Head-to-head · updated 13 September 2026
DataShield vs Prisma AIRS: the firewall says the call was clean, but was it allowed?
Prisma AIRS is Palo Alto's AI security platform, and it is a real one. Six modules ship under that name: AI Gateway, Agent Security, AI Red Teaming, AI Runtime Security, AI Model Security, and AI Posture Management. Their own line is "Discover, assess and protect your entire AI ecosystem from one, unified platform." They scan models, simulate attacks, and block prompt injection inline at a scale we can't match. If a threat is moving through your AI traffic, they are very good at catching it.
We work one floor down. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Every governed tool call is checked against the agent's authority at that moment, and the decision is sealed into a hash chain you can verify without trusting us. Detection asks whether the call was dangerous. We answer whether it was allowed, and prove it later. Most buyers end up wanting both.
The short version
Pick DataShield when
- An examiner, or the EU AI Act's Article 12, will ask you to prove an agent's access log wasn't edited. A logging service can't answer that. Our chain answers it with math. Run the verifier.
- You need to pull an agent's authority mid-session and have the very next tool call fail, not wait for a token to age out.
- Your rule is that the policy engine, the tokens, and the evidence all stay on your own infrastructure, with keys you hold.
- You'd rather not be funnelled into one vendor's whole stack, and you'd like to see a price first.
Pick Prisma AIRS when
- You want inline blocking. Their runtime firewall sits in the path and stops prompt injection, data leakage, and insecure output. We have no inline product and won't pretend otherwise.
- You need AI red teaming. Their module simulates real attacks against your agents and apps to find gaps. We don't do offensive testing at all.
- You need ML model and supply-chain scanning. That's the Protect AI lineage, and it's mature. We never built it.
- You already run Palo Alto. Adding AIRS to an existing agreement is a line item, not a procurement cycle, and that is a genuinely good reason.
Bottom line: Prisma AIRS inspects the traffic and the artifacts. DataShield decides whether the agent was allowed to touch the data, and keeps proof. Run the firewall. Just don't file its logs as your audit trail.
Feature by feature
Competitor cells describe what Palo Alto's public site and docs say as of the date above. If we've mischaracterised something, email support@myorg.ai and we'll correct it, credited.
| What matters | DataShield | Prisma AIRS | Edge |
|---|---|---|---|
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion, or truncation. Public verifier. | Scan results and violations flow to Strata Logging Service, with transaction IDs, session views, and threat snippets. We found no published tamper-evidence mechanism for those logs. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling, a declared authority tier, and a revocation re-check before dispatch. Revocation lands mid-session. | Agent Security "verifies every agent identity" and flags privilege misuse. Identity, not a per-call authority decision. Mid-session revocation isn't described in the docs we read. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It auto-revokes, and it can't be quietly deleted from the log. | Not described in their public docs. Worth asking, since CyberArk brings a long privileged-access lineage into the group. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor identities are HMAC-committed, so the chain still verifies after erasure. | Log retention in Strata Logging Service. We found no per-subject erasure story, and no statement on what erasure does to prior scan records. | ◆ |
| Tokenization and data handling | Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Tokens are deterministic, join-preserving, and vault-reversible, with quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column. | Sensitive-data-leakage detection on traffic in flight. Detection, not tokenization at rest. Raw values stay in the source datasets. | ◆ |
| Inline runtime blocking | No traffic proxy, by design. What we do have: a fail-closed gate on every value that leaves a governed dataset for a prompt, and a PHI dataset refuses any AI endpoint not marked BAA-approved. Datasets are tokenized at ingest, so the model works on tokens. | Two documented modes: API Intercept, which embeds security in your code, and Network Intercept via an AI Runtime Firewall with autoscaling. This is home turf. | ◇ |
| AI red teaming | Not offered. We publish a threat model and a verifier you can attack yourself, which is not the same thing. | A dedicated module that simulates real-world attacks to find gaps across AI agents and applications. | ◇ |
| Model and supply-chain security | Not offered. We govern data and tool calls, not model artifacts. | AI Model Security, built on the Protect AI acquisition that closed in July 2025. Scans models and artifacts for tampering and embedded code. | ◇ |
| MCP and agents | Native MCP endpoints on Auth, Ontology, and Lighthouse. MCP tool tokens with scope ceilings, plus per-call metering attributed to the agent. | MCP threat detection is in the taxonomy, and the docs describe securing agents with a standalone MCP server. It's threat detection on MCP rather than tool-level authority. | ◈ |
| Deployment | Self-hosted in your own cloud or data center, or on a dedicated single-tenant server we operate. Your keys. | Fully managed SaaS is the headline. Palo Alto sells on-prem elsewhere in its portfolio, but we couldn't confirm a self-hosted AIRS option in their public docs. | ◆ |
| Maturity signals | Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so. | Public company. FY2026 revenue $11.48B, Next-Generation Security ARR $9.10B, up 63% year on year. This row isn't close. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Platform is quote-only, with a "Get preview and early access" call to action. The AI Gateway does publish real numbers: free developer tier, $49 a month for the production tier, enterprise custom. | ◈ |
◆ DataShield leads◇ Prisma AIRS leads◈ comparable
Prisma AIRS claims are drawn from paloaltonetworks.com, docs.paloaltonetworks.com, portkey.ai, and Palo Alto's FY2026 results release, last checked 13 September 2026. We link them below rather than paraphrase from memory.
Three things you get here that you won't get from a runtime security platform
Proof that survives an audit
A log that an admin can edit has no evidentiary value. A logging service is built to store logs, not to defend them. Ours is a hash chain with signed checkpoints, and the verifier names what went wrong, not just that something did. That's the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.
Authority that can change mid-flight
An analyst resigns at 2pm. Their agent is 20 minutes into a 40-minute job. With DataShield the next governed tool call is re-checked against current authority and fails closed. Identity verification alone won't catch that, because the identity is still perfectly valid. How Auth does it.
An erasure you can defend
GDPR says delete. Your auditor says keep the log. Crypto-shred settles it: the subject's key material is destroyed, the data becomes unreadable, and the chain still verifies. See the diagram.
Where Prisma AIRS is genuinely stronger
We'd rather you hear this from us than from their rep. Palo Alto has spent real money to build this: $634.5M for Protect AI, which closed in July 2025, Portkey in May 2026, and CyberArk for the identity backbone. The Prisma AIRS AI Gateway went generally available in August 2026 and now carries Portkey's numbers, 3,000-plus GenAI teams and 1,600-plus models. Their inline firewall, red teaming, and model scanning are things we do not do and are not going to do. Behind all of it is a company that just reported $9.10B in Next-Generation Security ARR. If your board wants one vendor with a phone number, that's a defensible choice.
The push-back is narrow and it matters. Detection tells you a call looked dangerous. It doesn't tell you the call was permitted, by whom, under what authority, at that moment. Gartner expects most unauthorized agent transactions through 2028 to be internal policy violations rather than attacks, and a policy violation looks like normal traffic to a firewall because it is normal traffic. Then there's the second problem: when the examiner asks for March, you hand over logs from a logging service, and the only thing backing them is the assertion that nobody edited them.
Questions worth asking both of us
These are the questions we'd want answered if we were buying. Ask them on every vendor call, including ours.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it, checkpoints are signed and chained, and verification tells deletion apart from truncation and from tampering. Run it against a sample chain at /verify. Prisma AIRS: their docs describe scan results, violations, and session views in Strata Logging Service. We found no published tamper-evidence mechanism. Ask them to demonstrate one, and watch whether the answer is about access controls rather than cryptography.
What happens to a revoked agent mid-session?
DataShield re-checks authority on every governed tool call, so revocation takes effect on the very next call. Prisma AIRS says Agent Security verifies every agent identity and detects privilege misuse. That's a different question: a revoked agent still has a valid identity until someone tears it down. Ask how many minutes a pulled agent keeps working.
If we already run Prisma AIRS, why would we add DataShield?
Because the layers don't overlap much. Their firewall governs what flows through the pipe. We govern what the data is and who may act on it: tokenized at ingest, authorized per tool call, sealed into a chain. Most of our design conversations assume a gateway or a runtime firewall is already in place. We are the evidence and authorization layer underneath it, not a replacement for it.
Agents can bypass DataShield entirely. Doesn't that break the model?
Fair, and here's the straight answer. We are not an inline proxy and we don't intercept prompt traffic. Our control point is the data and the MCP tool boundary. An agent that reaches data through our MCP surface gets tokenized data under scope-ceiling authorization with sealed audit. An agent that bypasses everything still finds no raw values in the dataset, because the protection lives in the data rather than in the pipe. For inline blocking and model routing, run a gateway. Prisma AIRS is a good one. What it can't give you is protected data at rest, reversible tokens, tamper-evident evidence, or crypto-shred erasure.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence stays verifiable after the subject is gone. For Prisma AIRS we found log retention settings but no per-subject erasure story. Ask what happens to a year of scan records that contain a subject's data after an Article 17 request.
Does DataShield have SOC 2?
Not yet, and we won't imply otherwise. Palo Alto's compliance posture is far ahead of ours and it would be silly to argue. What we offer instead: Auth is live a public threat model and a verifier anyone can run, Guardian and Lighthouse have been in production since April 2026, and design-partner terms include source escrow so a small vendor isn't a single point of failure. Details on the security page.
- Prisma AIRS hero: "Discover, assess and protect your entire AI ecosystem from one, unified platform." Six modules listed, primary CTA "Get preview and early access." — paloaltonetworks.com, 13 Sep 2026
- AI Runtime Security ships API Intercept and Network Intercept modes; detection covers prompt injection, data leakage, MCP threats, and agent privilege misuse. Results go to Strata Logging Service. — docs.paloaltonetworks.com, 13 Sep 2026
- Palo Alto FY2026: revenue $11.48B, Q4 revenue $3.41B up 34%, Next-Generation Security ARR $9.10B up 63%. The release also flags that Prisma AIRS AI Gateway is now generally available. — Palo Alto Networks press release, 1 Sep 2026
- The former Portkey site now serves the Prisma AIRS AI Gateway: "Observe, govern, and secure every AI interaction across your enterprise. Now generally available." 3,000+ GenAI teams, 1,600+ LLMs. — portkey.ai, 13 Sep 2026
- Gateway pricing is published: free developer tier at 10k logs a month, production at $49 a month, enterprise custom. The AIRS platform itself stays quote-only. — portkey.ai/pricing, 13 Sep 2026
- Palo Alto acquired Protect AI for $634.5M, closed 22 July 2025, folded into the Prisma AIRS platform. — GeekWire, 2025
Other head-to-heads
DataShield vs Protect AI
Model scanning was the acquisition. Agent authority is a different question.
ComplementDataShield vs AI gateways
The gateway governs the pipe. We govern the data.
PlatformDataShield vs Cisco AI Defense
Another network incumbent aiming its stack at agent traffic.
AllEvery comparison
One honest scorecard per vendor, rows we lose included.
See both mechanisms run in your browser: break a live audit chain, revoke an agent mid-session, then decide what your firewall logs are actually worth. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →