AI Defense Stack

AI security posture management & discovery

Palo Alto Networks Prisma AIRS: commercial AI security platform

Prisma AIRS is a commercial AI security platform from Palo Alto Networks. It is a commercial product offered as: SaaS, Cloud-native, API. Pricing model: not published.

  • Last reviewed
Visit Prisma AIRS (opens in a new tab) Documentation (opens in a new tab)
Commercial Layer 2: Discovery and posture

Best for

Organizations that already run Palo Alto Networks security products and want AI inventory, model scanning and runtime controls from the same vendor

Ownership

Palo Alto Networks announced on July 22, 2025 that it completed its acquisition of Protect AI, and the release says Protect AI's technology and team will be a cornerstone of Prisma AIRS. Source, checked October 21, 2026: paloaltonetworks.com (opens in a new tab)

Consider instead if

  • You want a free open-source scanner for model files instead of a platform. See ModelScan.

What Prisma AIRS does

Prisma AIRS is Palo Alto Networks' commercial AI security platform. The documentation describes four modules that can be used on their own: AI Runtime Security, AI Supply Chain Security, AI Red Teaming and AI Gateway. An AI Inventory capability maps AI workloads, resources and traffic. Supply chain scanning checks GGUF, Pickle, PyTorch and Safetensors model files for hidden backdoors and malicious code, and it integrates with Hugging Face, private registries and CI/CD. Runtime enforcement runs as a firewall instance in AWS, Azure or GCP, through an API or Python SDK, or as a SaaS gateway. The pages we opened list no prices, so ask the vendor.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Palo Alto Networks Source, checked October 21, 2026: docs.paloaltonetworks.com (opens in a new tab)
Status
Active Source, checked October 21, 2026: docs.paloaltonetworks.com (opens in a new tab)
Ownership
Palo Alto Networks announced on July 22, 2025 that it completed its acquisition of Protect AI, and the release says Protect AI's technology and team will be a cornerstone of Prisma AIRS. Source, checked October 21, 2026: paloaltonetworks.com (opens in a new tab)
Open source
No: closed source (proprietary) Source, checked October 21, 2026: docs.paloaltonetworks.com (opens in a new tab)
Latest release
Not documented in the sources we checked
Deployment
SaaS, Cloud-native, API Source, checked October 21, 2026: docs.paloaltonetworks.com (opens in a new tab)
Pricing model
Not published in the sources we checked Source, checked October 21, 2026: docs.paloaltonetworks.com (opens in a new tab)
Website
paloaltonetworks.com Source, checked October 21, 2026: paloaltonetworks.com (opens in a new tab)
Documentation
docs.paloaltonetworks.com Source, checked October 21, 2026: docs.paloaltonetworks.com (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
Not documented in the sources we checked
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where Prisma AIRS fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Prisma AIRS covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L2 Discovery Discovery and posture Primary Find the AI models, services, agents, MCP servers and AI apps in use, and check how each is configured and exposed. Follows its category, AI security posture management & discovery
L3 Supply chain Model and supply chain Also covers Documents scanning of model files for backdoors and malicious code. Scans GGUF, Pickle, PyTorch and Safetensors model files for hidden backdoors, malicious code and deserialization flaws
L6 Runtime Runtime guardrails Also covers Documents real-time blocking and gateway policy for AI traffic. Detects and blocks AI-specific attacks and data loss in real time; Centralizes AI access policy, governance and observability through an AI Gateway

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Prisma AIRS, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM02 Sensitive Information Disclosure The runtime module is described as detecting and blocking AI-specific attacks and data loss. Detects and blocks AI-specific attacks and data loss in real time
LLM03 Supply Chain Scans third-party model files for malicious code and maps AI assets across the environment. Maps AI workloads, resources and traffic to find blind spots across the enterprise; Scans GGUF, Pickle, PyTorch and Safetensors model files for hidden backdoors, malicious code and deserialization flaws
LLM04 Data and Model Poisoning The model scanner checks for hidden backdoors in model files. Scans GGUF, Pickle, PyTorch and Safetensors model files for hidden backdoors, malicious code and deserialization flaws

Not mapped in our analysis: LLM06, LLM08. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in AI security posture management & discovery, ranked within the category by Coverage Score.

Snyk Evo AI-SPM

Snyk

Commercial
  • SaaS
  • CLI

Maps AI models, agents, datasets and MCP servers across code and apps, scores model risk and enforces policy.

Best for: Teams that already use Snyk and want an inventory of AI models, agents and MCP servers tied to policy in the same platform

Coverage Score 64 out of 100
  • LLM03 Supply Chain
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency
  • +1 more

Reviewed

Microsoft Defender for Cloud AI security posture management

Microsoft

Commercial
  • Cloud-native

Finds AI workloads across Azure, AWS and Google Cloud and flags risks with recommendations and attack paths.

Best for: Teams already using Defender for Cloud that want AI workloads in Azure, AWS and Google Cloud added to their posture view

Coverage Score 55 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM03 Supply Chain

Reviewed

Wiz AI Security Posture Management (AI-SPM)

Google (Wiz)

Commercial
  • SaaS
  • Cloud-native

Finds AI services across cloud accounts without agents and maps misconfigurations and attack paths.

Best for: Cloud security teams that want agentless discovery of AI services and their risks inside a cloud security platform

Coverage Score 54 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM03 Supply Chain
  • LLM06 Excessive Agency

Reviewed

Prisma AIRS FAQ

What is in Prisma AIRS?

The docs describe four modules that work independently: AI Runtime Security, AI Supply Chain Security, AI Red Teaming and AI Gateway, plus an AI Inventory capability.

What happened to Protect AI?

Palo Alto Networks announced on July 22, 2025 that it completed its acquisition of Protect AI. The release names Prisma AIRS but not individual Protect AI products.

Which model formats can it scan?

The platform architecture page lists GGUF, Pickle, PyTorch and Safetensors for AI Model Security.

Key facts you can cite

We have no commercial relationship with Palo Alto Networks.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.