Document 2 of 4 · Adversarial testing / AI red teaming
Adversarial testing for LLM apps and agents: requirements, vendors, gaps
- Contents: 11 use cases, 48 requirements, 14 acquisitions (Aug 2024 to Sep 2026), vendor matrix, bake-off shortlist, 10 market gaps
01Scope & definition
- Definition: AI adversarial testing (AI red teaming) is pre-release and continuous attack simulation against an AI-enabled system to find exploitable behavior.
- Target types: model endpoint, LLM app, RAG system, tool-using agent, MCP server, multi-agent workflow.
- SSDLC placement: P6 (Test & verify) as a release gate; P8 (Operate) as scheduled regression against staging or production.
- CAISI agent-hijacking evaluations: adaptive red-team attacks 81% success against agents vs 11% for baseline attacks; success rises with repeated attempts.
- CISA/NSA Careful Adoption of Agentic AI (May 2026): calls for adversarial testing during development.
- SSDF 218A PW.3.3: requires adversarial samples in testing.
- NIST AI RMF MEASURE 2.7: adversarial test results are the evidence for this subcategory.
| In scope | Out of scope |
|---|---|
| Automated and human-guided attack generation against the whole system: prompts, retrieved content, tool outputs, memory, other agents | Model benchmarks (leaderboard safety scores do not cover the app's tools, data and permissions) |
| Pass/fail at a gate, with reproducible transcripts and tool traces | Runtime guardrails (F1), which block attacks inline |
| Mapped to OWASP LLM / ASI / MCP Top 10, MITRE ATLAS, NIST AI RMF MEASURE 2.7 | DAST and pentest of web, API and identity flaws (D3) |
02Use cases
- 11 enterprise use cases.
- Priority split: UC-1 to UC-4 P1; UC-5 to UC-9 and UC-11 P2; UC-10 P3.
| ID | Use case | Primary owner | Risk focus | Outcome / acceptance | Priority |
|---|---|---|---|---|---|
| UC-1 | Pre-release red team of a customer-facing chat / RAG app | AppSec, product owner | LLM01, 02, 05, 07, 08, 09 | Release gate: no open Critical/High; ASR below threshold per objective | P1 |
| UC-2 | Tool-using agent (internal or customer-facing) | AppSec, platform eng | ASI01, 02, 03, 05, 06; LLM06 | Proof that no attack causes an unauthorized tool side effect (write, send, pay, delete, exfiltrate) | P1 |
| UC-3 | CI/CD regression gate on prompt, model, tool or config change | Dev teams, DevSecOps | All, as regression | A smoke suite under 30 min fails the build on regressions; nightly full suite | P1 |
| UC-4 | Guardrail / AI firewall efficacy validation | Security architecture | LLM01, 02; ASI01 | Block rate and false-positive rate of runtime guardrails (F1) measured before purchase and after each policy change | P1 |
| UC-5 | Third-party MCP server & tool onboarding | Platform eng, TPRM | MCP03, 04, 05, 06, 07; ASI04 | Gate for the private MCP registry (G2): no tool poisoning, injection, over-scope or rug pull | P2 |
| UC-6 | Model selection or model swap due diligence | AI platform team | LLM01, 09; AI 600-1 | Candidate models compared on the deployed system prompt and tools before switching | P2 |
| UC-7 | Continuous red teaming of production / staging | SecOps, AppSec | All | Weekly scheduled runs; drift alerts when ASR rises | P2 |
| UC-8 | Coding agents and internal copilots | Developer platform | LLM01; ASI01, 02, 05 | Repo-borne and docs-borne injection does not lead to secret access or code execution | P2 |
| UC-9 | Multimodal and voice agents (contact center, document intake) | CX engineering | LLM01 (multimodal), LLM02 | Image, document and audio-borne injection; PII leakage on voice channels | P2 |
| UC-10 | Multi-agent / A2A workflows | Platform eng | ASI07, 08, 10 | Injection that propagates between agents; cascading failure containment | P3 |
| UC-11 | Compliance evidence | GRC | NIST AI RMF MEASURE 2.7; EU AI Act; ISO 42001 | Exportable, framework-mapped test evidence per AI system and release | P2 |
03Threat & test catalog
- 13 attack classes, cross-referenced to OWASP LLM (2025), OWASP ASI, OWASP MCP Top 10 and MITRE ATLAS.
| Attack class | Test techniques | OWASP LLM (2025) | OWASP ASI | OWASP MCP | MITRE ATLAS |
|---|---|---|---|---|---|
| Direct prompt injection & jailbreak | Role-play, encoding/obfuscation, multilingual, many-shot, crescendo / multi-turn escalation | LLM01 | ASI01 | — | AML.T0051, AML.T0054 |
| Indirect prompt injection | Payloads planted in RAG documents, web pages, email, tickets, images, PDFs, tool outputs | LLM01 | ASI01, ASI06 | MCP06, MCP10 | AML.T0051.001 |
| Hidden context / system prompt extraction | Instruction leakage, tool schema and secret discovery | LLM07 | — | MCP01 | AML.T0056 |
| Sensitive data exfiltration | PII/PHI/PCI leakage; cross-user/tenant data; markdown-image and URL exfil channels | LLM02 | ASI02 | MCP10 | AML.T0057 |
| Tool misuse & excessive agency | Unauthorized tool calls, harmful arguments, chaining low-risk tools into high-impact actions | LLM06 | ASI02 | MCP02 | AML.T0053 |
| Identity & privilege abuse | Confused deputy, acting beyond the invoking user, token replay | LLM06 | ASI03 | MCP07 | — |
| Unexpected code execution | Agent-generated code / shell / SQL reaching interpreters | LLM05 | ASI05 | MCP05 | AML.T0050 |
| Memory & context poisoning | Persisting malicious instructions across sessions or users | LLM04, LLM08 | ASI06 | — | AML.T0070 |
| Tool / MCP supply chain | Poisoned tool descriptions, rug pulls, typosquatted servers | LLM03 | ASI04 | MCP03, MCP04, MCP09 | AML.T0010 |
| Inter-agent & cascading failure | Spoofed agent messages, injection propagated across agents | — | ASI07, ASI08, ASI10 | — | — |
| Human trust exploitation | Agent persuades a user to approve a harmful action | LLM09 | ASI09 | — | — |
| Harmful / off-policy content & misinformation | Toxicity, regulated advice, brand harm, hallucinated commitments | LLM09 | — | — | — |
| Unbounded consumption | Token or cost amplification, recursive loops, denial of wallet | LLM10 | ASI08 | — | AML.T0034 |
- ATLAS technique IDs not yet verified against the ATLAS v2026.06 data release.
04Requirements
- 48 requirements in 8 groups (TGT, ATK, AGT, EVL, OPS, RPT, SEC, COM).
- 32 MUST: failing any one disqualifies a vendor unless roadmapped with a contractual date.
- Each requirement traces to a POC test case (TC-xx) in doc 4, or to contract, proposal, demo or diligence review.
| ID | Requirement | Priority | Verified by |
|---|---|---|---|
| TGT · Target integration | |||
| TGT-01 | Connect to any HTTP/REST/GraphQL/WebSocket/SSE target with a configurable request/response mapping. No vendor SDK should be required in the app. | MUST | POC TC-01/02 |
| TGT-02 | Handle real authentication: OAuth2 client credentials + token refresh, OIDC user login, session cookies, mTLS, API keys from a vault | MUST | TC-01 |
| TGT-03 | Maintain stateful multi-turn sessions (conversation IDs, server-side memory) and reset state between attacks | MUST | TC-02 |
| TGT-04 | Drive a real browser UI for apps without a clean API (clicks, file upload, streaming render) | SHOULD | TC-03 |
| TGT-05 | Native adapters for agent frameworks and platforms: OpenAI Agents SDK, LangGraph, Bedrock AgentCore, Microsoft Foundry / Copilot Studio, Google ADK | SHOULD | TC-04 |
| TGT-06 | Act as an MCP client to test MCP servers directly, and as a malicious MCP server or tool to test agents | MUST | TC-16/17 |
| TGT-07 | Inject attacker-controlled content into indirect channels: seed RAG documents, mailboxes, tickets, web pages and tool responses | MUST | TC-08/09 |
| TGT-08 | Multimodal inputs (image, PDF, audio) and voice / telephony targets | COULD | TC-21 |
| TGT-09 | Throttle per target (RPS, concurrency, token budget) to cap load on staging and model spend | MUST | TC-27 |
| ATK · Attack coverage | |||
| ATK-01 | Single-turn library covering jailbreak, encoding/obfuscation and multilingual attacks, with a documented update cadence and provenance | MUST | TC-05 |
| ATK-02 | Adaptive multi-turn attacker (crescendo, tree/iterative search) that adjusts to target responses | MUST | TC-06 |
| ATK-03 | Context-aware attack generation: profiles the target's purpose, tools and data, and generates business-specific objectives | MUST | TC-07 |
| ATK-04 | Indirect prompt-injection campaigns through every channel in TGT-07 | MUST | TC-08/09 |
| ATK-05 | Data exfiltration objectives including markdown image, link, tool-argument and DNS/HTTP out-of-band channels | MUST | TC-10 |
| ATK-06 | Custom attacks and objectives authored as code/config and versioned with the app | MUST | TC-22 |
| ATK-07 | Multi-attempt execution (k attempts per objective) and reporting of pass@k, per the CAISI methodology | MUST | TC-14 |
| ATK-08 | Bring-your-own attacker model (including self-hosted) | SHOULD | TC-28 |
| ATK-09 | Harmful-content and policy-violation objectives configurable to the organization's content policy | SHOULD | TC-05 |
| AGT · Agentic depth | |||
| AGT-01 | Observe and assert on actual tool calls and arguments, not only response text | MUST | TC-11 |
| AGT-02 | Detect real side effects via canaries / honeytokens and out-of-band callbacks, which give a deterministic oracle | MUST | TC-12 |
| AGT-03 | Test permission boundaries: attempts to exceed the invoking user's authorization (OBO / confused deputy) | MUST | TC-13 |
| AGT-04 | Memory and cross-session poisoning tests | SHOULD | TC-15 |
| AGT-05 | Mock or sandbox tools with behavior, not just static stubs, so destructive paths can be tested safely | SHOULD | TC-11 |
| AGT-06 | Multi-agent / A2A scenario testing | COULD | TC-20 |
| AGT-07 | Report coverage: which tools, permissions and data flows were exercised vs. available | SHOULD | TC-19 |
| EVL · Evaluation & scoring | |||
| EVL-01 | Configurable judges (LLM and deterministic detectors) per objective; judge prompt and model visible and editable | MUST | TC-23 |
| EVL-02 | Published or demonstrable judge accuracy against human labels; agreement (Cohen's κ) measured in the POC | MUST | TC-23 |
| EVL-03 | Attack Success Rate with confidence intervals; repeatability across runs reported | SHOULD | TC-14 |
| EVL-04 | Severity scoring mapped to the organization's risk model; supports OWASP AIVSS | SHOULD | TC-24 |
| EVL-05 | Human review workflow: confirm, dismiss and annotate; dismissals persist across runs | MUST | TC-24 |
| OPS · CI/CD & lifecycle | |||
| OPS-01 | CLI + API; test suites as config-as-code in the app repo | MUST | TC-25 |
| OPS-02 | Pipeline gate with thresholds per objective/severity; exit codes; GitHub Actions / GitLab / Jenkins / Azure DevOps examples | MUST | TC-25 |
| OPS-03 | Regression baselining: diff findings between versions (new / fixed / regressed) | MUST | TC-26 |
| OPS-04 | Scheduling for continuous runs against staging/prod with alerting on drift | SHOULD | TC-26 |
| OPS-05 | Reproducible replay of any finding (exact transcript, seed/config, target version) | MUST | TC-14 |
| RPT · Reporting & integration | |||
| RPT-01 | Map findings to OWASP LLM 2025 (and 2026), OWASP Agentic ASI01–10, OWASP MCP Top 10, MITRE ATLAS, NIST AI RMF | MUST | TC-24 |
| RPT-02 | Full evidence per finding: transcript, tool-call trace, retrieved content, judge rationale | MUST | TC-24 |
| RPT-03 | Ticketing (Jira, ServiceNow), SIEM export, SARIF/JSON export | SHOULD | TC-25 |
| RPT-04 | Actionable remediation: prompt hardening, tool scoping, guardrail policy suggestions | SHOULD | TC-24 |
| RPT-05 | Closed loop to runtime guardrails, preferably vendor-neutral (can feed a third-party guardrail) | COULD | TC-24 |
| SEC · Platform security & deployment | |||
| SEC-01 | Deployment options: SaaS with region pinning, customer VPC, or self-hosted; air-gapped if a regulated workload requires it | MUST | TC-29 |
| SEC-02 | SSO (SAML/OIDC), SCIM, RBAC by team/app, immutable audit log | MUST | TC-29 |
| SEC-03 | Customer data and transcripts are not used for vendor model training; retention is configurable; DPA available | MUST | Contract |
| SEC-04 | Containment: the tester's own attacker agent can't reach unintended systems (egress allowlist, kill switch) | MUST | TC-30 |
| SEC-05 | SOC 2 Type II / ISO 27001; pen-test report; SBOM for the product | MUST | Contract |
| COM · Commercial & viability | |||
| COM-01 | Transparent pricing unit (per app/target, per scan, per seat) with model token costs predictable or included | MUST | Proposal |
| COM-02 | Roadmap commitments for 2026 frameworks (OWASP LLM 2026, Agent Control Standard), A2A, voice | SHOULD | Demo |
| COM-03 | Ownership stability: acquisition status, product continuity commitments and exit/data-export terms | MUST | Diligence |
05Market landscape (Oct 2026)
- 14 AI red-teaming / AI-security startups acquired between Aug 2024 and Sep 2026; 5 of them in 2026.
- Ownership and continuity check per vendor: requirement COM-03.
| Target | Acquirer | Announced | Product today |
|---|---|---|---|
| Robust Intelligence | Cisco | Aug 2024 | Cisco AI Defense (algorithmic red teaming) |
| Protect AI | Palo Alto Networks | Jul 2025 | Prisma AIRS AI Red Teaming (Recon) |
| Invariant Labs | Snyk | Jun 2025 | Snyk agent-scan (ex mcp-scan) |
| Prompt Security | SentinelOne | Aug 2025 | Prompt AI Red Teaming (GA RSAC 2026) |
| Aim Security | Cato Networks | Sep 2025 | Runtime / SASE; red teaming unconfirmed |
| CalypsoAI | F5 | Sep 2025 | F5 AI Red Team |
| Lakera | Check Point | Sep 2025 | Check Point AI Red Teaming (ex Lakera Red) |
| Pangea | CrowdStrike | Sep 2025 | Falcon AIDR (runtime) |
| SPLX | Zscaler | Nov 2025 | Zscaler Automated AI Red Teaming |
| Promptfoo | OpenAI | Mar 2026 | promptfoo OSS + Enterprise; OSS license unchanged |
| TrojAI | A10 Networks | Jun 2026 | TrojAI Detect / Defend |
| Enkrypt AI | Anaconda | Aug 2026 | Enkrypt red teaming + MCP scanning |
| Virtue AI | Fortinet | Aug 2026 | VirtueRed / VirtueGuard |
| Haize Labs | Beacon Software | Sep 2026 | Team became internal research group; customer continuity undisclosed |
- Segment 1, independent specialists: Mindgard, Straiker, Gray Swan, Pillar, HiddenLayer, Lasso.
- Segment 2, platform-bundled: red-team modules paired with the same vendor's runtime guardrail.
- Segment 3, hyperscaler: tools scoped to the provider's own platform.
- Segment 4, open source: promptfoo, PyRIT, garak, DeepTeam, AgentDojo / Inspect, Snyk agent-scan.
- Gartner: "AI security testing" at the Innovation Trigger of the AppSec Hype Cycle.
- No Forrester Wave or Gartner Magic Quadrant exists for this category as of Oct 2026.
06Vendor matrix
- Source of capability data: vendor material and trade press.
- MUST requirements verified in the vendor demo (doc 3) and POC (doc 4).
- Agentic depth scale: Low, Medium, High; n/p = not published.
| Vendor / product | Deployment | Targets | Agentic depth | CI/CD | Runtime loop | Framework mapping | Notes | Open verification items |
|---|---|---|---|---|---|---|---|---|
| Independent specialists | ||||||||
| Pillar Security — RedGraph | SaaS | Agents through the real app UI, tools, MCP, knowledge bases | High: agents chain tool calls into exploits; video evidence of real command execution | Version-controlled suites | Pillar runtime guardrails | OWASP LLM + Agentic, ATLAS, NIST AI RMF, SAIL | Regression baselining (stable / new / hardened / regressed per finding, Aug 2026); only reviewed vendor with it. Gartner Cool Vendor, AI Software Security, Jul 2026. | VPC deployment option |
| Straiker — Ascend AI | SaaS; SDK / sensors; AWS Marketplace | Web apps, agentic workflows, coding and productivity agents | High: IPI, MCP tool misuse, exfiltration | Native hooks trigger on prompt/model/config change | Defend AI (closed loop) | OWASP, ATLAS, NIST, EU AI Act, STAR | Closed loop red team → Defend AI runtime; $64M Series A (Jun 2026) | Customer references |
| Mindgard | SaaS; Docker; API | Models, agents, apps (recon + agent profiling) | Medium-high | CI/CD + Burp Suite integration | Runtime protection, AI-BOM | n/p | 150+ public vulnerability disclosures (e.g. Cursor). Gartner sample vendor for AI security testing; Gartner Top-Funded AI TRiSM (Jan 2026). $30M Series A (Aug 2026). | Agent tool-call assertion depth; framework mapping |
| Repello AI — ARTEMIS | Enterprise (deployment n/p) | Browser-driven UI testing, files, voice, images; 100+ languages | Medium-high: multi-stage chained exploits | Yes | ARGUS runtime | ATLAS, OWASP, NIST, ISO 42001, EU AI Act | Browser-driven UI and voice target support | Attack volume figures (vendor-claimed) |
| HiddenLayer — Automated Red Teaming | SaaS | Models, GenAI apps, agents | Medium | Pre-launch integration | AISec runtime, Agentic Runtime, coding-agent harness security | OWASP-mapped | Model scanning + runtime + red team in one platform | $100M round (reported by a single source) |
| Gray Swan — Shade | n/p | Models, agents | Medium-high | Pre-deployment + CI/CD | Cygnal runtime | n/p | Attack corpus from Arena (15k+ researchers); cited in frontier-lab system cards | Enterprise app adapters |
| Adversa AI | n/p | Agents, MCP, multi-agent | High (vendor-claimed): GH, tool misuse, memory poisoning, multi-agent | n/p | Coding-agent runtime | Listed in OWASP Agentic solutions guide | Claims multi-agent scenario testing | Product vs services mix |
| Giskard — Hub 3.0 + OSS | SaaS (EU sovereignty) + OSS | Any JSON API, agents | Medium: per-turn checks in multi-turn scenarios | Upload from OSS library | — | n/p | Security + quality testing; EU data residency | Agent side-effect detection |
| Platform-bundled (pairs with the vendor's runtime guardrail) | ||||||||
| Palo Alto — Prisma AIRS AI Red Teaming | SaaS; public + private endpoints | Models, apps, agents | Medium-high: agent profiles target tools first; MT since Feb 2026 | Templates; OAuth2 refresh | Prisma AIRS runtime + Portkey gateway | OWASP, NIST AI RMF | Unit 42 / Huntr threat intel; suite includes model scanning, gateway, endpoint (Koi) | Pricing within Prisma AIRS bundle |
| Zscaler — Automated AI Red Teaming (SPLX) | SaaS; REST connectors | Chat apps; multimodal incl. voice | Medium | Yes; Jira / ServiceNow | SPLX prompt hardening + Zscaler guardrails | 8 frameworks: ATLAS, NIST, OWASP, SAIF, EU AI Act, ISO 42001, DORA, DASF | Compliance-framework reporting | Agent tool depth (less documented) |
| F5 — AI Red Team (CalypsoAI) | Customer cloud tenant or on-prem OpenShift | Models, apps, agents | Medium: agent swarm, MT | Daily CI/CD | Findings convert directly to F5 AI Guardrails | n/p | Self-hosted in customer cloud tenant or on-prem OpenShift | Closed loop requires F5 AI Guardrails |
| Cisco — AI Defense | SaaS | Models, agents | Medium: poisoned tools, unauthorized tool use | n/p | AI Defense runtime; AI BOM; MCP Catalog | NIST, OWASP, MITRE | Galileo (evals) + Splunk; NeMo integration | Agent test depth |
| Check Point — AI Red Teaming (Lakera) | SaaS | LLMs, agents, RAG, MCP | Medium | n/p | AI Guardrails (Lakera Guard) | n/p | Gandalf attack corpus | Product name (sourced from competitor material) |
| SentinelOne — Prompt AI Red Teaming | SaaS | In-house AI apps | Medium | n/p | Prompt runtime + agent security | n/p | Part of SentinelOne platform | GA Mar 2026 |
| Fortinet (Virtue AI) / A10 (TrojAI) | Cloud, on-prem, edge / sovereign | Models, apps, agents; multimodal | Medium | n/p | VirtueGuard / TrojAI Defend | Broad (Virtue) | Air-gapped / sovereign deployment | Integration status after 2026 acquisitions |
| Hyperscaler | ||||||||
| Microsoft — Foundry AI Red Teaming Agent | Local (PyRIT) or Foundry cloud | Foundry models & agents | Low-medium: agentic categories cloud-only; no non-Azure tools, browser, computer-use | SDK | Azure AI Content Safety / Prompt Shields | Risk categories, ASR | Foundry-native | Foundry targets only; English-only for some categories |
| Open source baselines | ||||||||
| promptfoo (OpenAI) | Self-hosted (MIT) | HTTP, browser, RAG, agents, MCP, voice | Medium-high | YAML config in PRs | — | OWASP LLM, OWASP Agentic, NIST, EU AI Act | MIT license unchanged after acquisition | Owned by OpenAI since Mar 2026 |
| PyRIT (Microsoft) | Self-hosted (MIT) | Any target via orchestrators/converters | Medium (scenarios v1.x, Jul 2026) | CLI pyrit_scan | — | Scorers; custom | Research toolkit (orchestrators, converters, scorers) | Engineering effort to operate |
| garak (NVIDIA) | Self-hosted (Apache-2.0) | Model endpoints | Low | CLI | — | Probe taxonomy | Model-level scanning | Not agent-stateful |
| DeepTeam (Confident AI) | Self-hosted (Apache-2.0) + SaaS | Any callback | Medium: agentic module | Python | Guardrails | Explicit OWASP ASI 2026 mapping | Agentic taxonomy module | Callback-level, not UI |
| AgentDojo / Inspect | Self-hosted (MIT) | Simulated tool-using agents | Research benchmark | — | — | CAISI method | Benchmark methodology | Not a product |
| Snyk agent-scan | CLI (Apache-2.0) | MCP servers, skills | Static/dynamic MCP scan | CLI | — | — | Applies to UC-5 MCP onboarding | Not a red-team tool |
- Not shortlisted, governance-led: Lasso, Cranium (Arena), Holistic AI.
- Not shortlisted, harmful-content focus: Alice (formerly ActiveFence).
- Not shortlisted, ownership change: Haize Labs (acquired by Beacon Software, Sep 2026; customer continuity undisclosed); Enkrypt (acquired by Anaconda, Aug 2026).
- Not shortlisted, runtime / posture with no verified red-teaming product: Noma, Zenity, Operant, WitnessAI.
- AWS and Google: no first-party automated red-teaming product.
07Shortlist
- Format: 4 commercial vendors plus an OSS control group.
- Selection criteria: requirement coverage in §04 and vendor matrix data in §06.
| Slot | Shortlisted | Basis | Alternate (condition) |
|---|---|---|---|
| 1 · Agentic depth specialist | Pillar Security (RedGraph) | Agent exploitation through the real app UI with video evidence; regression baselining (OPS-03); Gartner Cool Vendor 2026 | Self-hosted required (SEC-01) → F5 AI Red Team |
| 2 · Closed-loop agent specialist | Straiker (Ascend AI) | MCP tool misuse, IPI and exfiltration tests; testing triggered on prompt/model/config change; Defend AI runtime loop | Voice or UI-only targets → Repello ARTEMIS |
| 3 · CI/CD + researcher-grade | Mindgard | CI/CD and Burp Suite integration; 150+ public vulnerability disclosures; Gartner sample vendor | Arena attack corpus → Gray Swan |
| 4 · Incumbent platform module | Red-team module from the existing SASE/firewall vendor: Prisma AIRS, Zscaler, F5, Cisco or Check Point | Closed loop to the same vendor's runtime guardrail | No incumbent → slot dropped, or Zscaler (8-framework compliance mapping) |
| Control group | promptfoo + PyRIT (OSS), run internally | OSS baseline; commercial tools compared against it on recall, effort and evidence | — |
- Bake-off: 4 vendors plus OSS control group.
- Test targets: internally built, seeded reference targets (not vendor demo apps).
- Decision metrics: recall, precision, agentic side-effect detection, regression capability, effort (doc 4 §7).
08Market gaps
- 10 capabilities not observed, or observed in at most a few, of the reviewed vendors and OSS tools.
| # | Capability | Evidence |
|---|---|---|
| G1 | Stateful agent testing with real tool side-effect detection | Most reviewed tools grade response text. Microsoft Foundry cannot test non-Azure tools, browser or computer use, and its mock tools cannot mock behavior. UK AISI had a containment incident in its own agent evaluations. |
| G2 | Coverage metrics | Vendors publish attack counts ("10k/month", "15M vectors"). No reviewed vendor reports coverage of the target's tools × permissions × data flows. |
| G3 | Judge reliability | Every reviewed product uses LLM-as-judge; none publishes calibrated accuracy against human labels. Microsoft documents that ASR is non-deterministic. |
| G4 | MCP dynamic testing & rug-pull detection | Products scan tool descriptions. Dynamic server testing exists only in single-maintainer OSS. Enkrypt found 73% of scanned MCP servers vulnerable. |
| G5 | Multi-agent / A2A | Only Adversa and DeepTeam (recursive hijack) claim it. No reviewed tool tests at the A2A protocol level. |
| G6 | Regression baselining | Only Pillar has versioned per-finding baselines. |
| G7 | Reproducibility | No reviewed vendor publishes seed/replay guarantees. |
| G8 | Interactive (manual) workbench | No reviewed product offers an intercept / replay / mutate workbench for LLM, MCP or A2A traffic equivalent to Burp Suite for web apps. Mindgard offers a Burp Suite integration. |
| G9 | 2026 framework mapping | Few reviewed vendors map to OWASP LLM 2026 or the Agent Control Standard / AgBOM. |
| G10 | Air-gapped options | Only F5, A10/TrojAI, Fortinet/Virtue and OSS tools offer it. |
09Sources
- CAISI agent hijacking evaluations
- CAISI large-scale agent red teaming competition
- OWASP GenAI Red Teaming Guide
- OWASP AI Testing Guide
- Palo Alto completes Protect AI acquisition
- Prisma AIRS AI Red Teaming
- Cisco / Robust Intelligence
- Snyk / Invariant Labs
- SentinelOne / Prompt Security
- SentinelOne AI red teaming GA (RSAC 2026)
- Cato / Aim Security
- F5 / CalypsoAI
- F5 AI Red Team
- Check Point / Lakera
- CrowdStrike / Pangea
- Zscaler / SPLX
- Zscaler automated AI red teaming
- OpenAI / Promptfoo
- promptfoo red team docs
- A10 / TrojAI
- Anaconda / Enkrypt AI
- Fortinet / Virtue AI
- Beacon / Haize Labs
- Pillar RedGraph
- Pillar Gartner Cool Vendor 2026
- Straiker Ascend AI
- Straiker Series A
- Mindgard Series A
- Mindgard / Gartner AI TRiSM
- Mindgard / Gartner AppSec Hype Cycle
- Repello ARTEMIS
- HiddenLayer automated red teaming
- Gray Swan Series A
- Adversa AI
- Giskard Hub 3.0
- Microsoft Foundry AI Red Teaming Agent
- PyRIT scenarios (Jul 2026)
- NVIDIA garak
- DeepTeam
- AgentDojo (NeurIPS 2024)
- UK AISI evaluation containment incident (CSA)