Lakera

What is Lakera?

Lakera is a security platform designed for generative AI applications and intelligent agents; it is now part of Check Point’s AI Security product portfolio. By enabling AI asset discovery, risk assessment, runtime safeguards, and red team testing, it helps teams identify and block security risks associated with models before and after deployment.

The existing Lakera Guard functionality of the platform is now presented as AI Guardrails; the development documentation and some technical resources still use the name Lakera. The focus of this product is not on generating content, but rather on checking whether user inputs, model outputs, search results, and tool calls violate security policies.

Current status of the company and its products

In 2025, Check Point announced its intention to acquire Lakera, and the acquisition was completed in the same year. Following this acquisition, Lakera’s security capabilities were integrated into Check Point’s more comprehensive range of AI security products; existing customers could continue to use these functions through the existing consoles and interfaces.

Two types of core products

Companies can deploy runtime safeguards separately, or they can use AI Agent Security, which covers the entire lifecycle of proxy assets. The latter includes safeguard functions and integrates detection, assessment, and continuous protection within a single management process.

AI agent discovery

The agent discovery module connects to the proxy platforms used by enterprises in order to create a unified list of assets. It is able to identify proxies, workflows, tools, data connections, and permission relationships, thereby reducing the issue of teams not knowing which AI agents are currently in use.

• Supports connection to Amazon Bedrock and AgentCore environments.
• It supports checking proxy assets in Google Cloud.
• Supports the Microsoft Copilot Studio workspace.
• Supports Salesforce Agentforce agents.
• Supports n8n automation workflows.
• Supports the Relevance AI agent platform.
• Assets and their risk relationships can be viewed in a unified view.

Proxy risk assessment

Risk assessment involves analyzing agent configurations, permissions, tools, and data access relationships, and it connects various individual issues into actionable risk pathways. The results are sorted by severity, allowing the security team to prioritize those risk combinations that could have a real impact on business operations.

Runtime security safeguards

AI Guardrails carries out real-time screening between applications and models; it can either merely record any risks identified or directly block requests that violate the rules. It is suitable for monitoring user inputs, model responses, search results, tool descriptions, and the outputs provided by tools.

Hints for injection attacks and jailbreak prevention

Prompt Defense is used to detect attempts at direct prompt injection, indirect injection, jailbreaking, and manipulation of system commands. Indirect attacks may be hidden in web pages, files, segments of knowledge bases, or the content returned by tools; therefore, it is necessary to examine each interaction carried out by the proxy.

Content and data protection

• Identify hate, violence, self-harm, sexual content, and other prohibited categories.
• Detect the leakage of personal identity information and sensitive data.
• It reduces the risk of system prompts and internal instructions being stolen.
• Identify malicious links and suspicious redirect destinations.
• Prevent agents from deviating from their authorized tasks or performing unrelated actions.
• Callable capabilities are controlled through the allowlist and blocklist of tools.
• Configure custom safeguards for specific industry and enterprise rules.

Search-enhanced generation and tool invocation protection

In the retrieval-enhanced generation process, the platform can examine the user’s query, the retrieved context, and the model’s final response separately. This allows it to detect both direct attacks by users and hidden malicious instructions in the knowledge base documents.

For agent and tool calls, security checks should be performed before and after each reasoning step, rather than only on the final answer. The tool description, parameters, execution results, and external protocol context can all serve as entry points for indirect prompt injection.

How the Guard API works

Developers submit the messages, roles, and policy information to be checked through the Guard API; the interface returns information indicating any violations as well as the results of the inspection. The application then decides, based on the policies in place, whether to allow access, record the relevant data, provide a warning, or terminate the current interaction.

1. Create a project in the console and obtain access credentials.
2. Select predefined defenses for the application and configure the policies to be implemented.
3. The Guard interface is called before the user input is fed into the model.
4. Check again the search results, tool outputs, and model outputs before moving on to the next step.
5. Read the violation categories and processing results, and apply blocking or downgrade logic.
6. View logs, trends, and false alarms in the console.
7. Adjust strategies and thresholds based on actual business data.
8. Send high-risk events to the enterprise’s security operations process.

Detection mode and forced mode

API and platform capabilities

The current interface is based on the second version of Guard capabilities, and it offers enterprise features such as result querying, policy management, and project management. Self-hosted deployment also provides health checks, configuration checks, and interfaces to determine the readiness of services, which facilitates integration with container orchestration and operation monitoring tools.

Comparison of SaaS and self-hosted solutions

Data areas and language support

For SaaS, processing locations such as the Eastern United States, Western United States, Ireland in the EU, and Singapore in Asia are available; companies can also specify the locations for log storage and processing. Organizations should choose the appropriate location based on requirements related to data retention, cross-border data transfer, and internal compliance rules.

The platform supports over 100 languages, making it suitable for multilingual chatbots and cross-regional agent applications. The accuracy of recognition is influenced by factors such as language, domain, prompt length, and business context; therefore, it is necessary to use one’s own data for evaluation.

AI Red Team Testing

AI Red Teaming is used to automatically attack models, agents, and custom interfaces before they go live or after version updates. It covers the areas of security and responsible AI, and it aggregates the test results into risk scores as well as structured reports that can be exported.

• Test the direct model interface, chat applications, and AI agents.
• Automatically generate and execute various types of adversarial attacks.
• Log attack hints, responses, classifications, and success status.
• It helps to compare the changes in risk across different versions, strategies, and models.
• It supports exporting results as JSON or CSV files.
• Suitable for security reviews, release gatekeeping, and regression testing.

Red Team SDK

Lakera Red offers preview versions of SDKs for TypeScript and Python, which enable the integration of custom applications or internal interfaces into testing tasks. The deployment components use an active outbound connection approach; nevertheless, enterprises should still assess the operating environment, version dependencies, and boundaries of the test data.

1. Prepare test targets and dedicated accounts that are isolated from production.
2. Install the SDK for the corresponding language and configure the testing credentials.
3. Implement a target adapter to send the attack input to the model or proxy.
4. Returns the model output and the necessary operational status.
5. Select the test category, scope, and maximum number of requests.
6. Run the scan and examine successful cases with high risk.
7. Fix suggestions, tool permissions, data access, or safeguard configurations.
8. Run the same test set again to verify the effectiveness of the fix.

Prices and packages

The price information was verified on August 23, 2026; the actual amounts, taxes, exchange rates, and discounts may vary, and the final figures will be those displayed on the settlement page.

Lakera adopts a model that combines a free community tier with custom enterprise contracts. The community version is suitable for prototype testing, while production systems usually require sales engagement based on factors such as the scale of requests, the length of the context, the method of deployment, and the enterprise’s specific requirements.

Corporate security and compliance

The product offers role-based permissions, logging, data retention settings, and security system integration, and it provides clear information regarding its enterprise security and privacy controls. The purchaser still needs to examine the data processing agreements, sub-processors, incident response procedures, and deletion mechanisms in light of their own regulatory obligations.

• Confirm how long the prompt messages, responses, and detection logs are stored respectively.
• Determine the processing area and log area to be used for the project.
• Limit the administrator roles that can view the original interactive content.
• Minimize, mask, or tokenize sensitive fields.
• Integrate high-risk events into the enterprise security information and event management system.
• Establish a retesting process for changes to models, agents, and tools.
• Complete data processing and compliance review before proceeding with the official purchase.

GitHub and the open-source status

The Lakera core platform, the Guard detection model, and the enterprise console are not open-source products. While its official GitHub organization has released demonstration, research, and auxiliary projects, most of the public repositories there have been archived; therefore, it cannot be assumed that these commercial platforms can be deployed on one’s own.

Which users are it suitable for

• Development teams are working on launching large language model applications.
• It is necessary to protect enterprises that use retrieval-enhanced generation for their knowledge bases.
• A security team that manages AI agents and shadow AI assets across multiple platforms.
• Product managers who need to prevent prompt injection, jailbreaking, and data leakage.
• An engineering team aiming to create a platform for modeling and issuing secure access controls.
• Regulated organizations that require self-hosting or a specified data area.
• Consultants specializing in generative AI penetration testing and risk assessment.

Product advantages

• It covers asset discovery, risk assessment, runtime protection, and red team testing at the same time.
• It is able to examine user input, model output, retrieval context, and tool calls.
• It offers both detection and forced operation modes, facilitating phased deployment.
• Supports SaaS and enterprise self-hosted deployments.
• It supports multi-language applications and multiple data processing areas.
• It can be integrated with logging, monitoring, and security operations processes.
• The free community quota is suitable for developers to carry out technical testing first.

Restrictions and Precautions

No security barrier can guarantee the prevention of all unknown attacks, and it is possible for false positives or false negatives to occur. The high detection rates, low latency, and low false positive rates cited by manufacturers are performance metrics achieved under specific testing conditions; they should not be considered as the actual results for all languages, models, and applications.

• The full set of proxy security features may still be available in early access or rolled out in phases.
• There is no fixed public price for the enterprise version; the procurement cost must be assessed separately.
• Each call to the safeguard increases the number of requests, delays, and operational complexity.
• Long contexts, multilingual content, and industry-specific terminology require separate testing.
• Excessively strict custom policies may affect regular users and proxy tasks.
• The self-hosted version requires the customer to handle scaling, monitoring, upgrades, and fault recovery.
• Archived open-source repositories should not be used as proof of ongoing maintenance capabilities.
• Guardrails cannot replace identity permissions, key management, and manual approval.

Recommendations for selection and verification

1. List the models, agents, knowledge bases, and tools that need to be protected.
2. Risk levels are determined based on data sensitivity and execution permissions.
3. A test set is created using real but anonymized historical requests.
4. First, measure false positives, false negatives, and latency in Detect mode.
5. Enable prompt injection, content, data, and tool protection one by one.
6. Add identity verification and manual confirmation for high-risk operations.
7. Run red team tests and save the comparison results between versions.
8. Confirm the monthly request volume, context size, and peak concurrent cost.
9. Evaluate the data boundaries for SaaS-based or self-hosted solutions.
10. Switch to Enforce mode after performing regression testing.

Frequently Asked Questions

What is Lakera called now?

Lakera has been integrated into Check Point, and its core safeguarding capabilities are now provided through Check Point AI Guardrails. Some consoles, documents, SDKs, and historical technical resources still use the Lakera name.

Can Lakera prevent prompt injection?

It is capable of detecting both direct and indirect injection attempts, jailbreaks, and manipulations of system commands, and it can block such requests in policy mode. The actual effectiveness depends on the language, context, policies, and type of attack, so continuous testing is necessary.

What is the data limit in the free version?

The Community plan allows for up to 10,000 screening requests per month, and it is suitable for prototyping and small-scale testing. For the volume of requests, the context, and the functions required for commercial use, a custom contract is necessary.

Is self-hosting supported?

Enterprise clients can discuss self-hosted deployment options, which involve running the Guardrail solution on their own infrastructure and managing policies, logs, and scaling. The specific technical requirements as well as license costs need to be confirmed by the sales team.

Is Lakera an open-source project?

No, commercial guardrails, proxy security platforms, and detection models are all closed-source products. The open-source or archived projects available on the official GitHub include only some research tools, extensions, and demonstration code.

Is it appropriate to protect AI agents?

It is suitable; it can not only examine prompts and responses, but also identify proxy assets, assess permissions and data relationships, and check proxy steps during execution. For high-risk actions, minimum permissions and manual approval should still be required.

Summary

Lakera has evolved from a single large language model-based security tool to part of Check Point’s enterprise AI security framework, covering agent discovery, risk assessment, runtime protection, and automated red team testing. It is suitable for teams that need to integrate generative AI security into their development and security operations processes.

Individual developers can use 10,000 free screening requests per month to test the integration of Guard, while companies need to obtain a quote based on factors such as deployment location, number of requests, and the governance features required. Before making a decision, it is advisable to conduct tests using real business scenarios to assess the accuracy, false positive rates, latency, and costs, and to deploy Guard alongside mechanisms for identity management, access control, approval processes, and monitoring.