AI Defense Stack

LLM firewalls & guardrails

Cloudflare Firewall for AI (AI Security for Apps): set of WAF detections for LLM-powered apps

Firewall for AI is a set of WAF detections for LLM-powered apps from Cloudflare. It is a commercial product offered as: Cloud-native, Managed service. Pricing model: contact sales. The vendor's page now calls it AI Security for Apps.

  • Last reviewed
Visit Firewall for AI (opens in a new tab) Documentation (opens in a new tab)
Commercial Now AI Security for Apps Layer 6: Runtime guardrails

Best for

Teams already using Cloudflare WAF that want to flag or block risky prompts to their own LLM endpoints with rules they manage in one place

Ownership

Cloudflare's documentation titles the product AI Security for Apps and says it was formerly called Firewall for AI. The page gives no rename date and no ownership change. Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)

Consider instead if

  • You want gateway features such as caching, spend limits and model routing for LLM traffic. See Cloudflare AI Gateway.
  • You want an open-source toolkit you can run inside your own application. See NeMo Guardrails.

What Firewall for AI does

Cloudflare AI Security for Apps, formerly called Firewall for AI, adds detections for LLM-specific threats to your existing Cloudflare WAF rules. The documentation lists prompt injection scoring, PII detection in incoming prompts, and detection of unsafe and custom topics. It scans requests to endpoints labeled as LLM endpoints with a JSON content type, and writes the results into fields you can use in custom rules, rate limiting rules and Security Analytics. The page calls it model-agnostic, so it works with any LLM. LLM endpoint discovery is on all plans, while the AI detection fields are an Enterprise paid add-on. It filters traffic at the edge; it does not test models.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Cloudflare Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)
Status
Renamed Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)
Current name
AI Security for Apps Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)
Ownership
Cloudflare's documentation titles the product AI Security for Apps and says it was formerly called Firewall for AI. The page gives no rename date and no ownership change. Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)
Open source
No: closed source (proprietary) Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)
Latest release
Not documented in the sources we checked
Deployment
Cloud-native, Managed service Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)
Pricing model
Contact sales: LLM endpoint discovery is available on Free, Pro, Business and Enterprise plans. The AI detection fields and log mode ruleset are an Enterprise-only paid add-on; contact your account team. (as listed on October 21, 2026; check the vendor for current pricing) Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)
Website
developers.cloudflare.com Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)
Documentation
developers.cloudflare.com Source, checked October 21, 2026: developers.cloudflare.com (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
Not documented in the sources we checked
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Where Firewall for AI fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Firewall for AI covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L6 Runtime Runtime guardrails Primary Screen what goes into and comes out of a model in live traffic, and limit abuse of the model endpoint. Follows its category, LLM firewalls & guardrails
L5 Data Data protection Also covers Documents detection of personal data in prompts. Detects PII such as phone numbers, email addresses and card numbers in incoming prompts

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Firewall for AI, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection Prompt injection scoring flags prompts that try to subvert the model. Scores prompts for prompt injection so WAF rules can act on the result
LLM02 Sensitive Information Disclosure PII detection flags personal data in incoming prompts. Detects PII such as phone numbers, email addresses and card numbers in incoming prompts

Not mapped in our analysis: LLM05, LLM07, LLM09, LLM10. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in LLM firewalls & guardrails, ranked within the category by Coverage Score.

NVIDIA NeMo Guardrails

NVIDIA

Open sourceApache-2.0
  • Library
  • Self-hosted
  • API

Adds programmable input, dialog, retrieval, execution and output rails to LLM applications.

Best for: Teams that want to script rules for one LLM application in Python and run them in their own infrastructure

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM06 Excessive Agency

Reviewed

Portkey AI Gateway

Palo Alto Networks (Portkey)

Open sourceMIT Freemium Now Prisma AIRS AI Gateway
  • SaaS
  • Self-hosted
  • API

Routes LLM traffic through one gateway API and runs input and output guardrail checks on each request.

Best for: Teams that want a single gateway for several LLM providers with guardrail checks, available as open source or as a hosted service

Coverage Score 69 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM09 Misinformation

Reviewed

Kong AI Gateway

Kong

Open sourceApache-2.0
  • Self-hosted
  • SaaS
  • API

Routes LLM traffic through Kong with prompt guards, PII sanitization, spend limits and observability.

Best for: Teams that already run Kong as an API gateway and want LLM routing and prompt controls on the same data plane

Coverage Score 65 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM10 Unbounded Consumption

Reviewed

Firewall for AI FAQ

Is Cloudflare Firewall for AI still called that?

The Cloudflare documentation now titles the product AI Security for Apps and says it was formerly Firewall for AI.

Does it work with any LLM?

Yes. The documentation calls it model-agnostic and says it complements existing WAF rules.

Which plans include it?

LLM endpoint discovery is listed for Free, Pro, Business and Enterprise plans. The AI detection fields are listed as an Enterprise-only paid add-on.

Key facts you can cite

We have no commercial relationship with Cloudflare.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.