Mindgard

• Platform vendors that consolidated the category, Check Point through its Lakera agreement and Palo Alto Networks through its completed Protect AI purchase, could fold automated AI red teaming into broader suites and undercut a standalone Mindgard purchase before it names commercial references.
• Model providers such as Microsoft could ship native red teaming for the systems built on their own platforms, removing the third-party budget line Mindgard depends on.
• No named paying customer appears in the reviewed sources, so buyers who require current named references could stall enterprise deals.
• Mindgard's pipeline depends on the guardrail-bypass disclosures it publishes, so vendors patching those guardrails, as Microsoft did with stronger Azure mitigations, could erode the research that drives its inbound interest.
• The founder moved from chief executive to Chief Science Officer in 2025 and an outside CEO took over, so if the enterprise sales motion does not take hold the research lead could outlast the commercial runway disclosed in the 2024 seed.
• Switching cost stays low while testing findings are advisory rather than embedded in production controls, so a buyer can drop the subscription until the Defend runtime module matures into a daily dependency.

Mindgard treats the AI models, agents, and applications an enterprise runs as assets attackers target directly, and sells automated adversarial testing to find the flaws before deployment. The company frames the problem as runtime-specific, the prompt-injection and jailbreak weaknesses that exploit a model's probabilistic behavior and only appear once a system is live, which traditional application security tools were not built to catch.

Independent evidence corroborates the pain beyond vendor marketing. A 2025 paper from Mindgard's team, accepted to the LLMSec workshop, showed that six guardrail systems including Microsoft's Azure Prompt Shield could be evaded with up to 100 percent success, and CSO Online and Hackread covered the related Azure AI Content Safety bypass independently. Microsoft acknowledged the Azure issue and later deployed stronger mitigations, which establishes the problem as real rather than asserted.

The buyer is the enterprise security team, developer, or red teamer standing up AI in production. Mindgard routes them to a platform that integrates into existing automation, so the offering reads as a testing capability that fits established workflows rather than a separate practice a team must staff and learn. [s2, s8, s9]

The Mindgard platform runs as an autonomous red teamer rather than a fixed checklist. The product chains domain-specific attack techniques across one-shot and multi-step interactions to map the models, agents, and tools in a system, plan attacks, and surface the highest-impact flaws. Findings map to the EU AI Act, the NIST AI Risk Management Framework, the OWASP LLM Top 10, and MITRE ATLAS so a security team can translate them into governance and reporting.

The deployment design targets teams without specialist AI expertise. Mindgard runs through CI/CD pipelines, the Burp Suite proxy, or a single click, and a public documentation portal carries a Quickstart and a named Attack Library of LLM and ML techniques, evidence of a shipped product rather than a demo.

The research output demonstrates the same capability the product sells. The LLMSec 2025 paper documented character-injection and adversarial-machine-learning bypasses of Microsoft's Azure Prompt Shield and Content Safety filters, work that CSO Online and Hackread covered, which validates that the team can find the complex flaws the platform automates. [s2, s6, s8]

Mindgard competes in automated AI red teaming against both independent specialists, such as Adversa AI and Repello AI, and broader AI-security platforms, such as HiddenLayer, alongside the platform vendors that bought the category around it. The 2025 consolidation puts overlapping adversarial testing inside larger suites.

Mindgard's visible differentiator is the depth and independence of its research. The company came out of more than a decade of academic work at Lancaster University, where founder Peter Garraghan has published more than 60 research articles, and it publishes guardrail-bypass findings that outside outlets cover, which gives it a profile larger than its headcount would predict. That research is the part a bundled competitor would take the longest to reproduce.

The structural risk is who owns the buyer. Check Point agreed to acquire Lakera and Palo Alto Networks completed its purchase of Protect AI in 2025, so platform vendors can bundle red teaming into deals an enterprise already signs, and the model providers whose guardrails Mindgard probes could test the systems built on their own platforms. [s8, s12, s13]

Research is Mindgard's clearest go-to-market engine, and it points outward rather than at named accounts. The team's guardrail-bypass findings against Microsoft Azure and other targets drew independent coverage from CSO Online and Hackread, which builds inbound awareness and positions the company as a research authority. This is demand generation through public findings rather than evidence of paid deployments.

Verifiable commercial proof is thin. The about page records Fortune 500 design partners in 2026 but names none, and the other signals on offer are awards and the publicized guardrail-bypass disclosures, not named paying references. The 8 million dollar seed that .406 Ventures led in December 2024 funds the build, but the paying buyers themselves are not yet visible.

The motion is early, opening through a booked demo rather than self-serve signup. Mindgard leans on a low-friction first scan through CI/CD and Burp Suite and on its research brand to open enterprise conversations. Named references would be the signal that the inbound attention its disclosures generate has converted into deployments. [s4, s11, s9]

The founding story pairs academic depth with offensive-security craft. Peter Garraghan founded Mindgard on his Lancaster University research and is a professor and EPSRC Fellow there with more than 60 published research articles, and the company is spun out from over a decade of AI security research at Lancaster. The bench is unusually research-heavy for the stage.

The research record is the team's strongest public signal. Mindgard has published a stream of in-domain adversarial work, including the LLMSec 2025 guardrail-evasion paper and the documented bypass of Microsoft's Azure Prompt Shield and Content Safety filters that independent outlets covered. This is a sustained publication pattern in the company's own product domain rather than a single covered event.

The leadership matured as the company scaled. Garraghan led as chief executive through the 2024 raise and moved to Chief Science Officer in 2025, when Mindgard brought in James Brear as chief executive alongside the senior research and offensive-security hires Aaron Portnoy and Rich Smith, separating the founder's research role from the commercial leadership the next stage demands. [s14, s8, s4]

Mindgard publishes the trust artifact a security buyer checks first. The site displays an AICPA SOC 2 Type 2 badge in the footer, which gives a procurement team a starting point rather than only a sales conversation. No inspectable trust portal or downloadable report surfaces in the fetched pages beyond that badge.

The deeper trust question is the one any offensive testing vendor faces. Mindgard's product probes a customer's proprietary AI systems and the Defend module sits inline in production, so a security review will ask where the testing runs and what data leaves the environment. The pages reviewed describe integration through CI/CD and proxies but do not lay out the data-handling and isolation detail a regulated buyer would press on, which is the readiness item most likely to surface in a deal. [s15, s5]

Add analyzed competitors to compare them side by side with Mindgard.

Mindgard sells to the enterprise security team, developer, or red teamer standing up AI in production. The company frames its buyer as an enterprise that needs to discover, assess, and defend the AI models, agents, and applications it runs, and routes that buyer through a platform rather than a consulting engagement. The pain it names is AI-specific, the prompt-injection and jailbreak weaknesses traditional application security tools were not built to catch.

The segment is the upper enterprise reached through direct sales. The about page records Fortune 500 design partners in 2026 as the demand signal, and the entry point is a booked demo rather than self-serve signup, the shape of a vendor selling negotiated enterprise deals. Incorporated in the UK in 2022 and now headquartered in Boston and London, Mindgard reaches both US and UK enterprise buyers.

The segmentation widens by surface rather than by buyer. Mindgard spans discovery, reconnaissance, automated attack, and runtime defense on one platform, so it can address an enterprise across the AI lifecycle regardless of which models it runs. That breadth puts it against both independent AI red-teaming specialists and the platform vendors that bought adjacent runtime AI security companies in 2025.

Mindgard runs as an autonomous red teamer rather than a fixed checklist. The product chains domain-specific attack techniques across one-shot and multi-step interactions to evaluate how models reason and behave under pressure, and tests complete AI systems rather than isolated models, capturing how agents, tools, APIs, and data sources interact. Findings map to the EU AI Act, the NIST AI Risk Management Framework, the OWASP LLM Top 10, and MITRE ATLAS for governance and reporting.

The deployment design targets teams without specialist AI expertise. Mindgard deploys through CI/CD, the Burp Suite proxy, or a single click, and surfaces high-impact findings with attacker context and remediation guidance that teams send into existing tooling and ticketing systems.

The verifiable footprint is strong for the category. A public documentation portal carries a Quickstart and a named Attack Library, evidence of a shipped product rather than a demo, and the LLMSec 2025 paper showing up to 100 percent evasion of six guardrail systems including Microsoft's Azure Prompt Shield validates that the team can find the complex flaws the platform automates. The accumulating attack library plus a decade of Lancaster research is the part a rival would take the longest to match, since the frontier models are ones every competitor can license.

Research is Mindgard's clearest go-to-market engine, and it points outward rather than at named accounts. The team's guardrail-bypass disclosures, including the Azure AI Content Safety bypass that CSO Online and Hackread covered, build inbound awareness and position the company as a research authority. This is demand generation through public findings rather than evidence of paid deployments.

Commercial proof stays thin. The about page records Fortune 500 design partners in 2026 but names none, and the other signals on offer are awards and the publicized guardrail-bypass disclosures, not named paying references. No paying customer speaks in its own voice in the fetched sources.

The motion is early and demo-led. Mindgard leans on a low-friction first scan through CI/CD and Burp Suite and on its research brand to open enterprise conversations, with a booked demo as the entry point. The 8 million dollar seed that .406 Ventures led in December 2024 funds the build, and named references would be the signal that inbound attention has converted into deployments.

Mindgard publishes no public price, so the charged unit and list price stay private. Every conversion path on the site routes to a booked demo rather than a rate card or free tier, the posture of a vendor selling negotiated enterprise deals to the Fortune 500 buyer it names. The absence withholds the budget-anchoring signal some peers publish.

The buying unit is not publicly answerable from the record. Because the platform tests AI systems and the Defend module sits in the production request flow, cost would plausibly track the number of systems tested or the volume of traffic screened, but that is inference rather than a published unit.

The inferable belief is that buyers pay for assurance over a moving AI attack surface rather than for a fixed feature set. Confirming the unit and whether testing volume is capped would require a sales conversation, which the demo-only posture signals is the intended path.

Mindgard delivers as software the customer connects to its own AI systems and runs, not as a managed engagement. The platform flow is connect, launch automated discovery and assessment, integrate findings into security workflows, and remediate, with the customer operating the tests and consuming the reports. A team can bring its own techniques to test its systems its way.

The operational job follows a moving attack surface rather than a static rule set. Mindgard runs recon, safety, and adversarial evaluations, deploys through CI/CD and Burp Suite, and the Defend module continuously monitors prompts, responses, and agent actions to block malicious behavior in production. Published uptime or support service-level commitments do not surface in the fetched pages.

The runtime module raises the heavier operational question. A control that sits in the production AI request flow becomes a dependency whose latency and availability a careful buyer examines, and the fetched pages describe the blocking behavior but not the data-handling and isolation detail a regulated buyer testing its own proprietary models would press on.

Mindgard publishes the trust artifact a security buyer checks first. The site displays an AICPA SOC 2 Type 2 badge in the footer, confirmed in the rendered page, which gives a procurement team a starting point rather than only a sales conversation. No inspectable trust portal or downloadable report surfaces in the fetched pages beyond that badge.

The research record adds to that assurance. The LLMSec 2025 paper and the documented bypass of Microsoft's Azure AI Content Safety filters, which CSO Online covered along with Microsoft's response, are public evidence that the team understands the attacks the product runs, an in-domain signal a buyer can weigh alongside the attestation. Findings also map to the EU AI Act, NIST AI RMF, OWASP, and MITRE ATLAS, which helps a buyer translate results into its own compliance reporting.

The deeper trust question is the one any offensive testing vendor faces. Because Mindgard's product probes a customer's proprietary AI models and its Defend layer sits inline in production, a security review will ask where the testing runs and what data leaves the environment, the readiness item most likely to surface in a regulated deal beyond the published badge.

Mindgard positions itself as the security control point across an enterprise's AI estate rather than a point tool. It spans discovery of agents and shadow AI, reconnaissance, automated attack, and runtime defense on one platform, and tests complete AI systems including agents, tools, APIs, and data sources rather than isolated models. The platform claim rests on covering the full attack surface an enterprise exposes when it adopts AI.

Outward, the company reaches buyers as model-agnostic coverage that works regardless of which AI tools an enterprise runs. By deploying through CI/CD and Burp Suite and sending findings into existing security tooling and ticketing systems, Mindgard fits established workflows rather than asking a team to adopt a separate practice.

The exposure is who owns the buyer. Palo Alto Networks completed its purchase of Protect AI and Check Point agreed to acquire Lakera in 2025, so platform vendors can bundle equivalent red teaming into deals an enterprise already signs, and the model providers whose guardrails Mindgard probes could test the systems built on their own platforms.

Mindgard's credibility comes from an academic research lineage that is unusual for the stage. Founder Peter Garraghan is a Lancaster University professor and EPSRC Fellow with more than 60 published research articles, now Chief Science Officer, and the company is spun out from over a decade of AI security research at Lancaster. The Azure AI Content Safety bypass the team disclosed, and the LLMSec 2025 guardrail-evasion paper, show the craft is in-domain rather than a single unrelated finding.

The leadership matured as the company scaled. The about page records a 2025 milestone of expanded leadership with key hires, an outside chief executive in James Brear, alongside the senior research and offensive-security hires Aaron Portnoy and Rich Smith, separating the founder's research role from the commercial leadership the enterprise stage demands. Brear previously led Swimlane, a security automation company, before joining Mindgard.

The verifiable strength is the research record and the named senior leaders, with the open item the depth of the commercial organization. The 8 million dollar seed that .406 Ventures led in December 2024 funds the build, and whether the new leadership converts the research brand into a paying book of business is what the team has yet to prove publicly.