AI Defense Stack

LLM firewalls & guardrails

Cisco AI Defense: AI validation and runtime protection suite

Cisco AI Defense is an AI validation and runtime protection suite from Cisco. It is a commercial product offered as: API, Self-hosted. Pricing model: not published.

  • Last reviewed
Visit Cisco AI Defense (opens in a new tab) Documentation (opens in a new tab)
Commercial Layer 6: Runtime guardrails

Best for

Organizations that already use Cisco security products and want AI discovery, validation and runtime enforcement from one vendor

Consider instead if

  • You want an open-source library you can modify and run entirely yourself. See NeMo Guardrails.
  • You want a standalone hosted guardrail API that your own application calls. See Lakera Guard.

What Cisco AI Defense does

Cisco AI Defense is a commercial security suite. Its data sheet lists four components: AI Cloud Visibility, AI Supply Chain Risk Management, AI Model and Application Validation, and AI Runtime Protection, each extended to agents and MCP. Runtime protection inspects prompts and responses for security (prompt injection), privacy (PII, PCI, PHI) and safety issues, and applies tool allowlists and blocklists to MCP traffic. Developers can call an Inspection API from their own application. Cisco lists Validation Essentials, Runtime Essentials and Advantage licensing options but states no prices. Cisco also publishes Apache-2.0 companion tools, such as an MCP scanner, in a separate GitHub organization.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Cisco Source, checked October 21, 2026: cisco.com (opens in a new tab)
Status
Active Source, checked October 21, 2026: cisco.com (opens in a new tab)
Open source
No: closed source (proprietary) Source, checked October 21, 2026: github.com (opens in a new tab)
Latest release
Not documented in the sources we checked
Deployment
API, Self-hosted Source, checked October 21, 2026: cisco.com (opens in a new tab)
Pricing model
Not published in the sources we checked Source, checked October 21, 2026: cisco.com (opens in a new tab)
Website
cisco.com Source, checked October 21, 2026: cisco.com (opens in a new tab)
Documentation
developer.cisco.com Source, checked October 21, 2026: developer.cisco.com (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
developer.cisco.com Source, checked October 21, 2026: developer.cisco.com (opens in a new tab)
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where Cisco AI Defense fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Cisco AI Defense covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L6 Runtime Runtime guardrails Primary Screen what goes into and comes out of a model in live traffic, and limit abuse of the model endpoint. Follows its category, LLM firewalls & guardrails
L7 Agent access Agent and tool access Also covers Documents allow and block lists for MCP tools. Enforces tool allowlists and blocklists on MCP traffic
L5 Data Data protection Also covers Documents screening of prompts and responses for PII, PCI and PHI. Screens for PII, PCI and PHI leakage in prompts and responses

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Cisco AI Defense, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection Runtime protection blocks prompt injection and prompt extraction attempts. Inspects prompts and responses to block prompt injection and denial-of-service attacks
LLM02 Sensitive Information Disclosure Runtime privacy controls cover PII, PCI and PHI leakage. Screens for PII, PCI and PHI leakage in prompts and responses
LLM05 Improper Output Handling Outputs are scanned for sensitive or harmful content before they reach users. Scans model outputs for sensitive information, hallucinations and other harmful content
LLM06 Excessive Agency Tool allowlists and blocklists apply to MCP traffic. Enforces tool allowlists and blocklists on MCP traffic

Not mapped in our analysis: LLM07, LLM09, LLM10. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in LLM firewalls & guardrails, ranked within the category by Coverage Score.

NVIDIA NeMo Guardrails

NVIDIA

Open sourceApache-2.0
  • Library
  • Self-hosted
  • API

Adds programmable input, dialog, retrieval, execution and output rails to LLM applications.

Best for: Teams that want to script rules for one LLM application in Python and run them in their own infrastructure

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM06 Excessive Agency

Reviewed

Portkey AI Gateway

Palo Alto Networks (Portkey)

Open sourceMIT Freemium Now Prisma AIRS AI Gateway
  • SaaS
  • Self-hosted
  • API

Routes LLM traffic through one gateway API and runs input and output guardrail checks on each request.

Best for: Teams that want a single gateway for several LLM providers with guardrail checks, available as open source or as a hosted service

Coverage Score 69 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM09 Misinformation

Reviewed

Kong AI Gateway

Kong

Open sourceApache-2.0
  • Self-hosted
  • SaaS
  • API

Routes LLM traffic through Kong with prompt guards, PII sanitization, spend limits and observability.

Best for: Teams that already run Kong as an API gateway and want LLM routing and prompt controls on the same data plane

Coverage Score 65 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM10 Unbounded Consumption

Reviewed

Cisco AI Defense FAQ

Is Cisco AI Defense open source?

No. The platform is licensed commercial software. Cisco publishes separate Apache-2.0 tools, such as an MCP scanner, in the cisco-ai-defense GitHub organization.

What licensing options does Cisco AI Defense list?

Its data sheet lists Validation Essentials, Runtime Essentials and Advantage, and states no prices.

Can an application call Cisco AI Defense directly?

Yes. The Inspection API lets an application send chat messages or HTTP traffic and decide whether to allow or block them, using policies managed in AI Defense.

Key facts you can cite

We have no commercial relationship with Cisco.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.