Incumbents Bundling AI Security
Promptfoo
The real threat is not a better point product, it is a broader security incumbent turning AI security into one more module on an existing enterprise contract. Check Point and SentinelOne each moved to combine red teaming with runtime controls, so a buyer can test an AI app before launch, then watch and block risky prompts, tool calls, or data leaks after launch, without creating a new vendor relationship. Promptfoo is competing against bundled distribution as much as product depth.
-
Check Point said Lakera gives it an end to end AI security stack, and Check Point already sells through a global platform that spans network, cloud, and workspace security to more than 100,000 organizations. That matters because AI security can be added to an existing renewal, reseller motion, and security architecture review.
-
SentinelOne positioned Prompt Security as runtime protection for employee AI use and agent workflows, including visibility into which AI tools are being used, what data is being shared, and enforcement against prompt injection and leakage. That lands naturally with SOC and IT teams already buying endpoint, cloud, and identity security from SentinelOne.
-
Promptfoo comes from the opposite direction. Its core wedge is developer and AppSec workflow, where teams test prompts, RAG paths, and agent behavior before code ships. That is attractive when the buyer wants model agnostic depth and fast iteration, but less so when procurement wants one security vendor to cover runtime, policy, and incident response too.
The market is heading toward two lanes. Standalone tools will keep winning with engineering teams that want the deepest testing and fastest product cycles. Platform vendors will win large enterprise standardization deals by folding AI security into existing security spend, channels, and operations teams. That makes distribution and workflow ownership just as important as detection quality.