Lakera Guard is an AI security API that protects LLM applications against prompt injection, jailbreaks, and data leakage in real time.
Lakera was founded in 2021 in Zurich by David Haber (CEO), Dr. Mateo Rojas-Carulla, and Dr. Matthias Kraft — AI researchers with backgrounds at Google and Meta.
The company has 11 PhDs on staff.
Lakera gained widespread recognition for creating Gandalf, an educational game where players try to extract a secret password from an AI through prompt injection.
Gandalf has attracted over 1 million players and generated 80M+ adversarial prompts that feed directly into Lakera’s threat intelligence.
In May 2025, Cisco announced the acquisition of Lakera. The deal brings Lakera Guard, Lakera Red, and the Gandalf community dataset into the Cisco AI Defense portfolio.
The Zurich-based research team continues to maintain Guard’s detection models under Cisco, with new sales now routed through Cisco enterprise procurement.
What is Lakera Guard?
Lakera Guard sits between users and LLMs as a security layer. Every input and output passes through Guard’s detection engine before reaching the model.
If a threat is detected, it flags or blocks the request before the LLM processes it.
The system delivers 98%+ detection rates with sub-50ms latency and false positive rates below 0.5%. It screens content across 100+ languages and scripts.
The detection models learn from 100K+ new adversarial samples each day, drawn partly from the Gandalf community’s 80M+ prompts.
Pick your next step
See alternatives
Compare Lakera Guard side by side with other prompt-injection guardrails before you commit.
→Open-source option
LLM Guard is a free, self-hosted alternative if you prefer to run prompt-injection detection on your own infrastructure.
→Browse the category
See every AI security tool I've reviewed, grouped by guardrail, red-team, and model-scanning use cases.
→Key Features
| Feature | Details |
|---|---|
| Prompt Injection Detection | Direct injection, indirect injection, jailbreak, system prompt extraction |
| Detection Rate | 98%+ across all attack types |
| Latency | Sub-50ms per request |
| False Positive Rate | Below 0.5% in production |
| Language Support | 100+ languages and scripts |
| PII Detection | Identifies and redacts personal data in inputs and outputs |
| Content Moderation | Toxicity, hate speech, violence, custom policies |
| Link Scanning | Flags suspicious URLs outside approved domain lists |
| API Format | OpenAI-compatible chat completions message format |
| Scale | 1M+ secured transactions per app per day |
How the API works
Lakera Guard uses a single endpoint: POST https://api.lakera.ai/v2/guard. Requests follow the OpenAI chat completions message format with roles (system, user, assistant).
Guard screens the last interaction in the message chain and returns a flagged boolean indicating whether a threat was detected.
You can configure projects with specific policies that determine which detectors run. The breakdown parameter returns per-detector flagging details, and the payload parameter returns match locations for PII and profanity.
The four main detection categories are:
- Prompt attacks — prompt injections , jailbreaks, and manipulation attempts
- Data leakage — PII and sensitive information exposure
- Content violation — offensive, hateful, sexual, violent, or vulgar material
- Unknown links — suspicious URLs outside approved domain lists
Lakera Red
Lakera Red is the company’s AI red teaming product. It runs automated attack simulations against your LLM applications to identify vulnerabilities before they reach production. Red teaming results feed back into Guard’s detection models.
Gandalf
Gandalf is Lakera’s interactive game where players try to extract a secret password from an AI through increasingly sophisticated prompt injection techniques. It demonstrates real-world attack patterns and has been used by security researchers, AI engineers, educational institutions, and CTF competitions.
The 80M+ adversarial prompts collected through Gandalf form a unique dataset that informs Lakera’s threat intelligence. The game is free to play at gandalf.lakera.ai.
Getting Started
https://api.lakera.ai/v2/guard with your messages in OpenAI chat completions format. If flagged is true, block the request.Lakera Guard pricing
Lakera publishes a free Community tier on platform.lakera.ai for evaluation and low-volume use. Paid Pro and Enterprise plans are sales-gated — Lakera does not publish per-call or per-seat list prices, and post-acquisition quotes now route through Cisco enterprise sales.
I do not publish dollar amounts for sales-gated tools. To get a quote, sign up at platform.lakera.ai for the free tier or contact Cisco AI Defense for Enterprise pricing. Be ready to share expected request volume per app per day, deployment region (data residency rules), and whether you need on-prem deployment in addition to the managed API.
When to use Lakera Guard
Lakera Guard is built for teams deploying LLM-powered applications that need real-time input/output screening. The API-first design means integration takes minutes rather than weeks.
It works with any LLM — OpenAI, Anthropic, Google, Azure OpenAI, AWS Bedrock, or self-hosted models.
The platform handles high-volume production traffic (1M+ transactions per app per day) with sub-50ms latency, making it practical for customer-facing chatbots and real-time applications.
Lakera alternatives
Lakera Guard’s wedge is sub-50ms latency, 100+ language coverage, and a managed API trained on the Gandalf community dataset. When that managed-API model is not the right fit, these are the closest alternatives:
- LLM Guard — Open-source (MIT) input/output scanner stack from Protect AI. Pick LLM Guard when you need self-hosted runtime guardrails with no data leaving your infrastructure and accept managing the ML inference yourself.
- OpenAI Guardrails — OpenAI’s official tripwire-pattern guardrails for the Assistants and Responses APIs. Better when you are already locked to OpenAI infrastructure and want first-party agent guardrails.
- NeMo Guardrails — NVIDIA’s framework adds dialog-flow control via the Colang language. Choose NeMo when multi-turn conversation modeling matters more than per-request input/output scanning.
- Prompt Security — A managed runtime guardrail service now operated by SentinelOne (acquired May 2025) and integrated into the Singularity Platform. Pick Prompt Security when you are standardized on SentinelOne for endpoint and want AI guardrails in the same stack.
- Knostic — A different problem space: need-to-know access control for enterprise LLMs (Microsoft 365 Copilot, Glean). Pair with Lakera rather than swap; Knostic enforces who can see what, Lakera enforces what the model can be tricked into doing.
- See the full Lakera alternatives guide for a side-by-side comparison table and post-Cisco-acquisition framing.
For a wider catalog, the AI security tools hub groups these by sub-category (runtime guardrails, red teaming, model scanning, access control).
