All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Google sells Model Armor to organizations running AI applications and agents. The Google Cloud service screens prompts and responses for prompt injection and sensitive-data leaks. In Google's Agent Gateway, which governs agent traffic, Model Armor can block content that breaks a customer's policies. For healthcare and US federal buyers, Google lists HIPAA and FedRAMP High certifications for it. TrioTech, comparing cloud guardrails, calls Model Armor multi-cloud and says its document and malicious-URL screening go further than rivals'. ARMO, reviewing Google Cloud's AI security, argues Model Armor frequently lets through harmless-looking injected instructions in retrieved documents. Teams on Google Cloud can turn Model Armor on in services they already use.
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | Google documents Model Armor as screening prompts and responses for AI applications and agents, and Blueinfy describes the same job. OWASP lists prompt injection as LLM01:2025, so an outside body frames the risk the same way. No cited source measures how often these failures occur for Model Armor's buyers or what they cost. The buyer and problem are clear but the pain is unquantified, which is rung 3. [s7, s14, s20, s10] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 4/5 | Google documents how Model Armor intercepts prompts before they reach Gemini models and responses before the application receives them, with floor settings and per-request templates. Outside parties bear on the capability: TrueFoundry's integration guide describes calling the sanitization API with a configured template, Triotech compares its architecture with the Bedrock and Azure guardrails, and ARMO analyzes where its data plane ends. Detailed documentation with several external technical assessments meets rung 4. [s9, s17, s23, s15] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | Google is adding Model Armor integrations for agents. OWASP describes prompt injection as user prompts altering model behavior or output unexpectedly. SiliconANGLE covered Google launches in August 2025 and April 2026, and ARMO describes a CISO asked whether Google's native stack suffices. None of these shows RFP language, a guardrail budget line or a regulatory mandate, so buyer-side demand stays indirect at rung 3. [s20, s10, s11, s15] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 1/5 | The cited sources name Francis deSouza, Google Cloud's chief operating officer and president of security products, but identify no leader or builder of this line, and Google's reference to Google and Mandiant research concerns the broader AI Protection offering. With no verifiable background for the line's own team, team credibility sits at rung 1. That rests on an absence, not on an adverse finding. [s11, s13] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 3/5 | TrueFoundry documents an integration with Model Armor. Google's documentation lists inline integrations across Agent Gateway, Apigee, Gemini Enterprise and its MCP servers. The captured sources name no Model Armor customer or usage figure. That reach counts only as an indirect signal, which is rung 3. [s17, s7, s10] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | At line scope the test is shipping output, and Google's capital is excluded. SiliconANGLE reported Agentspace protection in August 2025 and agent integrations in preview in April 2026. Google's integration list now spans Agent Gateway, Apigee, Service Extensions and MCP servers. The cited sources contain no line revenue or usage figure, so efficiency is unconfirmed, which is rung 3. [s10, s11, s7] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 4/5 | Outside writers place Model Armor in the AI guardrail category without coaching. SiliconANGLE calls it Google Cloud's in-line protection system for AI agents, and Blueinfy lists it among Google's dedicated safety services. TrioTech compares it with Bedrock Guardrails and Azure AI Content Safety, and ARMO calls it Google's prompt and response screening service. The cited sources contain no analyst category named after Model Armor, which holds it below rung 5. [s10, s14, s23, s15] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | Model Armor already belongs to a platform vendor, so its exposure is substitution by other Google tools or rival clouds. Blueinfy lists Google's Checks Guardrails as another runtime safety feature, and TrioTech compares Bedrock Guardrails and Azure AI Content Safety as alternatives. Inline placement in Gemini Enterprise and Agent Gateway adds integration friction, but no retained data or lock-in moat appears, which is rung 3. [s14, s23, s7] |
Model Armor defends the live traffic of AI applications and agents. Google documents screening of prompts and responses, and SiliconANGLE describes defense against prompt injection, data leakage and tool poisoning.
The risk has standing outside Google. OWASP lists prompt injection as LLM01:2025 and defines it as user prompts that alter a model's behavior or output in unintended ways. Blueinfy describes Model Armor as checking model inputs and outputs to reduce harmful content and data exposure.
The record frames the pain without sizing it. ARMO describes a CISO running agents on GKE who is asked whether Google's native stack is now sufficient. No captured source measures incident rates or losses for these buyers. [s7, s10, s14, s15, s20]
Model Armor runs in two modes. Called through its REST API, it works only as a detector, and the application's own code acts on each verdict. Through Google's integrations, it can inspect and block traffic inline.
The inline integrations span Google's agent stack. The Agent Gateway integration enforces security policies on traffic to and from governed agents. Gemini Enterprise routes user, agent and model interactions through Model Armor, and Service Extensions screen traffic at application load balancers. In Gemini Enterprise Agent Platform, Model Armor intercepts prompts before they reach Gemini models and responses before the application receives them.
Google's documentation also records limits. Google's documented Agent Platform setup command enables inspect-only mode for floor settings. These settings define the project's minimum protection baseline. If Model Armor is temporarily unreachable or hits an internal error, the platform continues without screening, which Google says can expose unscreened prompts or responses. Configuration errors, such as permission or quota issues, are still reported in blocking mode. ARMO says Model Armor does not observe subsequent agent actions, including child processes and network destinations. [s7, s9, s15]
Model Armor competes with the other clouds' native guardrails. TrioTech compares it with Amazon Bedrock Guardrails and Azure AI Content Safety, and describes Model Armor as positioned for model-agnostic, multi-cloud inline screening.
The same comparison sorts buyers by cloud. It says AWS-native teams tend toward Bedrock Guardrails, Azure OpenAI users toward Content Safety, and multi-cloud or multi-model teams toward Model Armor. It also reports that independent comparisons most consistently rate Azure ahead on indirect injection defense. A buyer whose main risk is indirect injection therefore has reason to test Azure's alternative.
Google's own portfolio overlaps it. Blueinfy lists Checks Guardrails as a separate Google runtime safety feature that evaluates model inputs and outputs. A Google Cloud buyer can therefore choose among more than one Google screening option. [s23, s14]
Model Armor integrates with Google's services and TrueFoundry. Google documents inline integrations with Agent Gateway, Apigee, Gemini Enterprise, Google MCP servers, Service Extensions and Gemini Enterprise Agent Platform. TrueFoundry documents a guardrail integration for its own AI gateway.
Independent press covered the launch cadence. SiliconANGLE reported inline protection for Agentspace in August 2025. In April 2026 it reported integrations in preview with Agent Gateway, Agent Runtime and LangChain. Google's own article on iTWire, credited to Google Cloud, lists Model Armor among new governance and security controls in Gemini Enterprise Agent Platform.
Google names no customer in the captured sources. The captured sources publish no Model Armor customer, usage figure or revenue figure. Traction evidence comes from integrations and press coverage. [s7, s17, s10, s11, s24]
Google builds and runs Model Armor, and the reviewed sources name no team or leader specific to it. SiliconANGLE quotes Francis deSouza, Google Cloud's president of security products, on the April 2026 security launches that included Model Armor.
InfoQ relays Google's statement that AI Protection, which uses Model Armor, draws on security research from Google and Mandiant. The cited outside sources contain no assessment of the people behind the line. [s11, s13]
Model Armor carries its own compliance record. Its compliance page lists HIPAA and FedRAMP High certifications and data residency as a security control. Google's FedRAMP and DoD scope page lists Model Armor in its table of services by audit scope.
DoD authorization is still pending. The scope page shows a DISA review entry for Model Armor. The page defines that as a service submitted for DoD authorization and waiting for DISA approval. The captured text does not show which DoD levels that entry covers.
The captured sources contain no Model Armor detection or false-positive rate. ARMO argues that crafted indirect injections will frequently pass. [s6, s21, s15]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Lakera | competes with | Competes for the same AI application buyer. | |
| Prompt Security | competes with | Competes for the same AI application buyer. | |
| Gray Swan AI | competes with | Competes for the same AI application buyer. | |
| Dynamo AI | competes with | Competes for the same AI application buyer. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| Microsoft | adjacent | Azure AI Content Safety is one of the cloud-native guardrails TrioTech compares with Model Armor. | N/AMicrosoft is scored by product line, not as a whole company, so there is no company-wide column to compare. Open its profile to compare a specific product. |
| Amazon Web Services | adjacent | Amazon Bedrock Guardrails is one of the cloud-native guardrails TrioTech compares with Model Armor. | N/AAmazon Web Services is scored by product line, not as a whole company, so there is no company-wide column to compare. Open its profile to compare a specific product. |
Add analyzed competitors to compare them side by side with Google Model Armor.
A closer look at this line's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
press the advantage
Customers buy Model Armor as usage-priced screening software that they configure through policy templates and floor settings, a project-wide minimum baseline of protection. In Google's Gemini Enterprise Agent Platform, Agent Gateway and load balancers, Model Armor screens traffic inline and can block content that breaks the customer's policies. Through its REST API, Model Armor works as a detector, and the customer's application decides what to block. Google does not disclose a proprietary dataset or patent behind Model Armor. Google lists FedRAMP High and HIPAA certifications for Model Armor, and its DoD authorization awaits approval. A guardrail replacing it in deployments that require FedRAMP High would have to meet that authorization.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Customers buy screening software they configure through templates and floor settings and run in their own projects. TrioTech describes usage-based pricing across the cloud guardrails, which is payment for features at rung 1. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Model Armor sits inline in Gemini Enterprise, Agent Gateway and Service Extensions, so leaving means reconfiguring those integrations and recreating templates and floor settings. The cited record documents that inline placement but does not size the migration, which scores 2 with that bound stated. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 2/3 | Model Armor's own compliance page lists FedRAMP High and HIPAA, and Google's FedRAMP scope page lists it in the audit-scope table. A replacement in deployments that require FedRAMP High would have to meet that authorization, which is material but feasible at rung 2. DoD authorization is still in DISA review, so it adds nothing to the moat yet. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Screening prompts, responses and agent traffic inline for injection, sensitive data and harmful content is real-time detection work. ARMO's account that crafted indirect injections will frequently pass shows the detection problem remains hard. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | Model Armor is built and sold for organizations running production AI on Google Cloud. Its HIPAA and FedRAMP High certifications position it for healthcare and federal buyers, the regulated class rung 3 names. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 3/3 | Through its integrations Model Armor sits inline between applications and the models or agents they call. In Gemini Enterprise Agent Platform it intercepts prompts before they reach Gemini models and responses before the application receives them. In inspect-and-block mode it blocks violations. Agent Gateway supports inline inspection and blocking. Model Armor also protects AI interactions passing through load balancers. The dependence covers only that routed traffic. The REST API only detects, and the Agent Platform integration continues when Model Armor is temporarily unreachable. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 | No captured source names a dataset, content licence or granted patent that Model Armor retains. The cited sources describe filters, templates and floor settings, which name methods. The four-part floor's first test needs a named retained asset, so it fails there. |
Model Armor serves teams putting generative and agentic AI into production, with the deepest fit on Google Cloud. Google integrates it inline across its agent stack, from Gemini Enterprise Agent Platform to Agent Gateway and Google MCP servers.
The segment includes teams running models outside Google. Google's integration table lists all models and all clouds as Agent Gateway coverage. TrueFoundry says the service works with any model on any cloud. TrioTech says multi-cloud and multi-model teams tend toward Model Armor.
Its certifications open regulated segments. The compliance page lists HIPAA and FedRAMP High. No captured source names a buyer in any segment, so segment fit reads from positioning and certifications.
Model Armor screens prompts and responses with filters a customer tunes. Blueinfy describes adjustable filters that let organizations customize protections, and TrioTech says its malicious-URL and document screening go further than competitors.
Its advantage is inline placement across Google's agent stack. Gemini Enterprise routes interactions through it, and Agent Gateway and Service Extensions screen traffic in transit. Floor settings apply a baseline to every Agent Platform generateContent call in a project.
The limits are documented. The REST API works only as a detector, and the Agent Platform integration continues unscreened when Model Armor is temporarily unreachable. ARMO argues that indirect injection written as benign text will frequently pass, and no captured source reports a detection benchmark. ARMO's summary is that Model Armor protects the content surface, which leaves agent actions to other controls.
Model Armor's go-to-market runs through Google's platform. Google documents Model Armor integrations with Gemini Enterprise and Apigee.
Partners and the API extend the reach. TrueFoundry documents a Model Armor guardrail integration for its AI gateway. Google's table lists all models and all clouds as Agent Gateway coverage.
SiliconANGLE covered its agent integrations in 2025 and 2026, and the captured sources name no customer.
Model Armor is priced on usage, with a free tier. TrioTech says all three cloud guardrails price around usage volume, on top of the model call's own compute. It lists a free tier among Model Armor's pros.
Usage also runs against a quota. Google sets a default Model Armor API quota of 1,200 queries per minute per project. Every call made to sanitize content counts against it.
Model Armor runs as a managed Google Cloud service configured per project. Customers define templates for per-request policies and floor settings for a project-wide baseline, and they choose inspect-only or inspect-and-block enforcement.
Operations need planning around quota and failure modes. The default API quota is 1,200 queries per minute per project. If Model Armor is unavailable in a region, temporarily unreachable, or hits an internal error, the Agent Platform integration continues without screening.
The enforcement default matters in practice. Google's documented Agent Platform setup command enables inspect-only mode. Customers must select blocking to stop traffic that violates their policies.
Model Armor's compliance record belongs to the product. Its compliance page lists HIPAA and FedRAMP High certifications and data residency. Google's FedRAMP and DoD scope page lists Model Armor in its audit-scope table. Its DISA review entry means DoD authorization is still awaited.
Data-handling controls sit inside the screening. In Gemini Enterprise Agent Platform, Model Armor can issue a block verdict to prevent sensitive data from proceeding.
The captured sources contain no detection or false-positive rate. ARMO argues that crafted indirect injections will frequently pass.
Model Armor is a layer inside Google's AI platform. Google integrates it with Gemini Enterprise, Gemini Enterprise Agent Platform, Agent Gateway, Apigee, Service Extensions and Google MCP servers.
Outside Google, the REST API and partner integrations keep it usable. TrueFoundry integrates it into a third-party AI gateway, and TrueFoundry says it works with any model on any cloud.
It shares ground with other controls. Blueinfy lists Checks Guardrails as a separate Google runtime safety feature. ARMO notes that Model Armor was not designed to observe what an agent does after a response.
Google builds and operates Model Armor, and the reviewed sources name no team or leader specific to it. SiliconANGLE quotes Francis deSouza, Google Cloud's president of security products, on the April 2026 launches.
InfoQ relays Google's statement that AI Protection, which uses Model Armor, draws on security research from Google and Mandiant. The cited outside sources contain no assessment of the people behind the line.
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.