Adversa AI
A research-heavy specialist offering continuous red teaming, with an audit that it says covers the full OWASP LLM Top 10.
Best AI Red Teaming Companies (2026)
This is a comparison of 23 companies that sell AI red teaming: testing LLM apps, models and agents for jailbreaks, prompt injection, data leakage and unsafe behaviour. Vendors are listed alphabetically within three groups (both, automated platform, managed service). Nothing is ranked or scored. Every fact is a vendor claim or a dated press statement, linked to its source, and checked on 2026-11-07.
Of the 23 vendors, 14 sell an automated platform, 5 sell a managed or crowdsourced service, and 4 sell both. 7 have been acquired since 2024. Only 2 publish a dollar price.
How to choose
- Decide what you are testing. A base model, a chatbot, a RAG app and an autonomous agent need different attacks. Most platforms here now advertise agent and MCP testing; the "What it tests" column shows what each one claims.
- Pick a delivery model. Platforms give repeatable, automated runs you can put in CI/CD. Consultancies and crowds give a scoped human assessment and a report. Three vendors sell both. See red teaming vs penetration testing.
- Check the framework mappings you need. If you must show evidence against the OWASP Top 10 for LLM Applications (2025), MITRE ATLAS, NIST AI RMF or the EU AI Act, only use vendors that claim that mapping. See EU AI Act and red teaming.
- Know who owns the vendor. 7 of these companies were acquired since 2024, five of them by network-security vendors and one by a model vendor. That affects roadmap, bundling and independence.
- Expect to ask for a quote. Only 2 vendors publish prices. Free tiers and open-source tools let you trial before you buy. See what AI red teaming costs and open-source tools.
- Keep the red team independent. NIST AI 600-1 (action MS-1.3-003) says to verify that the people running structured human feedback exercises are not involved in developing the same model. An outside vendor is one way to meet that.
Comparison table
Three tables, one per offering type, alphabetical inside each. Scroll sideways on a phone. Abbreviations in "What it tests": JB = Jailbreaks · PI = Prompt injection · AG = Agent / tool abuse · DL = Data leakage · BS = Bias, safety, harmful content · SC = Model supply chain · MM = Multimodal. A mapping is shown only if the vendor claims it on its own pages.
Both (platform + service)
A platform you can run yourself plus expert-led or crowdsourced engagements.
| Vendor | Ownership | What it tests (claimed) | Framework mappings (claimed) | Pricing public? | Free tier | HQ |
|---|---|---|---|---|---|---|
| Adversa AI | Independent (VC-backed) | PI , JB , DL , AG ; Agents and MCP; Adversarial examples; Misinformation; Coding-agent security platform | OWASP LLM Top 10 | No | No | Not stated |
| Gray Swan | Independent | AG ; Tool, MCP, API and file access | None named | No | No | Pittsburgh, PA, US (per press coverage) |
| Lakera | Acquired by Check Point | JB , PI , AG , DL , BS , MM ; Multilingual attacks | None named | No | Unclear | Site lists a San Francisco address (Lakera Inc) |
| Mindgard | Independent | JB , PI , AG , DL , SC , MM ; MCP; Model poisoning; Model extraction | OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF, EU AI Act, ISO 42001 | No | No | Boston, MA, US, with a London office |
Automated platform
Automated attack libraries you run against your own models, apps or agents, often in CI/CD.
| Vendor | Ownership | What it tests (claimed) | Framework mappings (claimed) | Pricing public? | Free tier | HQ |
|---|---|---|---|---|---|---|
| Cisco AI Defense | Robust Intelligence acquired by Cisco | PI , AG , DL , BS , MM , SC ; 200+ attack techniques and subcategories (data sheet); Multimodal attacks in 10 languages; Supply chain is a separate component | OWASP LLM Top 10, OWASP Agentic Top 10, MITRE ATLAS, NIST AI RMF, EU AI Act | No | No | Not stated |
| Enkrypt AI | Acquired by Anaconda | PI , JB , DL , BS , MM ; MCP scanning; Multimodal on higher plans | NIST AI RMF, EU AI Act | Yes | Yes | Brighton, MA, US |
| F5 AI Red Team | CalypsoAI acquired by F5 | PI , JB , DL ; Multi-turn jailbreaks; RAG data leakage | OWASP LLM Top 10 | No | No | Not stated (CalypsoAI was based in Dublin) |
| Giskard | Independent | PI , DL , BS , AG ; Hallucination; RAG quality | OWASP LLM Top 10 | No | Yes | France |
| HiddenLayer | Independent | JB , PI , AG , DL , SC ; Model poisoning; Model extraction | None named | No | No | Austin, TX, US |
| Holistic AI | Independent | PI , JB , BS , AG , DL ; Bias, toxicity and hallucination; Runtime data leakage | NIST AI RMF, EU AI Act, ISO 42001, NYC Local Law 144 | No | No | Not confirmed on an opened page (search results say London) |
| Lasso Security | Independent | PI , JB , AG ; 3,000+ attack library; Tool-chain manipulation; Context poisoning | OWASP LLM Top 10, NIST AI RMF, MITRE (ATLAS not named) | No | Unclear | Not stated |
| Noma Security | Independent (VC-backed) | PI , JB , DL , BS , AG ; Cross-tenant data leakage; Agent supply-chain misconfiguration | OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF, EU AI Act, ISO 42001 | No | No | Not stated |
| Pillar Security | Independent | AG ; Tool orchestration; Permission escalation; Multi-turn attacks | OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF, EU AI Act | No | No | Not stated |
| Prisma AIRS (Palo Alto) | Protect AI acquired by Palo Alto Networks | JB , AG , BS , SC ; 500+ attack vectors across 50+ techniques (docs); Model scanning in Prisma AIRS | OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF | No | No | Not stated |
| Promptfoo | Part of OpenAI | PI , JB , DL , AG , BS ; Direct and indirect prompt injection; PII; Tool misuse, BOLA, SSRF; 50+ vulnerability types | OWASP LLM Top 10, NIST AI RMF, EU AI Act | Yes | Yes | San Francisco, CA, US |
| Repello AI | Independent | PI , JB , DL , AG , MM ; Agents, MCP and RAG; Text, image and audio | OWASP LLM Top 10, NIST AI RMF, MITRE (ATLAS not named) | No | Unclear | Not stated (a Dover, DE address is shown, which looks like a registered agent) |
| SPLX | Acquired by Zscaler | PI , JB , AG ; Agents, MCP and RAG; Guardrail testing; 5,000+ attack simulations | None named | No | Yes | Not stated |
| Straiker | Not stated (appears independent) | PI , AG , DL ; MCP and inter-agent attacks; Goal hijacking | OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF, EU AI Act | No | Unclear | Not stated |
Managed service
Scoped assessments by consultancies or crowdsourced testers, delivered as a report.
| Vendor | Ownership | What it tests (claimed) | Framework mappings (claimed) | Pricing public? | Free tier | HQ |
|---|---|---|---|---|---|---|
| Bishop Fox | Not stated | PI , JB , AG , DL , SC ; Prompt injection including RAG; Model extraction; Poisoning | OWASP LLM Top 10, OWASP ML Top 10, OWASP Agentic Top 10, MITRE ATLAS | No | No | Tempe, AZ, US |
| Bugcrowd | Not stated | PI , DL , AG , BS ; Excessive agency; Poisoning; Bias assessment (separate engagement) | OWASP LLM Top 10, MITRE ATLAS, EU AI Act | No | No | San Francisco, CA, US |
| HackerOne | Not stated | JB , PI , AG , DL , BS | OWASP LLM Top 10, OWASP Agentic Top 10, MITRE ATLAS, NIST AI RMF, EU AI Act | No | No | Not stated |
| NCC Group | Not stated | BS ; OWASP AI/ML and LLM risks; Threat modelling; Secure development lifecycle testing | OWASP LLM Top 10, NIST AI RMF, EU AI Act, ISO 42001 | No | No | Not stated |
| Trail of Bits | Not stated | PI , DL , AG , SC ; Training data and model IP leakage; Provenance, serialization and hardware | None named | No | No | New York mailing address only |
All 23 vendors
Alphabetical. Each card links to a page with the full fact block, ownership history, sources and alternatives.
-
-
Bishop Fox
An offensive-security consultancy with explicit OWASP (LLM, ML, Agentic) and MITRE ATLAS coverage.
-
Bugcrowd
Crowdsourced AI testing that sits alongside its bug bounty and vulnerability disclosure programs.
-
Cisco AI Defense
Red teaming as a validation feature of a broad enterprise AI security suite.
-
Enkrypt AI
Self-serve, credit-priced red teaming and guardrails with a free tier.
-
F5 AI Red Team
Automated red teaming with "agent swarms", sold alongside F5 AI Guardrails.
-
Giskard
Combines LLM quality testing (hallucination, RAG) with automated adversarial probing. It suits teams that want an open-source starting point.
-
Gray Swan
Combines automation with a large crowd of human red teamers, and works on frontier-model pre-release testing.
-
HackerOne
Human-led, crowdsourced adversarial testing on a fixed timeline.
-
HiddenLayer
A broad AI security platform. Red teaming runs as continuous, automated attack simulation alongside model supply-chain scanning and runtime defense.
-
Holistic AI
Suited to buyers whose need is driven by compliance rather than by the security team.
-
Lakera
A GenAI application security specialist, with Guard for runtime and Red for testing, now part of a large network security vendor. It offers both automated and expert-led red teaming.
-
Lasso Security
For buyers who want one platform for both testing and runtime protection of AI agents.
-
Mindgard
A research-rooted vendor offering both continuous automated testing and expert engagements. It names the widest set of frameworks of the independents, including EU AI Act Article 55.
-
NCC Group
A global consultancy whose AI/ML services include red teaming alongside threat modelling and secure development lifecycle work.
-
Noma Security
Red teaming is one module of an AI security platform with runtime detection and response.
-
Pillar Security
Agent-focused; red-team findings feed straight into its runtime guardrails.
-
Prisma AIRS (Palo Alto)
For buyers already on Palo Alto Networks. An attack agent profiles the target application and tailors its attacks, inside a broader AI security platform.
-
Promptfoo
The most widely used open-source LLM red-teaming tool. The paid tiers add dashboards, SSO and continuous monitoring. Buyers should note that it is now owned by a model vendor.
-
Repello AI
A red-teaming-first platform with explicit multimodal (text, image, audio) and MCP/RAG coverage.
-
SPLX
An attack-library-driven automated red-teaming platform aimed at agentic and MCP systems, with a free open-source scanner (Agentic Radar) as an entry point.
-
Straiker
Agent-first automated red teaming.
-
Trail of Bits
Suited to buyers who need supply-chain and infrastructure depth as well as prompt-level testing.
Who is not on this list, and why
- Scale AI: its red-teaming product page no longer exists (scale.com/red-teaming returns 404); red teaming appears only as a capability claim on its GenAI platform page. It mainly serves model developers and government, not enterprises deploying LLM apps.
- Haize Labs: acquired by Beacon Software and turned into an in-house research group. Its site was unreachable and outside sales could not be confirmed.
- Robust Intelligence and Protect AI no longer exist as standalone brands. They appear here as Cisco AI Defense and Palo Alto Networks Prisma AIRS.
- Not researched: Prompt Security (SentinelOne), Aim Security (Cato Networks), WitnessAI, Troj.ai and Virtue AI. No pages were opened for them, so they are not listed.
Full selection rules and sources: methodology.