AI Defense Stack

LLM firewalls & guardrails

Pangea AI Guard: hosted guardrail API for prompts and responses

Pangea AI Guard is a hosted guardrail API for prompts and responses from CrowdStrike. It is a commercial product offered as: SaaS, Self-hosted, API. Pricing model: not published.

  • Last reviewed
Visit Pangea AI Guard (opens in a new tab) Documentation (opens in a new tab)
Commercial Layer 6: Runtime guardrails

Best for

  • Teams that want a hosted guardrail API with configurable recipes, and the option to run the data plane in their own cloud
  • Agent builders who want different checks before planning, before a tool call and after a tool returns, from one API

Ownership

CrowdStrike's fiscal 2026 Form 10-K states that it acquired 100% of the equity interest of Pangea Cyber Corporation on September 26, 2025. Source, checked October 21, 2026: sec.gov (opens in a new tab)

Consider instead if

  • You want an open-source library you can modify and run entirely yourself. See NeMo Guardrails.
  • You want another hosted guardrail API to compare. See Lakera Guard.

What Pangea AI Guard does

Pangea AI Guard is an API you call wherever untrusted text meets a model or an agent, and its six preset recipes name those points: chat input, chat output, RAG ingestion, the agent's plan, tool input and tool output. Each recipe chains detectors for prompt injection, PII, secrets, malicious URLs and IPs, code, language, competitors and restricted topics. Each detector can report, block or rewrite, by masking, hashing, defanging a link or applying reversible format-preserving encryption. That gives agent builders a separate policy per stage instead of one filter for everything. MCP validation, image and prompt hardening detectors are still marked coming soon, and the pricing page showed no rates. CrowdStrike, which acquired Pangea in September 2025, now hosts the docs, and the old AI Guard product page redirects to a Falcon AIDR page that does not name AI Guard.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
CrowdStrike (Pangea) Source, checked October 21, 2026: sec.gov (opens in a new tab)
Status
Active Source, checked October 21, 2026: pangea.cloud (opens in a new tab)
Ownership
CrowdStrike's fiscal 2026 Form 10-K states that it acquired 100% of the equity interest of Pangea Cyber Corporation on September 26, 2025. Source, checked October 21, 2026: sec.gov (opens in a new tab)
Open source
No: closed source (proprietary) Source, checked October 21, 2026: pangea.cloud (opens in a new tab)
Latest release
Not documented in the sources we checked
Deployment
SaaS, Self-hosted, API Source, checked October 21, 2026: pangea.cloud (opens in a new tab)
Pricing model
Not published in the sources we checked Source, checked October 21, 2026: pangea.cloud (opens in a new tab)
Website
pangea.cloud Source, checked October 21, 2026: pangea.cloud (opens in a new tab)
Documentation
pangea.cloud Source, checked October 21, 2026: pangea.cloud (opens in a new tab)
API reference
pangea.cloud Source, checked October 21, 2026: pangea.cloud (opens in a new tab)
Quickstart
pangea.cloud Source, checked October 21, 2026: pangea.cloud (opens in a new tab)
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Where Pangea AI Guard fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Pangea AI Guard covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L6 Runtime Runtime guardrails Primary Screen what goes into and comes out of a model in live traffic, and limit abuse of the model endpoint. Follows its category, LLM firewalls & guardrails
L5 Data Data protection Also covers Documents redaction of personal and other sensitive data with a PII detector. Redacts PII and sensitive data with a Confidential and PII detector; Redaction actions for PII, secrets and custom entities: replacement, mask, partial mask, salted hash or reversible format-preserving encryption
L8 Monitoring Monitoring and response Also covers Documents an audit trail of detections, with webhooks that can trigger real-time alerts. Logs detections in an audit trail and can trigger webhooks for real-time alerts

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Pangea AI Guard, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection Recipes block prompt injection with a Malicious Prompt detector. Blocks prompt injection with a Malicious Prompt detector; RAG Ingestion recipe screens documents before they enter a RAG system for prompt injection, malicious entities, PII and secrets
LLM02 Sensitive Information Disclosure Recipes redact PII and sensitive data from AI interactions. Redacts PII and sensitive data with a Confidential and PII detector; Redaction actions for PII, secrets and custom entities: replacement, mask, partial mask, salted hash or reversible format-preserving encryption
LLM06 Excessive Agency Tool input and output recipes screen what an agent sends to tools and gets back; they do not limit which tools it may call. Agent Plan, Tool Input and Tool Output recipes stop injected plans and keep malicious entities and sensitive data out of tool calls and tool results
LLM08 Vector and Embedding Weaknesses The RAG ingestion recipe checks documents for injected instructions before indexing, the validation step OWASP LLM08 asks for. Blocks prompt injection with a Malicious Prompt detector; RAG Ingestion recipe screens documents before they enter a RAG system for prompt injection, malicious entities, PII and secrets

Not mapped in our analysis: LLM05, LLM07, LLM09, LLM10. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in LLM firewalls & guardrails, ranked within the category by Coverage Score.

NVIDIA NeMo Guardrails

NVIDIA

Open sourceApache-2.0
  • Library
  • Self-hosted
  • API

Adds programmable input, dialog, retrieval, execution and output rails to LLM applications.

Best for: Teams that want to script rules for one LLM application in Python and run them in their own infrastructure

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM06 Excessive Agency

Reviewed

Portkey AI Gateway

Palo Alto Networks (Portkey)

Open sourceMIT Freemium Now Prisma AIRS AI Gateway
  • SaaS
  • Self-hosted
  • API

Routes LLM traffic through one gateway API and runs input and output guardrail checks on each request.

Best for: Teams that want a single gateway for several LLM providers with guardrail checks, available as open source or as a hosted service

Coverage Score 69 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM09 Misinformation

Reviewed

Kong AI Gateway

Kong

Open sourceApache-2.0
  • Self-hosted
  • SaaS
  • API

Routes LLM traffic through Kong with prompt guards, PII sanitization, spend limits and observability.

Best for: Teams that already run Kong as an API gateway and want LLM routing and prompt controls on the same data plane

Coverage Score 65 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM10 Unbounded Consumption

Reviewed

Pangea AI Guard FAQ

Is Pangea AI Guard open source?

No. It is a hosted service, and we found no public source repository for the service itself.

Who owns Pangea?

CrowdStrike. Its fiscal 2026 Form 10-K states that it acquired 100% of Pangea Cyber Corporation on September 26, 2025, and the AI Guard docs now carry CrowdStrike branding.

How can AI Guard be deployed?

Pangea's documentation lists SaaS, Edge with a customer-hosted data plane, and Private Cloud in early access.

Can it protect an agent's tool calls?

The recipes page has three agent recipes: Agent Plan blocks prompt injection before the agent plans, Tool Input keeps malicious entities and sensitive data out of tool calls, and Tool Output checks what tools return. It screens content; it does not decide which tools an agent may use.

Key facts you can cite

We have no commercial relationship with CrowdStrike (Pangea).

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.