Topic starter
21/08/2026 4:42 pm
TL;DR: AI gateway and AI security buyers are increasingly being forced to decide whether guardrails belong inside the gateway or as a separate control layer, according to TruFoundry’s pricing analysis of Lasso Security. The practical issue is not cost alone but how runtime enforcement, discovery, and auditability change when AI governance is split across multiple products.
Editorial analysis by NHI Mgmt Group, based on content published by TruFoundry: “Lasso Security Pricing: A Complete Breakdown for 2026”.
By the numbers:
- Lasso Security describes its red-teaming library as covering 3,000+ attack types and techniques.
- TrueFoundry says its gateway can handle 350+ RPS on just 1 vCPU.
- TruFoundry states that TrueFoundry runs at ~3-4 ms latency while Lasso reports sub-50ms decision latency.
Key questions
Q: How should security teams decide whether AI guardrails belong in the gateway or in a separate layer?
A: Teams should place guardrails where they can actually enforce policy at runtime with the least duplication.
Q: Why do separate AI guardrail products often create more governance complexity?
A: Because they introduce another policy engine, another log source, and another place where identity and tool access can diverge.
Q: What breaks when BOM data is not connected to runtime enforcement?
A: The BOM becomes stale almost immediately.
Practitioner guidance
- Define the enforcement boundary before procurement Decide whether prompt, tool, and output controls belong in the gateway, in a separate security layer, or in both, and document which layer owns each decision type.
- Inventory agents, tools, and MCP servers continuously Maintain a living AI-BOM so every agentic application, external tool, and MCP dependency is mapped to an owner, policy, and approval path.
- Unify identity and policy logging Ensure authentication events, policy decisions, and tool-call records can be correlated across the gateway and any add-on guardrail platform.
Bottom line: AI gateway guardrails are no longer just a feature comparison, because placement affects who enforces policy, who can audit it, and how much operational overhead the AI stack carries.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:02 pm
AI gateway guardrails are becoming a control-plane decision, not a point product decision. The real question is whether policy, routing, identity, and observability are governed in one place or split across multiple products. That split increases the chance of policy drift, duplicated logging, and inconsistent enforcement across models, tools, and agents. Practitioners should treat guardrail placement as architecture, not procurement.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should procurement teams compare besides the sticker price of an AI gateway?
A: They should compare the full governance cost, including integration effort, policy maintenance, logging retention, audit evidence production, and the number of tools needed to cover the same control scope. A lower licence fee can still produce a higher operating cost if guardrails and observability sit in separate products.
👉 Read our full editorial: AI gateway guardrails are shifting pricing and governance decisions