Loading
One camp owns policy and framework mapping. The other owns runtime guardrails. This page says what each is good at, then where each beats us, then what is actually different here.
Every competitor statement below comes from docs/competitor-analysis.md or from a benchmark in this repository, and the source is named next to the claim. No vendor is scored from its own marketing pages.
Both descriptions are the README’s own, written before this page existed and not softened for it.
Policy, the model registry, framework mapping, and the relationships a buyer already has with an auditor.
Built for the model era. README records no runtime enforcement, no execution paths and no evaluation; the competitor analysis notes this is eroding rather than absolute, with runtime paths appearing across the camp.
The camp a CISO or a compliance lead has usually already bought.
Runtime guardrails, some of them with real depth: sandboxing, adaptive red teaming, network capture.
Thin on compliance framework mapping, and several are locked to one vendor’s model, cloud or security suite.
The camp a platform or security engineer reaches for first.
The analysis also names the alternative that wins most often, and it is neither camp: 6 of 11 vetted senior engineers had already hand-built a guardrail layer inside their employer. Its phrase for that is competing with git init.
Stated before a buyer makes us state it, with the number and the document each one came from.
On indirect injection through tool output, across the same 20 cases, an installed llm-guard scores 81.8% precision against our 66.7%. It raised 2 false positives on the benign half where we raised 5.
benchmarks/agent_security/README.md, Tier BCleanlab, Vectara, Galileo and Patronus all do model-based groundedness scoring, and the competitor analysis records them as benchmarked ahead of our lexical scorer. Its own instruction is not to contest that point in a technical evaluation.
docs/competitor-analysis.md, sections 4.3 and 5Identity, permissions, audit and evaluations arrive bundled with the runtime itself from OpenAI, Microsoft, Anthropic and Google. The analysis assumes Microsoft Entra Agent ID simply wins agent identity, and that the plumbing layer gets commoditised.
docs/competitor-analysis.md, sections 2 and 8Credo AI ships purpose-built policy packs and CE-marking support for EU AI Act filings. All 300 of our framework mappings remain DRAFT, produced from framework texts by engineers and unreviewed by compliance counsel.
docs/competitor-analysis.md, section 5OneTrust has a roughly 14,000-organisation installed base and third-party AI vendor risk workflows. IBM watsonx.governance has AI Factsheets, SR 11-7 model-risk workflows and FedRAMP GovCloud. We have none of that.
docs/competitor-analysis.md, section 5ServiceNow AI Control Tower has around 30 discovery integrations; our discovery is repository and config based. Kosmoy has kernel-enforced sandboxing; we do not sandbox at all. Zenity prevents inline inside Copilot Studio; we have zero coverage of that surface.
docs/competitor-analysis.md, section 5The only vendor named with numbers on this page, because this is the only one we installed and scored ourselves.
Indirect injection through tool output, 20 identical strings: 10 real shapes and 10 benign documents using the same vocabulary.
| Precision | Recall | False positives | False negatives | |
|---|---|---|---|---|
| AgentFox, full detector stack | 66.7% | 100.0% | 5 | 0 |
llm-guard, PromptInjection | 81.8% | 90.0% | 2 | 1 |
Source: benchmarks/agent_security/README.md, Tier B. Every llm-guard figure came from a real PromptInjection().scan() call in a separate interpreter, not from an asserted number.
llm-guard wins precision here by 15.1 points, and that cost is ours to carry. The other three tiers in that suite are reported as outside its design rather than scored as a loss for it, because a stateless text scanner has no tool registry, no capability model and no way to see a structured argument.
Columns are categories. Putting ticks against a named company would mean trusting that company’s marketing page, which we cannot check.
| Capability | GRC governance platforms | Agent-security tools | AgentFox |
|---|---|---|---|
| Policy, registry, framework mapping | Owns it | Thin on it | 300 framework mappings, all DRAFT |
| Runtime enforcement on model traffic | Thin to absent, and eroding | Owns it | Yes, observe mode by default |
| Containment after a detector misses | Not claimed | Detection-led language | 8 of 8 with every detector off |
| Blast-radius analysis of generated SQL | None surveyed | None surveyed | Statement level, real parser |
| Failure attribution across a handoff | None surveyed | None surveyed | Names the step that introduced the value |
| Sandboxed execution | No | Some of the camp | No, and out of scope |
| Estate-scale discovery connectors | Yes, breadth varies | Yes, breadth varies | Repository and config only |
| Low-code and Copilot agent surface | Partly | Covered | Not covered, a stated non-goal |
| Self-host with zero egress | Several are SaaS only | Several are SaaS only | The default |
| Licence | Commercial | Commercial | Apache-2.0, nothing gated |
| Marketplace listing and SOC 2 Type II | Almost all have one | Almost all have one | Neither; 6 of 14 procurement bars met |
“None surveyed” is the competitor analysis speaking about the field it checked, not a claim that nobody anywhere does this. The 8 of 8 figure is the containment benchmark with every detector switched off. The procurement row counts the 14 standard enterprise requirements that document tracks, of which 8 are still open, including SOC 2 Type II, ISO 27001 and an uptime SLA.
Four things, each of which a reader can check in the repository rather than take on trust.
A value that came out of a retrieved document is structurally blocked from an irreversible tool, whether or not any detector fired. Measured with the detectors switched off entirely, which is a total bypass rather than a simulated miss.
It governs OpenAI, Anthropic, LiteLLM and LangChain traffic in the same process, and has no model, cloud or security suite of its own to sell you. A model provider cannot make that claim about its own runtime.
A local install downloads no weights, needs no API key and adds no destination of its own. The competitor analysis records Zenity, Credo AI and OneTrust as SaaS only.
The enforcement path, the policy engine and the audit verifier are all readable. Nothing is behind a licence key and nothing is gated behind a paid tier.
The numbers behind all of this are on the benchmark page, and the mechanism is on the product page.