Mindgard

• Check Point and Palo Alto Networks could bundle AI red teaming into the AI security suites their enterprise customers already buy, which could undercut a separate Mindgard purchase.
• Model providers whose guardrails Mindgard tests, such as Microsoft, could add native adversarial testing for systems built on their platforms and shrink the budget for third-party AI red teaming.
• Buyers who require named references could slow enterprise deals, because Mindgard publishes its customer stories without naming the customers.
• Open-source tools that Mindgard compares itself against, such as Garak, PyRIT and Promptfoo, could satisfy security teams willing to run and interpret the testing themselves.
• Customers using Mindgard for periodic assessments may have less work to redo when switching than teams that integrate its regression testing and ticketing into their release process.

Mindgard sells security testing for the AI models, agents and applications an enterprise runs. It builds the platform for security and engineering teams accountable for AI systems in development and production, and it tests for weaknesses such as prompt injection, jailbreaks, system prompt leakage and unsafe tool use.

Outside outlets have reported Mindgard's findings in widely used AI products. CSO Online reported that Mindgard found ways around Microsoft's Azure AI Content Safety filters and that Microsoft strengthened those filters in response. SecurityWeek reported a Mindgard finding that Cursor on Windows could run code when a developer opened a repository.

Mindgard frames the demand around AI that keeps changing. It argues that each update to a model, prompt, tool or permission can open a new attack path, which is why it sells testing that reruns as those systems change. [s1, s2, s14, s18]

The Mindgard platform runs a discover, recon, attack and defend process. It identifies AI models, agents, servers and connected tools. It profiles how a system behaves, plans attack chains from that reconnaissance, and runs one-shot and multi-step attacks to validate which weaknesses an attacker could exploit.

Teams can run it without in-house AI security specialists. Mindgard deploys through CI/CD, Burp Suite or a single click. Teams can route findings into ticketing and security tools and map them to the OWASP Top 10 for LLM Applications, MITRE ATLAS, the NIST AI Risk Management Framework and the EU AI Act. Mindgard's public documentation includes a Quickstart, a CLI guide and an Attack Library of LLM and ML techniques.

Mindgard also sells runtime detection and response that monitors AI systems in real time and responds automatically, using what its reconnaissance and testing learned. Alongside the platform it sells services, including AI pentesting by its researchers and a subscription that gives a team access to an offensive security specialist. [s1, s2, s3, s5, s6, s9]

Mindgard competes with other AI security platforms and with open-source testing tools. On its homepage, Mindgard names Noma, Gray Swan, Straiker and HiddenLayer as platforms with overlapping capabilities, and it compares itself with the open-source tools Garak, PyRIT and Promptfoo, which teams configure and run themselves.

Large security vendors also sell AI red teaming. Check Point agreed to acquire Lakera in 2025 and lists Check Point AI Red Teaming among Lakera's flagship products, and Palo Alto Networks completed its purchase of Protect AI that year and includes AI red teaming in Prisma AIRS. Both vendors can offer AI red teaming to enterprises that already buy their broader security products. A Mindgard blog post summarizing S&P Global coverage lists Protect AI, Lakera, CalypsoAI and SPLX among the companies in the space.

Mindgard positions its research as its difference. It says it feeds intelligence from more than 150 publicly disclosed AI vulnerabilities into a proprietary knowledge base inside the platform, and it lists those disclosures on its website. [s1, s10, s21, s22, s8]

Mindgard sells to enterprises through booked demos, and it prices each deal to the customer's environment and requirements. Its customer stories describe an insurance company, a healthcare AI platform, a global development and financial institution, a semiconductor manufacturer, a highly regulated enterprise and an enterprise technology services provider, identified by industry only. A buyer that wants references to call would need to request them from Mindgard.

The company's own account of its traction is broader. It lists Fortune 500 design partners as a 2026 milestone. At its Series A, Mindgard said deployments had accelerated at Fortune 2000 companies in financial services, pharmaceuticals, gaming, digital services, semiconductors and healthcare, according to SiliconANGLE.

Funding grew in August 2026. Album VC led a $30 million Series A, with Karma Ventures joining existing investors .406 Ventures, Atlantic Bridge, IQ Capital and Lakestar, and Mindgard said it would spend the money on product, engineering, sales and marketing. [s2, s4, s7, s16, s17]

Mindgard pairs academic AI security research with offensive security leadership. Founder Peter Garraghan, now Chief Science Officer, is a Lancaster University professor and EPSRC Fellow who directs the university's Secure AI laboratory and has published more than 80 research articles. Mindgard grew out of more than a decade of AI security research at Lancaster.

James Brear became chief executive in October 2025 after running Swimlane, and Rich Smith is VP of Research. Chief Product Officer Aaron Portnoy ran the Zero Day Initiative and built Pwn2Own's first six contests, according to The Hacker News.

The team publishes its work continuously. Mindgard reports 156 vulnerabilities to affected vendors, with 132 accepted and 98 patched, and founder Peter Garraghan co-authored an arXiv preprint on evading six guardrail systems, including Microsoft's Azure Prompt Shield and Meta's Prompt Guard. [s4, s11, s13, s19, s20, s8]

Mindgard displays an AICPA SOC 2 Type 2 badge in its site footer and describes itself as SOC 2 Type II compliant on its red-teaming page, which gives a procurement team an attestation to request.

For a security reviewer, the question about an offensive testing vendor is how its testing touches the customer's systems. Mindgard says it defines environments, credentials, permitted actions and operating limits with the customer before testing begins and reviews endpoint, authentication, deployment and data-handling requirements with its security team. [s1, s2]

Add analyzed competitors to compare them side by side with Mindgard.

Mindgard sells to the security and engineering teams accountable for AI systems in development and production, including application security, product security, red team, AI engineering and governance teams. A Mindgard blog post summarizing S&P Global coverage describes its focus as organizations building or adopting AI at scale, from technology providers and software vendors to large enterprises.

The customers Mindgard describes sit in regulated and technical industries. Its customer stories cover an insurance company, a healthcare AI platform, a global development and financial institution, a semiconductor manufacturer, a highly regulated enterprise and an enterprise technology services provider. At its Series A, Mindgard said it had deployments at Fortune 2000 companies in financial services, pharmaceuticals, gaming, digital services, semiconductors and healthcare.

Mindgard has headquarters in Boston and London. It incorporated in the UK in 2022 and opened its US headquarters in Boston when James Brear became chief executive in October 2025.

Mindgard runs as an autonomous red teamer for AI systems. The platform identifies AI models, agents, servers and connected tools. It profiles how a system and its guardrails behave, plans attack chains from that reconnaissance, and runs one-shot and multi-step attacks to show which weaknesses an attacker could exploit. It then gives teams remediation guidance and retests the fixes.

Mindgard ties the platform to its research. It says it feeds insights from more than 150 publicly disclosed AI vulnerabilities into a proprietary knowledge base that strengthens how the platform finds new attack paths. Mindgard reports 156 vulnerabilities reported to affected vendors, 132 accepted and 98 patched. An arXiv preprint co-authored by founder Peter Garraghan showed character-injection and adversarial machine-learning techniques evading six guardrail systems, in some cases with up to 100% success.

Outside outlets have reported on the research. CSO Online reported that Mindgard tested filters through its own red-teaming platform using Azure OpenAI. SecurityWeek and The Hacker News covered its July 2026 disclosure of a Cursor flaw that ran code when a developer opened a repository.

Mindgard invites prospective customers to book a demo. The commercial references it publishes are its customer stories and the Fortune 500 design partners it lists as a 2026 milestone on its about page, with the customers unnamed.

Research disclosures give Mindgard an outside audience. CSO Online, SecurityWeek and The Hacker News each reported on a Mindgard finding in a widely used AI product, which puts the company's name in front of security readers.

The August 2026 Series A funds a larger commercial push. Album VC led the $30 million round, and Mindgard said it would expand its product, engineering, sales and marketing teams as customer demand grows.

Mindgard prices each deal to the customer. It says its pricing is based on each organization's environment and requirements.

Mindgard also documents a self-guided start. Its docs include a five-minute Quickstart that tests a demo model and a guide to running a first test through its CLI.

Mindgard delivers software that the customer's team connects to its own AI systems and operates. Teams connect models, agents and applications through APIs, launch reconnaissance and adversarial evaluations or bring their own techniques, and route findings into existing security tooling, ticketing systems and engineering workflows.

Mindgard also sells expertise on top of the software. Its services include AI pentesting in which Mindgard researchers test each control against the OWASP Top 10 for LLM Applications and MITRE ATLAS and deliver a report for auditors, customers and engineers. Mindgard also offers red teaming with partners, technical account management, an AI Security Expert subscription and training. On its red-teaming page, Mindgard offers expert-led testing for bespoke threat models and unusual architectures.

Mindgard also sells runtime detection and response. It says the module monitors AI systems in real time, detects malicious behavior and responds automatically using intelligence from its reconnaissance and testing.

Mindgard displays an AICPA SOC 2 Type 2 badge in its site footer and describes itself as SOC 2 Type II compliant on its red-teaming page. It maps findings to the OWASP Top 10 for LLM Applications, MITRE ATLAS, the NIST AI Risk Management Framework and EU AI Act requirements, which helps a customer use the results in audit reporting.

For a buyer letting an outside platform attack its AI systems, the security question is how the testing is bounded. Mindgard says it agrees on environments, credentials, permitted actions and operating limits before testing begins, and reviews endpoint, authentication, deployment and data-handling requirements with the customer.

Mindgard connects to the tools security and engineering teams already run. It deploys through CI/CD pipelines, Burp Suite or a single click, and it sends findings through APIs and workflow integrations into security tooling and ticketing systems.

Mindgard positions itself against open-source testing tools and broader AI security suites. On its homepage it compares itself with Garak, PyRIT and Promptfoo, which teams must configure, operate and interpret themselves, and it names Noma, Gray Swan, Straiker and HiddenLayer as platforms with overlapping capabilities.

Larger security vendors also sell AI red teaming. Check Point agreed to acquire Lakera in 2025 and lists Check Point AI Red Teaming among Lakera's flagship products, and Palo Alto Networks completed its purchase of Protect AI in July 2025 and includes AI red teaming in Prisma AIRS. Both vendors can offer AI red teaming to enterprises that already buy their broader security products.

Mindgard combines academic AI security research with offensive security leadership. Founder Peter Garraghan, now Chief Science Officer, is a Lancaster University professor and EPSRC Fellow who directs the university's Secure AI laboratory and has published more than 80 research articles, and Mindgard was founded on his Lancaster research.

James Brear became chief executive in October 2025, after running Swimlane and leading Veriflow and Procera, both later acquired, according to Mindgard's announcement. Aaron Portnoy, Chief Product Officer, ran the Zero Day Initiative and built Pwn2Own's first six contests, according to The Hacker News, and Rich Smith is VP of Research.

The team publishes its findings under Mindgard's name. Its disclosures page records 156 vulnerabilities reported to vendors, and SecurityWeek and The Hacker News attributed the Cursor finding to Mindgard and to Portnoy's write-up.