Qualifire

• Every customer reference in the record is presented by the company through a logo link on its own homepage, and no reviewed outside source mentions DoiT, Empire Media, Anodot, or Novacy in connection with it, so a buyer has nothing independent to check a reference against.
• The same LiteLLM directory that distributes Qualifire lists dozens of alternative guardrail providers, among them entries from Amazon, Microsoft, Google, Palo Alto Networks, and CrowdStrike, so a customer already buying from one of those vendors has a guardrail option that adds no supplier.
• The company publishes its prompt-injection model card and its benchmark dataset on Hugging Face under a licence the page labels other, so a competitor can inspect and evaluate the detection it sells rather than infer it, subject to whatever those terms allow.
• The AWS listing the homepage points at for cloud deployment names Rogue Security as its seller and the Hugging Face account holding the judge models carries that name too, while nothing in the reviewed record explains the brand or legal-entity relationship between the two names.
• No compliance attestation was found on the probed surfaces, which will stall deals with buyers whose procurement asks for one before a pilot.
• The ISO 42001 page states that prompts or completions are stored by default with an opt-out, so a customer with regulated or confidential traffic has a configuration change to make before any production traffic reaches it.

The argument is that offline testing cannot tell you how a model will behave in front of a user. Gilad Ivry told CTech that companies invest in development and offline testing to tune behaviour and still have no way of knowing how the model is performing while it is in use, and that Qualifire moves testing to runtime and decides in the milliseconds before the user sees an answer whether it meets the required standards.

The buyer is the team that owns a shipped AI feature. The documentation is addressed to developers wiring a proxy or an SDK into an existing application, and the pricing page sells a free tier and a paid plan listed at $550 per month alongside an enterprise arrangement, which describes a product a developer can adopt without a procurement cycle.

What the reviewed record does not carry is a measure of the pain. The concrete case the founders reach for is an Air Canada chatbot that promised a free ticket against policy, after which the customer sued and won, a single incident rather than a body of evidence, and no research, survey, or incident study in these sources counts how often production models answer off-policy or what it costs when they do. [s10, s2, s7, s6]

The product can make a decision on each call rather than only reporting afterwards. The guardrails documentation states plainly that guardrails which fail will block the response from reaching users, and the LiteLLM integration page records block as the default action, raising an HTTP 400 when a violation is detected, while a monitor setting logs the violation and lets the request proceed. Checks run before the model call on the input, after it on input and output, or in parallel with it. Traffic reaches the checks through a proxy endpoint that stands in for the model provider's own API, or through an SDK call.

The checks themselves are small models rather than a large one grading output. The documentation names seven, each fitted to one task: prompt injection and jailbreak detection, content safety, grounding against supplied context, tool selection quality, natural-language policy assertions, hallucination detection, and personal-data scanning. Ariel Dan told CTech these are small language models or classic machine learning algorithms rather than a language model used as a judge, and that the one-model approach rivals take is slow and expensive. Speed, balanced, and quality modes trade latency for reasoning depth on each check.

Rogue is the pre-production half. It drives multi-turn adversarial conversations against an agent over the agent-to-agent protocol, generates test scenarios from a described business context, and reports what the agent did, and the page names regression testing and continuous-integration automation among its purposes. The company publishes it in a public repository the homepage links to. [s3, s21, s4, s10, s9]

The company competes on cost and latency rather than on a capability rivals lack. Its own pages argue that small purpose-built judges are faster and cheaper than using a large model to grade output, and its judge documentation publishes a prompt-injection comparison table placing Sentinel v2 at 0.957 average F1 above entries for Qwen3Guard, OpenAI's GPT OSS Safeguard, and Meta's Llama Guard 3. That table is the vendor's own, and no reviewed independent source reproduces it.

Outside researchers have picked the benchmark up, which is a weaker thing than an outside measurement and still worth noting. An arXiv preprint describing a classifier called CourtGuard evaluated its own approach on the benchmark Qualifire published, and reported alongside it the 97.6% Sentinel figure and a 65.2% figure for ProtectAI's open alternative, both credited to Qualifire's own paper rather than re-measured. Nobody in the reviewed record has run Sentinel independently.

The structural problem is where the product is sold. LiteLLM's guardrail-provider directory lists Qualifire beside dozens of other entries, among them ones from Amazon, Microsoft, Google, Palo Alto Networks, and CrowdStrike. Being in that directory is real distribution and it is also a public inventory of what a buyer could select instead. [s4, s13, s15, s1]

The customer references are on the homepage and they take reading the markup to find. Four testimonials each carry a person's name and a job title with no employer in the visible text, but each testimonial's logo links to a company site: DoiT, Empire Media, Anodot, and Novacy. Every one of these references is presented by the company, and no reviewed source outside it mentions any of the four.

Marketplace and gateway placement is the second signal. LiteLLM and Portkey each carry a Qualifire page in their own documentation showing how to turn the checks on, which a prospective buyer can verify without asking the vendor. The homepage also points at cloud marketplace listings, and the AWS one it links to is sold under the name Rogue Security rather than Qualifire. Google selected the company for its 2025 AI-for-cybersecurity cohort of sixteen startups, and CTech reported the same selection and noted that no other Israeli company was in it.

The public repository is the third channel. Rogue lives in a public repository the homepage links to, and the free pricing tier lists Rogue reports inside the commercial product, which is the ordinary shape of a free tool feeding a paid one. What the reviewed record still lacks is any figure: no revenue, no customer count, no deployment scale. [s1, s15, s16, s12, s10, s9, s7]

The founding team is three people and the site names all of them. Ariel Dan is listed as co-founder and chief executive, described as an entrepreneur of more than twenty years who has led two companies to acquisitions; Dror Ivry as co-founder and chief technology officer; and Gilad Ivry as co-founder and chief product officer with a decade of applying machine learning to business problems.

The parts an outsider can check are narrower. Gilad Ivry told CTech he had worked at Vianai building products for an early generation of large language models before he and his brother started the company, and Dror Ivry co-authored the preprint describing the prompt-injection model, which is one publication rather than a record. Neither of the chief executive's two acquisitions is named on the about page, and no reviewed source outside the company identifies them.

CTech's conference profile put the company at nine employees in September 2025. Nothing later in the reviewed record restates that figure or describes anyone beyond the three founders. [s6, s10, s14, s11]

The company sells compliance help rather than holding a certificate. Its ISO 42001 page explains what the standard asks of an AI management system and offers the product as the layer that monitors and enforces those requirements in production, and it offers visitors a free certificate for signing up. That is a marketing surface addressed to the customer's obligations, not evidence about the vendor's own audit position.

No attestation was found by probe on 2026-09-01. The trust and security paths return errors, the matching subdomains do not resolve, and a control probe of a nonsense subdomain does not resolve either, so the absence is genuine rather than an artifact of wildcard DNS.

What the record does offer a cautious buyer is control over the data path. The ISO 42001 page states that prompts or completions are stored by default with an opt-out, that logs and evaluation results are encrypted in transit and at rest, and that on-premises deployment is available, and the pricing page lists a bring-your-own-cloud or on-premises option on the enterprise tier. A default that stores prompts is the detail a buyer with sensitive traffic will want to change first. [s8, s18, s7]

Add analyzed competitors to compare them side by side with Qualifire.

The segment is the engineering team that already has an AI feature in front of users. The documentation is addressed to a developer wiring a proxy endpoint or an SDK into an existing application, the homepage names agents, retrieval applications, and chatbots as the shapes it serves, and the entry price is zero, which describes a product adopted by the person who writes the code rather than bought by the person who signs contracts.

Two segments sit inside that. The self-serve tiers cap token volume, protection rules, and log retention, which fits a team validating one application. The enterprise tier lifts those caps and adds a customer-hosted or on-premises install, single sign-on, a model fitted to the customer, long log retention, and support commitments, which is the shape of a regulated buyer's requirements list.

The named references are four company sites the homepage testimonials link to: DoiT, Empire Media, Anodot, and Novacy. Nothing in the reviewed record says which tier any of them bought, describes a deployment at any of them, or places any of them in a regulated industry. No cited page identifies an industry served or a customer in the governed segment the top tier is built for.

The technical argument is that the checker should be small. Ariel Dan told CTech the company uses small language models or classic machine learning algorithms rather than a large model grading output, and that the one-model approach rivals take is slow and expensive. The documentation follows through: seven judges, each fitted to one task, with speed, balanced, and quality modes trading latency against reasoning depth on every check.

Enforcement is a decision rather than a report. The guardrails page states that guardrails which fail will block the response from reaching users; the API exposes each check as a named parameter over input, output, or both; and the LiteLLM integration records the default action as block, raising an HTTP 400 when a violation is detected, with the check running before the model call, after it, or in parallel with it.

Outside attention exists and is narrower than it looks. An arXiv preprint describing a classifier called CourtGuard evaluated its own approach on the benchmark Qualifire published, and reported alongside it the 97.6% Sentinel figure and a 65.2% figure for ProtectAI's open alternative, both credited to Qualifire's own paper rather than re-measured. So a third party treats the benchmark as worth running against, nobody in the reviewed record has run Sentinel independently, and the comparison table placing Sentinel v2 above Qwen3Guard, GPT OSS Safeguard, and Llama Guard 3 is the company's own.

Distribution runs through other people's gateways and marketplaces. LiteLLM and Portkey each carry a Qualifire page in their own documentation showing how to turn the checks on, and Portkey's page describes the product as offering more than twenty guardrail checks across content safety, quality, and compliance. That is placement a prospective buyer can verify without asking the vendor. The homepage also points at cloud marketplace listings, and the AWS one it links to is sold under the name Rogue Security.

References are self-presented and take reading the markup to find. Each homepage testimonial's logo links to a company site, naming DoiT, Empire Media, Anodot, and Novacy, and no reviewed source outside the company mentions any of them.

The public repository and institutional selection round it out. Rogue lives in a public repository the homepage links to, and the free pricing tier lists Rogue reports inside the commercial product. Google named the company in its 2025 AI-for-cybersecurity cohort of sixteen startups, and CTech reported the same selection, adding that no other Israeli company was in it. The reviewed record still carries no revenue figure and no deployment count.

Pricing is published rather than quoted, which tells a buyer what the product costs before any conversation. A free tier carries three hundred thousand monthly tokens, up to three protection rules, seven days of log retention, and one environment. A paid plan listed at $550 per month adds API access, custom policies, content analysis, personal-data masking, unlimited protection rules, and ninety days of retention. An enterprise arrangement is quoted rather than listed and adds customer-hosted or on-premises deployment and seven-year retention.

The meter on the pricing page is tokens: the free plan bundles a monthly allowance and the paid plan a much larger one, with the quoted tier described as unlimited. That aligns cost with the traffic the customer already pays a model provider for, and it makes the guardrail a visible percentage of that bill rather than a fixed line item.

Two things the tiers reveal are worth a buyer's attention. Personal-data masking sits on the paid plan while detection sits on the free one, so the remediation half of the privacy story is a paid upgrade. And the ceiling that matters at scale is retention rather than capability: the published window runs to ninety days on the paid plan, so a team with a longer audit obligation is pushed to the quoted tier by the log window rather than by the checks.

The product is delivered as a hosted service the customer points traffic at. Requests reach the checks through a proxy endpoint that stands in for the model provider's own API, so adopting it is a base-URL change and a header, or through an SDK call the application makes itself. The homepage offers the customer's own cloud, an on-premises install, and the hosted service as deployment choices.

The operational cost of an inline check is latency, and the company is specific about it. The documentation records a speed mode at roughly twenty milliseconds giving a simple pass or fail, a balanced mode near one hundred that returns reasoning, and a quality mode near five hundred using larger models. Those figures are the vendor's own and no reviewed source reproduces them.

The data handling is stated plainly and the default is the part to notice. The ISO 42001 page says prompts or completions are stored by default with a customer opt-out, that logs and evaluation results are encrypted in transit and at rest, and that on-premises deployment is available. A team whose prompts carry regulated or confidential material has a configuration change to make before it sends production traffic.

The company markets compliance help rather than holding a certificate. Its ISO 42001 page explains what the standard asks of an AI management system, positions the product as the layer that monitors and enforces those requirements in production, and offers visitors a free certificate for signing up. That is a surface addressed to the customer's obligations, and it says nothing about the vendor's own audit position.

No attestation was found by probe on 2026-09-01. The trust and security paths on the company's domain return errors, the matching subdomains do not resolve, and a control probe of a nonsense subdomain does not resolve either, so the absence is genuine rather than an artifact of wildcard DNS.

What a cautious buyer can lean on instead is deployment control and published artefacts. The enterprise tier offers a customer-hosted or on-premises install, which keeps the traffic inside the customer's own boundary, and the prompt-injection model and its benchmark are published openly enough that a security team can test the detection itself rather than take a number on trust.

The ecosystem position is a component inside someone else's control point. The product speaks the interfaces developers already use, offering a proxy that stands in for a provider's own endpoint, and it appears in the guardrail directories of two gateway projects. That is cheap to adopt, and the same property makes it cheap to swap: a customer that wants a different checker changes a configuration entry in the gateway it already runs.

Those directories are also a competitive inventory. LiteLLM's list carries Qualifire beside dozens of entries, among them guardrails from Amazon, Microsoft, Google, Palo Alto Networks, and CrowdStrike. Portkey's list is shorter and carries several of the same names.

The agent-testing engine is the part of the position that is genuinely the company's own. Rogue drives adversarial conversations against an agent over the agent-to-agent protocol and reports what the agent did, the page names regression testing and continuous-integration automation among its purposes, and the homepage links developers straight to the repository.

Three co-founders run the company and the site names them all. Ariel Dan is co-founder and chief executive, described as an entrepreneur of more than twenty years who has led two companies to acquisitions. Dror Ivry is co-founder and chief technology officer. Gilad Ivry is co-founder and chief product officer, credited with a decade of applying machine learning to business problems.

The checkable parts are narrower than the claims. Gilad Ivry told CTech he had worked at Vianai building products for an early generation of large language models before he and his brother started the company, and Dror Ivry co-authored the preprint describing the prompt-injection model, which is one publication rather than a record. Neither of the chief executive's two acquisitions is named on the about page, and no reviewed source outside the company identifies them.

The company was small when it was last counted. CTech's September 2025 conference profile recorded nine employees against $4.6 million raised, and nothing later in the reviewed record restates either figure or describes anyone beyond the three founders.