All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Guardion AI sells a runtime security layer for AI agents: an inline gateway and its own guardrail model that block prompt-injection attacks and strip sensitive data from what agents send and receive. The big cloud AI platforms now ship overlapping guardrail controls, and Guardion's own benchmark compares it against third-party guardrails and open-source models (s2, s6). Its distinct attributes in the record: a team with Apple and Nubank experience, a guardrail model trained across eight-plus languages (s2) with no per-language competitor benchmark, and a seat in Brazil's ANPD regulatory sandbox. Its named customers are still private and its headline benchmark is its own, so the regional regulatory foothold, more than the guardrail, is what a buyer can weigh today.
| Description | Guardion AI is a runtime governance platform that runs inline as a security gateway or Guard API, giving security teams real-time visibility, enforcement, and evidence across customer-facing, autonomous, and coding AI agents. | [f1] |
|---|
| Product | What it does |
|---|---|
| Guardion AI | Inline security gateway and Guard API enforcing runtime guardrails, PII redaction, and policy on every LLM, agent, and MCP call, with observability and tamper-evident audit. |
| ModernGuard | Multilingual guardrail model series built on ModernBERT and trained on proprietary data to detect prompt-injection and jailbreak attacks across many languages. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Orchestration Tools Agentic orchestration tools, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients on user devices. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Gateways & Routers MCP proxies and gateways, LLM routers, outbound AI-service traffic, shadow AI egress, and model-registry traffic. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, AIBOM, and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
Guardion AI runs runtime guardrails and an inline security gateway that detect and block prompt injection and jailbreaks, redact PII, and enforce policy on every LLM, agent, and MCP call. These capabilities are mapped to the AI Defense Matrix. [f2]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | Guardion names a clear buyer, security teams putting AI agents into production, and a concrete pain in agents acting without oversight, a risk Brazil's ANPD sandbox description also names, but the harm stays qualitative and category-generic rather than independently quantified, matching the present-but-unproven default. [s4, s5, s3] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 3/5 | Guardion runs its own ModernGuard model on a ModernBERT encoder and publishes architecture detail and a benchmark, real capability substance, but the headline 0.986 result comes from the company's own leaderboard with no independent evaluation, holding it at the vendor-evidenced default rather than the independently validated tier. [s2, s6, s3] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 4/5 | Guardion sells inline controls for LLM and MCP agent traffic, and independent bodies organized around that risk in the cited record: Brazil's ANPD opened an AI sandbox and Google ran a Latin America AI-cybersecurity accelerator in 2025, multiple corroborated demand signals short of the accelerating, independently established depth a 5 needs. [s4, s5, s3] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | Brazil's ANPD independently describes the developer, Metatext, as a global group of AI engineers and researchers with experience at Apple, Nubank, and the University of São Paulo, verifiable senior domain pedigree, but with no prior security-product exit or sustained publication record it holds at the default rather than the differentiated tier. [s4, s1] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 2/5 | Guardion cites production use by large Latin American fintechs and 50 million agent actions a month but names no customer and discloses no revenue, so the traction is unnamed. Selection by Google's accelerator and Brazil's ANPD and backing from Entrepreneurs First are indirect signals that lift it above absent, short of the named references a 3 needs. [s1, s5, s4] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | Guardion ships a working gateway and a trained guardrail model with accelerator backing, no disclosed funding amount, and a small team, visible output for the money, but with no disclosed revenue, margin, or growth-efficiency figure the efficiency itself is unconfirmed, the honest default for an early startup. [s1, s2] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 3/5 | Guardion fits a recognizable and increasingly named category, runtime security and guardrails for AI agents, but the space is crowded and contested with many similar entrants, and its EDR-for-AI framing still needs vendor explanation, matching the recognizable-but-nascent default. [s3, s5, s1] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | The inline-guardrail function is being built into the large cloud AI platforms and sold by a dozen startups, so it is broadly absorbable, but Guardion's own multilingual model and Latin American regulatory position add some friction short of a structural moat. [s3, s2, s4] |
Guardion AI treats the running AI agent as the asset under attack. The company sells runtime security for enterprises putting agents and large language models into production, where a prompt-injection attack, a leaked credential, or an over-broad tool call happens live, after the code has shipped. Brazil's data-protection regulator frames the same gap when it describes agents running without visibility into their behavior or a way to trace an incident to a user.
The problem is recognized beyond Guardion's own pages. Google selected the company for its inaugural Latin America AI-cybersecurity accelerator in 2025, and Brazil's ANPD chose Metatext, Guardion's developer, for a regulatory sandbox on AI risk. Independent bodies building programs around agent security point to a real, emerging problem, though the depth of buyer demand for a standalone tool is not established in the public record. [s4, s5, s3]
Guardion AI enforces security at the point where an agent acts. Its inline gateway sits in front of the models, agents, and tool servers an organization runs, or teams call a Guard API directly, and either mode screens every request and response without application rewrites. The controls block prompt injection and jailbreaks, redact sensitive data before it leaves the organization, and record tamper-evident logs that export to a security team's existing tools.
The differentiating engineering is Guardion's own model rather than a generic filter. ModernGuard, built on a ModernBERT encoder and trained on the company's data, classifies prompt attacks and is tuned for languages that broad commercial filters serve poorly. Guardion publishes the model openly and reports it scoring 0.986 on its own prompt-attack benchmark.787, a result the company publishes itself rather than an independent evaluation. [s3, s2, s6]
Guardion competes in a crowded runtime-guardrail market and against the platforms absorbing it. A dozen startups sell a near-identical inline control, and the big cloud AI platforms now ship guardrails, prompt-injection filtering, and data redaction as built-in features of products enterprises already buy. Bundling is the pattern a buyer should weigh, since the platforms Guardion competes against ship these controls inside products enterprises already buy.
Guardion's answer is to compete where the platforms are weakest. Its model covers under-served languages, and its early users and regulatory relationships sit in Latin America, a market the global vendors address generically. That regional, multilingual, regulation-ready position is the company's stated edge rather than the guardrail mechanism itself. [s3, s2, s4]
Guardion's traction depends on unnamed references and program selections rather than named customers. The company says it runs in production at large Latin American fintechs and screens more than 50 million agent actions a month, but it names no customer and discloses no revenue, so the scale claims cannot be checked independently. No named account appears in the public record.
What is verifiable is reputational. Google selected Guardion for its Latin America AI-cybersecurity accelerator, Brazil's ANPD chose its developer Metatext for a regulatory sandbox, and Entrepreneurs First backs the company. These are credible third-party signals of promise, and they support a modest lift above no evidence, but none is a paying, referenceable customer. [s5, s4, s1]
Guardion's team carries verifiable, relevant pedigree. Brazil's data-protection regulator describes Metatext, Guardion's developer, as a global group of AI engineers and researchers with experience at Apple, Nubank, and the University of São Paulo, and the company says its founders worked on Apple's Siri.
That background is senior and on-point without reaching the top tier. The team shows no prior security-product exit, no sustained publication record, and no independent recognition of the kind that marks a category-defining founder. The Apple and Nubank names lend credibility, but the evidence supports competent domain experience rather than a proven track record. [s4, s1]
Guardion has no completed security attestation in the public record. The company states its SOC 2 Type II is in progress and describes readiness for GDPR, HIPAA, and Brazil's LGPD, but readiness is not certification, and a probe of the homepage, the trust subdomain, and the security path on 2026-07-03 found no published report or trust portal. The vendor's own statement that certification is in progress is the strongest signal here.
The regulatory engagement is real but different from an attestation. Selection into Brazil's ANPD AI sandbox and alignment with an industry AI-risk framework show active compliance work, and for Latin American regulated buyers that engagement matters. It eases a buyer's diligence without yet proving the controls to an auditor. [s1, s7, s4]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Prompt Security | competes with | Runtime LLM and agent guardrail vendor overlapping Guardion's inline prompt-injection and data-protection controls. | |
| Lakera | competes with | Runtime AI guardrail and red-teaming specialist whose Guard model Guardion benchmarks its own model against. | |
| Gray Swan AI | competes with | Sells Cygnal, an inline runtime guardrail that screens prompts, responses, and agent tool calls, the same control Guardion offers. | |
| Operant AI | competes with | Runtime defense for live AI apps and agents with inline redaction and MCP protection, overlapping Guardion's gateway. | |
| Amazon Web Services | adjacent | Amazon Bedrock Guardrails bundles prompt-injection filtering and content controls into the cloud platform, the absorption Guardion's standalone tool faces. | N/AAmazon Web Services is scored by product line, not as a whole company, so there is no company-wide column to compare. Open its profile to compare a specific product. |
| Palo Alto Networks | adjacent | Platform vendor whose Prisma AIRS line folds AI runtime guardrails into suites enterprises already buy. | N/AWe scored these companies at different scopes, so the totals measure different things. |
Add analyzed competitors to compare them side by side with Guardion AI.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
pivot urgently
Guardion AI's differentiators are mostly reproducible by a funded rival, the honest read on its durability. Guardion's own benchmark names third-party guardrail rivals (s2, s6). The narrower exception is switching cost. Once agents route through its inline gateway and its tamper-evident logs feed the customer's SIEM, leaving means re-plumbing that enforcement, real friction short of network effects. Harder to copy are a guardrail model trained across eight-plus languages, per-language rival coverage unbenchmarked, and an ANPD sandbox seat. The record documents no named account and no completed attestation, so Guardion is most defensible where language coverage and Latin American regulation matter, weakest where a general-purpose guardrail is enough.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Guardion delivers software the customer connects and runs, an inline gateway and a Guard API offered as SaaS or self-hosted with a 30-day onboarding engagement, rather than an ongoing analyst-staffed service that accepts accountability for the security outcome, the software-product level. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | The inline gateway sits between an agent and the models and tools it calls, and its tamper-evident logs feed the customer's SIEM, so once policies and coverage route through it, leaving means re-plumbing that enforcement, real friction short of network effects or mandated data residency. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | Guardion's SOC 2 Type II is in progress rather than attained and its GDPR, HIPAA, and LGPD posture is self-described readiness, so no completed attestation or regulatory mandate raises a barrier, table-stakes rather than a moat, and its ANPD sandbox participation is a diligence signal rather than a compliance barrier. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Training a fine-tuned prompt-attack model on a ModernBERT encoder, enforcing guardrails inline at low latency across many languages, and redacting sensitive data as it flows between an agent and the model is applied machine-learning and adversarial-AI work at the hard tier. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 2/3 | The buyer is the enterprise security and platform team, credible and high-value, but Guardion's evidence reduces to unnamed Latin American fintech references with no named regulated customer on the record, so it holds at the cluster level rather than the procurement-gated roster a 3 needs. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | Guardion runs one guardrail-and-gateway layer beside the models, agents, and tool servers it inspects rather than infrastructure the workload cannot run without, and it depends on the LLM and MCP calls it does not own. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 | ModernGuard is trained on data the company calls its own but does not name, and a self-published benchmark is an asset a funded rival could rebuild, with no production-feedback loop or named non-public corpus documented, so nothing compounds into a content moat. |
Guardion sells to the enterprise security and platform teams responsible for AI agents in production, and its evidence concentrates in one region and vertical. The named signals, production use at Latin American fintechs and selection into a Brazilian regulatory sandbox and a Google Latin America accelerator, point to regulated financial services in Latin America as the beachhead.
The buyer is credible and high-value, but the company has published no named account. The segment it actually sells to is clearer by geography than by a referenceable customer list.
Guardion's technical advantage is its own guardrail model rather than a wrapper over a generic filter. ModernGuard, built on a ModernBERT encoder and trained on the company's data, classifies prompt attacks across many languages and runs inline as a gateway or through a Guard API without application rewrites.
Guardion publishes benchmark results showing the model at 0.986 against Lakera Guard at 0.787 on its own prompt-attack test. That is a real engineering result, but one the company publishes itself, so an independent evaluation would carry more weight than the vendor leaderboard.
Guardion's go-to-market leans on program credibility rather than a proven sales motion. The company earns visibility through selection into Google's Latin America AI-cybersecurity accelerator, Brazil's ANPD sandbox, and Entrepreneurs First, and it markets an embedded-engineer onboarding that replaces an in-house build.
What it has not shown publicly is a repeatable, referenceable sales record. No named customer, no disclosed revenue, and no independent account of how deals close appears in the record.
The reviewed sources capture no published price points, and the homepage shows both free-trial and demo calls to action with a pricing page, so the public record does not settle whether the motion is self-serve, usage-based, or negotiated. Its framing that an embedded engineer replaces roughly a year and several engineers of in-house work signals value-based positioning against the cost of building it yourself.
Without a published unit of charge, what a buyer ultimately pays for, per call, per agent, or per seat, is not established in the public record.
Guardion delivers as software the customer connects and runs, in two modes: an inline security gateway in front of models, agents, and tool servers, or a Guard API called from code, both marketed as zero-instrumentation. Operations lean on the customer's own stack, with tamper-evident logs exported to the buyer's existing security tools and a 30-day embedded-engineer onboarding to reach production.
The delivery is a control the customer operates, not a managed service that runs it for them.
Guardion has active compliance work but no completed attestation on the public record. It states its SOC 2 Type II is in progress and describes readiness for GDPR, HIPAA, and Brazil's LGPD, and a probe of its homepage, trust subdomain, and security path on 2026-07-03 found no published report or trust portal.
Its selection into Brazil's ANPD AI sandbox is a genuine regulatory engagement that helps a Latin American buyer's diligence, without yet proving controls to an auditor.
Guardion positions as a neutral layer across the AI stack, integrating with any model, framework, and tool server rather than locking to one. It advertises integration across models, frameworks, and tool servers and treats coding agents as a first-class case, which widens its reach.
That breadth also defines its exposure. A layer that sits beside the platforms can be replaced by a guardrail those platforms build in, so its ecosystem value is integration reach, not a position the incumbents depend on.
Guardion's team is its strongest asset on paper. Brazil's data-protection regulator describes the developer, Metatext, as a global group of AI engineers and researchers with experience at Apple, Nubank, and the University of São Paulo, and the company says it was built by the engineers who secured Siri.
The pedigree is senior and relevant. The record shows no prior security-product exit or sustained public research of the kind that marks a category-defining founder.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Guardion AI: Agent Runtime Security | official | 2026-07-09 |
| f2 | AI Defense Matrix Catalog mapping | other | 2026-07-03 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | Guardion AI homepage (inline gateway or Guard API, LatAm fintech use, +50M agent actions/month, Siri-engineer team, Entrepreneurs First backing) “Trusted in production by the largest fintechs in LatAm ... +50M Agent actions / month protected ... Built by the engineers who secured Siri ... all logs are tamper-evident and exportable to your SIEM ... SOC 2 Type II, in progress” | official | 2026-07-03 |
| s2 | ModernGuard blog: self-run prompt-attack benchmark and ModernBERT architecture “GuardionAI/ModernGuard | 0.986 ... Lakera Guard | 0.787 ... Built on a cutting-edge ModernBERT encoder” | official | 2026-07-03 |
| s3 | Guardion AI (AI Defense Matrix Catalog): runtime guardrail platform and inline gateway “Runtime guardrail platform and inline security gateway that detects and blocks prompt injection, jailbreaks, and unsafe agent actions, and redacts PII across LLM and MCP calls.” | other | 2026-07-03 |
| s4 | Brazil ANPD AI regulatory sandbox: Metatext (developer of Guardion.AI) selected, team from Apple, Nubank, USP “A Metatext é a desenvolvedora da Guardion.AI, plataforma de segurança para inteligência artificial ... A Metatext é formada por um time global de engenheiros e pesquisadores especialistas em IA com experiência na Apple, Nubank e USP.” | regulatory | 2026-07-03 |
| s5 | Google for Startups Accelerator: AI for Cybersecurity Latin America cohort names GuardionAI (Brazil) “the 11 startups selected for our inaugural Google for Startups Accelerator: AI for Cybersecurity program in Latin America ... GuardionAI (Brazil): An AI security platform that protects AI agent systems” | press | 2026-07-03 |
| s6 | Guardion AI vendor-hosted runtime-guardrail and LLM security benchmark (self-compared) “Independent benchmarks that show how AI models and AI runtime guardrails fail under real adversarial pressure, before they fail in production.” | official | 2026-07-03 |
| s7 | Guardion AI trust-surface probe 2026-07-03: homepage footer states SOC 2 Type II in progress; no trust portal (trust. subdomain absent, /security not published) “SOC 2 Type II, in progress ... GDPR · HIPAA · LGPD” | official | 2026-07-03 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | Guardion AI homepage (inline gateway and Guard API, 30-day onboarding, Siri-engineer team, Entrepreneurs First backing, LatAm fintech use) “A Guardion engineer embeds with your team for 30 days. Replaces the ~12 months and 3+ engineers it takes to build this in-house ... Either way it is zero-instrumentation ... all logs are tamper-evident and exportable to your SIEM ... SOC 2 Type II, in progress” | official | 2026-07-03 |
| s2 | ModernGuard blog: self-run prompt-attack benchmark and ModernBERT architecture “GuardionAI/ModernGuard | 0.986 ... Lakera Guard | 0.787 ... Built on a cutting-edge ModernBERT encoder” | official | 2026-07-03 |
| s3 | Guardion AI (AI Defense Matrix Catalog): runtime guardrail platform and inline gateway “Runtime guardrail platform and inline security gateway that detects and blocks prompt injection, jailbreaks, and unsafe agent actions, and redacts PII across LLM and MCP calls.” | other | 2026-07-03 |
| s4 | Brazil ANPD AI regulatory sandbox: Metatext (developer of Guardion.AI) selected, team from Apple, Nubank, USP “A Metatext é a desenvolvedora da Guardion.AI, plataforma de segurança para inteligência artificial ... A Metatext é formada por um time global de engenheiros e pesquisadores especialistas em IA com experiência na Apple, Nubank e USP.” | regulatory | 2026-07-03 |
| s5 | Google for Startups Accelerator: AI for Cybersecurity Latin America cohort names GuardionAI (Brazil) “the 11 startups selected for our inaugural Google for Startups Accelerator: AI for Cybersecurity program in Latin America ... GuardionAI (Brazil): An AI security platform that protects AI agent systems” | press | 2026-07-03 |
| s6 | Guardion AI vendor-hosted runtime-guardrail and LLM security benchmark (self-compared) “Independent benchmarks that show how AI models and AI runtime guardrails fail under real adversarial pressure, before they fail in production.” | official | 2026-07-03 |
| s7 | Guardion AI trust-surface probe 2026-07-03: homepage footer states SOC 2 Type II in progress; no trust portal (trust. subdomain absent, /security not published) “SOC 2 Type II, in progress ... GDPR · HIPAA · LGPD” | official | 2026-07-03 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.