid-session?

We re-read authority at dispatch on each governed tool call, so revocation takes effect one call later, not one token later. Lakera has no identity plane, so the question doesn't really apply to them: Guard screens the content of a request without knowing which agent sent it or what that agent is entitled to do. Worth asking both of us how long a compromised agent keeps working after you pull its access.

How does GDPR erasure interact with the audit trail?

We destroy the subject's key material and issue an ISO 27560 receipt. The chain keeps verifying because the actors in it are HMAC commitments, not names. Lakera's masking is one-way placeholders, which is a different kind of privacy control: there's no vault, so there's nothing to shred and nothing to re-identify under policy. We found no erasure documentation on their side.

Does Lakera Guard screen MCP tool calls?

Not according to their own documentation. The LiteLLM integration supports /v1/chat/completions and states that MCP and A2A traffic aren't covered. That matters because agents cause damage through tool calls, not through the chat box. Ask them directly, and ask for a roadmap date if they say it's coming. Our dispatch pipeline is per-tool-call by construction.

Should we run both, or is this an either/or?

Run both, in most cases. There's almost no mechanism overlap: Lakera classifies content at the model edge, we authorize actions and seal evidence around tool calls. The only place we touch is superficial PII detection, and even there the mechanisms differ (their masking is one-way, our tokenization is vault-reversible). If someone tells you a detection product and a governance product are the same purchase, push back on that, whichever vendor is saying it.

Does DataShield have SOC 2?

No. Auth is v1.0 with a published threat model and a verifier anyone can run; Guardian and Lighthouse are v0.2 and have been in production since April 2026; design-partner terms include source escrow. Lakera sits inside Check Point, so they bring the compliance posture of a large public security company, and weighing that against a vendor you hadn't heard of last month is a reasonable thing to do. Security page.

Lakera Guard, Lakera Red, and Gandalf continue under the Lakera name a year after the Check Point acquisition, with integration into Check Point's AI Security Center of Excellence still underway. — AppSecSanta, 18 Jun 2026
Check Point acquired Lakera for roughly $300M; the deal was reported in September 2025. — AppSecSanta retrospective, 18 Jun 2026
Lakera Guard's published figures: 98%+ detection, sub-50ms latency, ~0.01% false-positive rate, models fed by 80M+ Gandalf attack prompts. — Lakera Guard 2026 review, AppSecSanta, 18 Jun 2026
Lakera's LiteLLM integration supports /v1/chat/completions only and does not support MCP or A2A traffic. — Lakera v2 LiteLLM integration docs, 13 Sep 2026
≥80% of unauthorized agent transactions through 2028 will be internal policy violations rather than attacks. — Gartner, 2026
EDPB names pseudonymization as a GDPR risk mitigation for AI models. — EDPB Opinion 28/2024

Other head-to-heads

Complement

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →