Notifications
Clear all
Topic starter
21/08/2026 4:42 pm
TL;DR: AI gateway and AI security buyers are increasingly being forced to decide whether guardrails belong inside the gateway or as a separate control layer, according to TruFoundry’s pricing analysis of Lasso Security. The practical issue is not cost alone but how runtime enforcement, discovery, and auditability change when AI governance is split across multiple products.
NHIMG editorial — based on content published by TruFoundry: Lasso Security Pricing: A Complete Breakdown for 2026
By the numbers:
- Lasso Security says its platform covers 3,000+ attack types and techniques across automated AI red teaming.
- The company reports sub-50ms decision latency and a 98.6% detection accuracy rate.
Questions worth separating out
Q: How should security teams govern AI gateways in production environments?
A: Security teams should govern AI gateways like shared control planes, not convenience proxies.
Q: When does a separate AI security layer create more risk than it removes?
A: A separate layer creates more risk when it duplicates gateway controls without a clear source of truth for policy enforcement.
Q: What do organisations get wrong about AI-BOM and discovery?
A: They often treat discovery as a reporting task instead of a control requirement.
Practitioner guidance
- Define the enforcement boundary Map exactly where authentication, content filtering, tool approval, and routing decisions occur in the AI gateway path.
- Inventory AI agents and MCP dependencies Build an AI-BOM that lists every agent, model endpoint, MCP server, and external tool the gateway can reach.
- Separate red teaming from live response Use adversarial testing to validate prompt, tool, and policy boundaries before deployment, then run runtime detection for suspicious actions once the system is live.
What's in the full article
TruFoundry's full article covers the operational detail this post intentionally leaves for the source:
- Published pricing structure and the specific plan levels available for AI Gateway deployments.
- Feature-by-feature packaging detail for built-in guardrails, MCP governance, authentication, and observability.
- Deployment options across VPC, on-prem, air-gapped, hybrid, and multi-cloud environments.
- The pricing logic behind using a gateway with native guardrails versus adding a separate security layer.
👉 Read TruFoundry's breakdown of Lasso Security pricing and AI gateway guardrails →
AI gateway guardrails: are security teams buying one layer too many?
Explore further
21/08/2026 5:02 pm
AI gateway security is becoming an identity governance problem. Once agents can route requests, call tools, and act inside business workflows, the gateway is no longer just a traffic layer. It becomes the point where authentication, authorization, and policy enforcement converge for non-human activity. That creates a direct overlap with IAM and NHI governance, because the organisation is no longer managing only human sessions. Practitioners should treat AI gateways as part of the identity control plane, not as an adjacent infrastructure service.
A few things that frame the scale:
- 98.6% detection accuracy rate appears in Entro Security’s LLMjacking analysis, but detection alone does not solve delegated-access governance. See AI LLM hijack breach.
- 80% of organisations report AI agents have already performed actions beyond intended scope, according to AI Agents: The New Attack Surface report.
A question worth separating out:
Q: Should enterprises centralise AI guardrails in the gateway or split them across tools?
A: Centralising guardrails in the gateway usually improves consistency, but only if the gateway is the actual place where policy decisions are enforced. Splitting controls can make sense for specialised testing or detection, yet the organisation still needs one authoritative path for runtime authorization and audit evidence. Otherwise, responsibility becomes distributed while accountability disappears.
👉 Read our full editorial: AI gateway guardrails are shifting pricing and governance decisions
