Head-to-head · updated 13 September 2026
DataShield vs Lasso: a guardrail decides in 5ms, but who proves it a year later?
Lasso sells an AI security platform: discovery, posture, red teaming, runtime enforcement, detection and response. In September 2026 they shipped LEAP, a transformer-free guardrail that runs on plain CPUs and decides in under five milliseconds, and raised $30M led by ClearSky on the back of it. They also publish an open-source MCP gateway and a real MCP security use case. If your question is "is this content or this server dangerous", they answer it faster and cheaper than we can, and they do it in an air-gapped rack.
We answer the next question. Who was the agent, was it still allowed to act, and can you show a regulator that the record wasn't edited afterwards. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Every governed tool call is checked against the agent's current authority and sealed into a hash chain you can verify yourself. Most buyers who ask us about Lasso end up running both, so this page is mostly about which obligation lands in which layer.
The short version
Pick DataShield when
- Someone will ask you to prove an agent's access record wasn't changed. A SIEM export is a copy of a log, not evidence about it. Ours is a hash chain with signed checkpoints and a verifier you can run. Try it.
- You need to pull an agent's authority mid-session and have the next tool call fail closed, instead of waiting out a token.
- The data itself is the risk. We tokenize at ingest, so the agent's queries never touch the raw value, and re-identification is a logged, privileged act rather than a masking rule.
- You want the policy plane, the vault and the evidence on your own infrastructure, with your keys, and a price you can read before a sales call.
Pick Lasso when
- You need prompt-injection, memory-poisoning and jailbreak detection at runtime. Lasso publishes 98.6% accuracy at under 50ms, and LEAP cuts that to under 5ms on a CPU. We have no classifier at all.
- Red teaming before launch matters to you. Their offensive library claims over 3,000 attack types. We offer nothing like it.
- You run air-gapped or GPU-starved. A guardrail with no GPU footprint is a genuinely hard thing to build, and it is the reason DHS and defense buyers show up in their press release.
- You want AI-BOM discovery: an inventory of the models, prompts, tools and MCP servers already in use. We assume you know what you deployed, which is optimistic of us.
Bottom line: these stack cleanly. Lasso on top as the filter that judges content and servers, DataShield underneath as the layer that decides what an identified agent may do and keeps proof it did only that. If you can fund only one, ask which call you would rather explain to an examiner: the attack you missed, or the authorized agent you can't account for.
Feature by feature: AI guardrails and agent governance
Competitor cells describe what Lasso's public site, press releases and open-source repo say as of the date above. If we've mischaracterised something, email support@myorg.ai and we'll correct it, credited.
| What matters | DataShield | Lasso | Edge |
|---|---|---|---|
| Threat detection | None, by design. We don't classify content and won't pretend to. We limit what an agent can reach and record what it did. | Core strength. Prompt injection, memory poisoning and jailbreaks, mapped to MITRE and OWASP. Published figures: 98.6% accuracy, under 50ms per classification. | ◇ |
| Guardrail cost and latency | Nothing sits in the model path, so there's no number to quote. Authorization happens at tool dispatch. | LEAP is transformer-free and CPU-only, under 5ms per decision, with RAPID as a self-hosted judge for harder calls. They claim 570x the cost efficiency of cloud-native guardrails. | ◇ |
| Red teaming and posture | Not offered. We publish a threat model and a public verifier instead. | Automated red teaming with 3,000+ attack types, plus AI-BOM discovery and posture management across models, prompts, tools and MCP servers. | ◇ |
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion or truncation. Public verifier. | "Complete audit trails of every MCP connection and tool call" with SIEM export and compliance reports. We found no published tamper-evidence mechanism for those records. | ◆ |
| Agent authorization | Every governed tool call passes a token scope ceiling, a declared authority tier and a revocation re-check before dispatch. Cedar governs admin, config and token decisions. | Access management and permissions over MCP servers, plus automatic blocking of untrusted or unapproved servers. Policy sits on the connection, not on an agent identity with an authority tier. | ◆ |
| Mid-session revocation | Authority is re-read at dispatch, so revocation lands on the next tool call. An analyst leaves at 14:00 and their agent's 14:02 call fails. | We couldn't find a mid-session revocation mechanism in their public material. Ask them what happens to an in-flight session. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It auto-revokes and can't be quietly removed from the log. | Not described in their public docs. | ◆ |
| PII and tokenization | Classification catalog, quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column, and deterministic, join-preserving, vault-reversible tokens. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. | Inline DLP and masking. Their open-source gateway masks secrets and PII in requests and responses, with a Presidio plugin option. One-way by construction, no vault, no governed reversal. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor identities in the chain are HMAC commitments, so the evidence still verifies after the subject is gone. | GDPR appears as a framework they align to. We found no erasure mechanism described. | ◆ |
| MCP and agents | Native MCP endpoints on Auth, Ontology and Lighthouse. MCP tool tokens with scope ceilings, per-call dispatch, metering attributed to the agent. | A real MCP story: an MIT-licensed open-source gateway that proxies MCP servers, scans server reputation and sanitizes traffic, covering Claude Code and Desktop, Cursor, Windsurf and custom agents. | ◈ |
| Deployment | Self-hosted in your own cloud or data center, or on a dedicated single-tenant server we operate. Your keys. | SaaS and self-hosted, AWS and Azure marketplace listings, a Cloudflare integration, and CPU-only guardrails aimed at air-gapped networks. | ◈ |
| Maturity signals | Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so. | Founded 2023, $30M Series A led by ClearSky in September 2026, Gartner Cool Vendor 2024, named customers including DHS, BMW, Leonardo, eToro and Fiverr, and claimed revenue growth above 500% in a year. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Quote-only, demo-gated. Third-party write-ups on their pricing exist because Lasso doesn't publish any. | ◆ |
◆ DataShield leads◇ Lasso leads◈ comparable
Lasso claims are drawn from lasso.security, their September 2026 funding and LEAP announcement, and their public MCP gateway repository, last checked 13 September 2026. Sources are linked below.
Three things you get here that you won't get from a guardrail layer
Evidence, not a log export
"Compliance-ready audit trails" usually means structured logs you can ship to a SIEM. That proves records were written. It says nothing about whether one was edited on Tuesday. Our chain commits each record to the one before it, signs checkpoints, and the verifier names the failure rather than shrugging. That's the property an EU AI Act Article 12 or HIPAA §164.312(b) reviewer is testing for. Run it in your browser.
Authority that can change mid-flight
A guardrail asks whether this request looks bad. It doesn't ask whether this agent is still entitled to make it. We re-check scope ceiling, authority tier and revocation at every governed dispatch, so pulling access takes effect one call later, not one token later. How Auth does it.
Pseudonymization you can reverse under policy
Masking a value to a placeholder is one-way. Fine for a log line, useless when a fraud analyst legitimately needs the real customer record. Our tokens are deterministic and join-preserving, the vault holds the mapping, and every reversal is logged like the privileged act it is. The data model.
Where Lasso is genuinely stronger
Almost everything on the detection side. LEAP is the most interesting guardrail release of the year: transformer-free, no GPU, under five milliseconds a decision, and deployable in an air-gapped network where a cloud API is simply not allowed. Pair that with RAPID as a self-hosted judge for the hard calls and you get a routing story that most guardrail vendors can't match on cost. Their red-team library claims over 3,000 attack types. Their AI-BOM finds the shadow agents and MCP servers your teams stood up without telling you. Their open-source MCP gateway is MIT-licensed and actually useful, which is more than most vendors give away. And DHS, BMW and Leonardo are references we can't answer with anything except an honest shrug.
The push-back is about scope. Gartner expects at least 80% of unauthorized agent transactions through 2028 to be internal policy violations rather than attacks. A classifier trained on attacks is blind by construction to the agent that looks completely legitimate and does something it was never entitled to do. Even on the attack side, 98.6% means fourteen in a thousand get through, and the question then is what limits the blast radius and what you can show afterwards. Their own MCP page lists access management and audit trails as two of five pillars, which tells you they know the question matters. Our answer is a scope ceiling, a revocation re-check and a chain you can verify. Theirs, as far as we can tell from public material, is a policy proxy and a log shipper. Ask them to prove otherwise, and tell us if they do.
Questions worth asking both of us
Ask both of us these. The answers separate faster than the marketing does.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Records commit forward, checkpoints are Ed25519-signed and themselves chained, and verification returns a named failure: tampering, insertion, deletion or truncation. The sample chain at /verify is there to be broken. Lasso: their MCP page promises complete audit trails, SIEM export and compliance reports. We found no tamper-evidence mechanism described. If you're leaning on those records for EU AI Act Article 12 logging, ask what stops an edit.
What happens to a revoked agent mid-session?
We re-read authority at dispatch on each governed tool call, so the next call fails closed. Lasso can block an unapproved MCP server and enforce policy at the proxy, but we couldn't find anything about withdrawing an individual agent's authority while a job is running. Ask both of us how long a compromised agent keeps working after you pull its access, and ask for the demo, not the slide.
How does GDPR erasure interact with the audit trail?
We crypto-shred the subject's key material and issue an ISO 27560 receipt. The chain keeps verifying because actors in it are HMAC commitments, not names. Lasso lists GDPR among the frameworks they align to; we found no erasure mechanism in their public docs. Their masking is one-way, so there's no vault to shred and nothing to re-identify under policy either.
Is Lasso's MCP gateway an alternative to DataShield?
Not really, and this is the most common mix-up we hear. Their gateway governs the pipe: which MCP servers are allowed, what gets masked in transit, what looks like an injection. We govern the data and the actor: which tokenized dataset an identified agent may query, under what scope ceiling, with what recorded. If a developer adds a direct database credential to a script, a gateway sees nothing and our tokenized datasets are still tokenized. Most teams need both, which is why we say so here rather than making you find out.
Do you tokenize PII before the model sees it, or detect it afterwards?
Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. So there's no raw value in the queryable surface to detect. Lasso works the other way: inline DLP and masking on traffic, with a Presidio plugin in the open-source gateway. That catches free-form text we never see, and it's one-way. Different mechanisms for different failure modes, and worth being clear about which one your obligation needs.
Does DataShield have SOC 2?
No, and we won't imply otherwise. Auth is live a published threat model and a verifier anyone can run; Guardian and Lighthouse have been in production since April 2026; design-partner terms include source escrow. Lasso lists SOC 2 among frameworks they align to, though we couldn't confirm an attestation report in their public material, so ask them for the letter rather than the logo. Security page.
- Lasso's platform page publishes 98.6% threat detection accuracy, under 50ms per classification, 570x cost efficiency versus cloud-native guardrails, and a 3,000+ attack library. — lasso.security/platform/ai-security, 13 Sep 2026
- LEAP is a transformer-free, CPU-only guardrail at under 5ms per decision, announced with a $30M Series A led by ClearSky and customers including DHS, BMW, Leonardo, eToro and Fiverr. — Lasso Security announcement, 3 Sep 2026
- Lasso's MCP security page lists discovery, DLP, access management, audit trails and threat detection, covering Claude Code and Desktop, Cursor and Windsurf. — lasso.security/use-cases/mcp-security, 13 Sep 2026
- Lasso's MCP gateway is MIT-licensed and masks secrets and PII in proxied MCP traffic, with basic, Presidio and Lasso plugin tiers. — lasso-security/mcp-gateway on GitHub, 13 Sep 2026
- Release history: open-source MCP gateway April 2025, Cloudflare integration July 2025, Intent Security framework February 2026, CPU-based guardrails September 2026. — lasso.security/resources, 13 Sep 2026
- ≥80% of unauthorized agent transactions through 2028 will be internal policy violations rather than attacks. — Gartner, 2026
- EDPB names pseudonymization as a GDPR risk mitigation for AI models. — EDPB Opinion 28/2024
Other head-to-heads
DataShield vs Lakera
The other best-in-class classifier, and the same question about which layer the obligation lands in.
ComplementDataShield vs HiddenLayer
Model-layer threat defence versus authorization and sealed evidence around tool calls.
ComplementDataShield vs Docker MCP Gateway
The gateway governs the pipe. We govern the data moving through it.
AllEvery comparison
One honest scorecard per vendor, including the rows we lose.
Keep the guardrail. Then look at what sits under it: break a live audit chain, revoke an agent mid-session, watch the next tool call fail. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →