10 Best LLM Security Tools in 2026 (Open Source to Enterprise)

TL;DR

• Architecture and agent assessment, the newest category and the one the rest of this list does not cover: Trent (ours), for teams running agents that hold credentials and call tools.
• LLM guardrails, for teams that need something in the request path: Lakera Guard, Guardrails AI, NVIDIA NeMo Guardrails. Prompt Security sits beside them as workforce GenAI control.
• LLM red teaming and probing, for finding failures before release: Garak, PyRIT, Promptfoo, Mindgard.
• Probing answers how the model behaves, not what your agents can reach.
• Model and runtime protection, for watching models and agents in production: HiddenLayer.
• Two open-source picks for a small team: Garak to probe the model you ship, Promptfoo to run those checks in CI. Both free, both shipped a release in September 2026.
• Check ownership before you buy: Check Point owns Lakera Guard, Prompt Security ships inside SentinelOne Singularity, and Promptfoo now says it is part of OpenAI.
• The OWASP grid below is our own mapping, not a vendor-certified one.

What is an LLM security tool?

An LLM security tool finds, blocks or tests the ways a large language model application can be attacked, misused or made to leak, covering the model, the prompts around it and the agents acting on its output. This tooling grew up around the model: a guardrail reads text in the request path, a red team probes how the model behaves under attack, and both treat the model as the thing to watch. What teams ship now is a system: agents holding real credentials, calling tools, reaching MCP servers and databases. So the question moved: it is no longer just what the model can be made to say, it is what the system can be made to do, and you answer that by reading the architecture, every agent, tool, skill and MCP server, and what each one can read, write, execute and reach. Four jobs sit under that one label, and few products do more than one of them well.

Assess the architecture: work out what the agents, tools, skills and MCP servers can reach before anything runs.

Guard inputs and outputs: screen prompts and responses in the request path, and stop the ones that break policy.

Attack it before someone else does: fire jailbreaks, injections and leakage attempts at a running model, then report what worked.

Watch the model and agents at runtime: detect attacks, drift and misuse in production.

How we chose

Of course Trent is on this list, and not only because you are reading the Trent blog. We list what every tool does, who owns it now and when it last shipped, ours included, and we say where each one fits next to the others.

Every tool here had to be maintained, carry a license and a price we could check, and describe a capability its own vendor or repo documents.

Maintained means a release or a push on the repo for open source, and a current vendor page for a commercial product. Checkable means we read the license file and the pricing page rather than a summary. Documented means the vendor or the repo says it, not a review site. The last test: the tool addresses a named OWASP LLM risk, or the vendor describes the work in terms a security engineer would recognize.

This is a categorized shortlist, not a scored ranking: no independent testing, no weights. We checked every fact on primary pages in September 2026, and prices, versions and licenses drift.

Comparison table: ten LLM security tools at a glance

Licenses, prices, release dates and status (checked September 2026). “No public price” means nothing is published, not that it is expensive.

Architecture and agent assessment

An LLM application is an architecture, not a prompt. Architecture and agent assessment answers what the system can be made to do, not what a single prompt returns. Once you have an agent with a tool list, a set of skills and two or three MCP servers, that means what those components can reach, and which of those paths a stranger can start. Terms here are defined in our agentic AI security glossary; the server side is covered in MCP security. Access facts (checked September 2026).

1. Trent. Trent is an AI Security Engineer. Point it at your source and it reconstructs your architecture from the real code, then inventories every agent, tool, skill and MCP server, tagging each by what it can actually do: Read, Write, Execute, Exfiltrate. It draws the capability graph, every agent, the tools it calls and the dependencies those reach, and traces each attack chain through your real components. Trent hands you the fix, your coding agent applies it, and Trent confirms it landed. It runs over MCP inside Claude Code, Codex, Cursor and most MCP-capable editors, and against a live app from its URL alone, no code access. Trent works before anything runs, so it does not sit in the request path. That makes it the layer guardrails and red-team tools assume someone else has done: it tells you which agents need a guardrail in front of them and which paths are worth probing, then pairs with whichever guardrail or probe you already run. Access and pricing available on request. Request access.

LLM guardrails tools

A guardrail sees the request path. What an agent can reach behind it is a different question. LLM guardrails screen what goes into the model and what comes back out, blocking or rewriting the prompts and responses that break your policy. The mechanics are in our explainer on what LLM guardrails are. Four entries here: three application guardrails, plus Prompt Security, which governs workforce GenAI use rather than your own request path. Licenses, versions and prices (checked September 2026).

2. Lakera Guard. A model-agnostic guardrail that screens application prompts and responses for prompt injection, data loss and unsafe output. Check Point acquired Lakera, announcing the agreement on 16 September 2025 and, per its FY2025 Form 20-F, completing the deal on 22 October 2025, with total consideration reported at about $201.8 million. Check Point’s Lakera documentation now also covers discovery and inventory of agents, tools and MCP servers. It runs as SaaS or self-hosted, and the pricing page publishes a Community tier at no cost, capped at 10,000 requests a month with a token cap, and quote only above that. Lakera Red is a separate red-team product, so check which one a quote covers. Best for teams that want screening hosted or self-run.

3. Guardrails AI. Open-source validation of what goes into and out of an LLM, built around a Hub of named validators you compose into a guard: PII, jailbreak and prompt injection detection, toxic language and more. guardrails-ai/guardrails is Apache-2.0 and free, with about 7,500 stars, v0.11.0 released on 14 August 2026 and a push on 25 September 2026. Hosted remote validator inference was discontinued and the validators moved to public PyPI packages, so plan to run them yourself. Its validator Hub lists the checks that exist today. Best for teams that want to pick individual checks rather than buy a policy engine.

4. NVIDIA NeMo Guardrails. A toolkit for programmable rails on an LLM conversation: you write the allowed and disallowed flows instead of tuning a classifier. NVIDIA-NeMo/Guardrails is Apache-2.0, free, about 7,200 stars, v0.24.1 released on 16 September 2026. It does not test a model you hold an API key for, so pair it with a probe. Best for conversation-level policy expressed as code a reviewer can read.

5. Prompt Security. Workforce GenAI control: visibility over how employees use GenAI apps, which is a different job from guarding your own product’s request path. SentinelOne signed a definitive agreement to acquire it on 5 August 2025, and its 8-K records the close on 5 September 2025, at a total consideration reported as about $180 million. It now ships inside SentinelOne Singularity, so it is no longer a standalone purchase. No public pricing, no public version. Best for governing how employees use GenAI apps, a different job from securing the agents you build.

LLM red teaming tools

Red teaming answers how the model behaves under attack, not what the system can do once it acts. It means attacking the model on purpose before release: firing jailbreaks, injections and leakage attempts, then recording what got through. Four here, three of them open source. Licenses, versions and stars (checked September 2026).

6. Garak. NVIDIA/garak probes a live model for prompt injection, jailbreaks, data leakage, hallucination and misinformation, then hands you a report of which probes landed. Apache-2.0, free, about 9,400 stars, v0.17.0 on 9 September 2026. NVIDIA maintains it, and the README tells old clones to repoint origin at the NVIDIA URL, so a checkout from a 2024 tutorial sits on a stale remote. It blocks no live traffic and changes nothing about the model. Best for an honest look at what a model you already ship does under attack.

7. PyRIT. Microsoft’s open framework for finding risk in generative AI systems, aimed at repeatable campaigns rather than a one-off scan. MIT, free, about 4,600 stars, v1.1.0 on 4 September 2026. The canonical repo is now microsoft/PyRIT: a March 2026 commit moved references off Azure/PyRIT. It does not block production requests. Best for teams that write their own attack strategies and re-run them as the model changes.

8. Promptfoo. An open CLI and library for evals and red teaming that runs in CI. MIT, free, about 25,500 stars, release 0.123.1 on 18 September 2026. Community red teaming includes up to 10,000 probes a month on the pricing page. OpenAI announced the acquisition on 9 March 2026 and Promptfoo now says it is part of OpenAI, while the project stays MIT under the promptfoo org. Best for LLM tests that run on every pull request.

9. Mindgard. A commercial offensive-security platform that discovers the AI systems and agents you have, red-teams them, then adds a runtime defense layer. Sold as SaaS, founded in 2022 out of Lancaster University research and independent as of September 2026. It documents its own Python CLI and a GitHub Action. No public pricing and no public version. Best for teams that need discovery and red teaming with a contract behind it.

Model and runtime protection

Model and runtime protection watches the model and the agents while they run, so it tells you what is happening in production. What the architecture allows was decided earlier, when the agents and tools were wired together. One entry here, because few products publish enough detail to place in this category. Status and funding (checked September 2026).

10. HiddenLayer. A commercial platform covering predictive, generative and agentic AI, including agent runtime security and security for the harness a coding agent runs inside. It is independent: on 2 September 2026 it announced a $100 million Series B led by Delta-v Capital. It documents SaaS, on-premises and air-gapped deployment. There is no open-source core, no public pricing and no public version, and you cannot read the detector. Best for teams that want production detection on agents they have already shipped.

What changed in LLM security since 2024

The independent LLM security vendors largely stopped being independent. Cisco completed its purchase of Robust Intelligence on 24 September 2024, and it ships as Cisco AI Defense. Palo Alto Networks closed Protect AI on 22 July 2025 for $634.5 million per its FY2025 10-K. SentinelOne closed Prompt Security on 5 September 2025. Check Point closed Lakera on 22 October 2025. OpenAI announced its acquisition of Promptfoo on 9 March 2026, and Promptfoo now says it is part of OpenAI. OWASP released a Top 10 for agentic applications on 10 December 2025, and on 2 August 2026 the European Commission’s enforcement powers for EU AI Act general-purpose model duties took effect.

The repos moved too. LLM Guard was archived on 9 July 2026, last tag 19 May 2025. Rebuff was archived on 16 May 2025. Vigil was last pushed in January 2024 and its README still says alpha. LLMFuzzer calls itself unmaintained in its own README, last pushed February 2024. Check the archive banner before you install anything off a list, this one included. Dates and repo status (checked September 2026).

How these tools map to the OWASP LLM Top 10

The grid shows five of the ten with a documented capability that clearly matches a named 2026 OWASP risk, and five rows blank. This is our own mapping, built from what each vendor or repo documents and translated to the 2026 IDs. It is not a vendor-certified mapping: the published vendor mappings we read still mix 2025 and 2026 numbering, and some repos tag risks without naming a version at all. A blank cell means we did not find the capability documented, not that the tool cannot do it. The documented mappings we could find cluster on prompt and output risks: almost every mark sits in LLM01, LLM02, LLM07, LLM08 or LLM10. The agent reach risk, LLM03 Excessive Agency, has one mark, and it is Trent’s, because that risk lives in what your agents can reach, not in what the model says.

We use the 2026 list, released in August 2026: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Excessive Agency, LLM04 Supply Chain, LLM05 Data and Model Poisoning, LLM06 Unbounded Consumption, LLM07 Misinformation, LLM08 Hidden Context Exposure, LLM09 Vector and Embedding Weaknesses, LLM10 Improper Output Handling. OWASP’s HTML index still headlines the 2025 list, so a mapping you read elsewhere may use different IDs. The companion agentic list is covered in our post on the OWASP Top 10 for agentic applications.

Trent’s marks come from what it documents finding in your code: prompt injection paths and tool misuse, where an agent can do more than its job needs. Guardrails AI’s row is blank because its validator Hub names the checks without the risk IDs. Marks come from the Garak repo, whose probes cover injection, leakage, misinformation and system-prompt extraction; Lakera’s own April 2026 post; the PyRIT v1.1.0 release notes; and Promptfoo’s red-team guide, which names prompt injection as an OWASP risk.

Best open source LLM security tools

Garak, Promptfoo, PyRIT, Guardrails AI and NeMo Guardrails are the five open-source tools on this list, all free to run under Apache-2.0 or MIT, with licence, version, release date and star count in their entries above (checked September 2026). Garak is the probe, Promptfoo the CI harness, PyRIT the framework for campaigns you write yourself, Guardrails AI the composable input and output validators, and NeMo Guardrails the conversation policy you express as code.

Two of those five will carry a small team through a quarter: Garak to find out what breaks, Promptfoo to keep those checks running in CI.

How to choose an LLM security tool

Three questions get you there, and the answers rarely point at one product.

Is the model your risk, or is the reach of your agents your risk? A chat feature with no tools puts the risk in what the model says back, so it needs input and output validation: Guardrails AI or NeMo Guardrails if you can run a library, Lakera Guard if you want it hosted. Agents that hold credentials and call tools move the risk into what those agents can reach, and answering that means reading the architecture, which is the work Trent does.

Do you need to stop something in the request path, or find problems before release? Stopping is a guardrail job: Lakera Guard, Guardrails AI, NeMo Guardrails, or Prompt Security for employee GenAI use. Finding is a red-team job: Garak, PyRIT, Promptfoo, Mindgard. Trent comes before both: it maps what your agents can reach, so you know what to guard and what to probe.

Can you run and maintain open source? If yes, Garak and Promptfoo cost nothing but your time, and no one is on call when a probe suite breaks the night before a release. If no one will own a Python dependency tree, or procurement needs a signed contract, buy instead: Mindgard for red teaming as a service, HiddenLayer for runtime, Lakera Guard for screening, Prompt Security inside Singularity for workforce use. Most teams end up with one tool from two of these three answers.

Where to start

Run Garak against the model you already ship; it costs an afternoon and tells you whether you have a problem worth budget. Then do the inventory: write down every agent, tool, skill and MCP server in your application, and what each one can read, write, execute and reach. That second list tells you what your system can be made to do, and building it from your real code is the work Trent does.

Reviewed by Zack Rossman Head of Engineering at Trent AI