TrojAI

• A10's plan to pair TrojAI's software with its hardware AI firewall is integration work that has not shipped, so a stalled merge could leave TrojAI a loosely held line rather than the combined offering A10 described.
• Model providers such as OpenAI and Microsoft, which TrojAI integrates with, could ship native red teaming and runtime filtering for the AI built on their platforms, removing the third-party budget line A10 now owns.
• Security platforms that bought AI security companies, including Check Point with Lakera, could fold both build-time and runtime coverage into broader suites, contesting the combined A10 and TrojAI offering on bundling.
• No paying customer is named in public sources, so A10 inherits integration breadth and early Gartner Peer Insights reviews without a disclosed reference roster, and buyers who require named references could stall deals.
• A10 must retain the TrojAI team through integration, because the build-time and runtime products depend on the founders and engineers who built them, and attrition would erode the acquired asset.
• A customer can cancel the runtime firewall subscription and stop the build-time scans, because the coverage is an overlay rather than embedded production control, which keeps switching cost low.

TrojAI treats the AI models, applications, and agents an enterprise builds as the assets under attack, and sells security before and after they ship. The homepage frames the problem as agent actions that adversaries can turn toward prompt injection, tool misuse, and unsafe behavior. The buyer is the enterprise security team putting AI into a production workflow.

Independent reporting corroborates the pain beyond vendor marketing. SecurityWeek describes the platform as helping organizations comply with benchmarks such as the OWASP AI framework and privacy regulations by testing models before deployment and protecting applications from sensitive data loss once deployed. That account treats the build-time and runtime risks as recognized problems rather than vendor speculation.

The pain stays qualitatively described rather than quantified. No fetched source sizes the buyer population or the loss exposure, so TrojAI names a clear and credible problem without an independent measure of its scale. [s1, s6, s3]

TrojAI ships two products that split across the AI lifecycle. TrojAI Detect runs automated red teaming at build time, drawing on more than 150 built-in security and safety tests plus custom tests to surface weaknesses such as jailbreaks, bias, and PII leakage, then maps findings to OWASP, MITRE, and NIST. TrojAI Defend is a runtime firewall that monitors, alerts, blocks, redacts, and logs the inputs and outputs of AI applications in production.

The runtime line has extended toward agentic workflows. Help Net Security covered TrojAI Defend for MCP, built to monitor traffic to and from Model Context Protocol servers and enforce policy across agents and MCP gateways. Browser extensions let employees use third-party generative AI tools while the firewall filters inputs and outputs for PII and intellectual property.

The capability detail is vendor-documented without an external product validation point. The product pages show dashboards, standards mapping, and downloadable data sheets, but no third-party benchmark or independent evaluation of detection quality appears in fetched sources, so depth rests on TrojAI's own documentation. [s2, s3, s8]

TrojAI competes against AI security specialists and the platforms consolidating the category. Adversa AI and Mindgard sell automated AI red teaming, Lakera shipped runtime guardrails before Check Point acquired it, and HiddenLayer runs red teaming inside a broader AI security platform. Gartner Peer Insights places TrojAI in its AI Security Testing market, a sign buyers can locate the slot.

TrojAI's structural distinction is selling both the build-time and runtime jobs from one company. Most independent rivals lead with one side, while TrojAI pairs Detect and Defend so a buyer gets the stack it would otherwise assemble from two vendors. That breadth raises the bar for a single bundled replacement without forming a structural moat.

The question of who owns the buyer relationship drove the outcome, and the acquisition answered it. The model providers and security platforms TrojAI integrates with can test and protect the AI built on their own infrastructure, and the same vendors that bought AI security rivals, Check Point with Lakera among them, can bundle both jobs into deals an enterprise already signs. A10 Networks resolved TrojAI's independence question by acquiring it in June 2026, pairing it with a hardware AI firewall and an installed base to sell into. [s2, s3, s9, s11, s16]

TrojAI's clearest go-to-market signal is the roster of platform partners it routes through. The company joined the Microsoft for Startups Pegasus Program, which gives Microsoft channels and customers access to its platform, and announced a generally available integration with OpenAI's ChatGPT Enterprise Compliance API for compliance visibility and runtime protection. A JFrog integration lets TrojAI Detect red team the models an enterprise registers in JFrog Artifactory.

Named paying-customer proof is thinner than the partner motion. No fetched press names a paying customer, and the independent customer signal that stands out is Gartner Peer Insights, where five reviewers rate TrojAI 4.2 out of 5 in the AI Security Testing market. The traction is real but reads as partnership-landing and early reviews rather than disclosed revenue or a named reference roster.

The motion was enterprise-direct and partner-assisted, and A10 now owns it. TrojAI hired a Rapid7 veteran to lead go-to-market and used the Microsoft, OpenAI, and JFrog integrations to reach buyers inside platforms they already use. After the June 2026 acquisition, A10's stated plan is to sell the combined offering into its base of more than 7,000 customers. [s14, s13, s15, s9, s11]

TrojAI's leadership pairs an enterprise-security operator with technical founders. CEO Lee Weiner joined in 2024 after 11 years as a senior executive at Rapid7, where the about page says he led product, engineering, and innovation as the company scaled from $40 million to over $750 million in revenue, and BetaKit confirms the Rapid7 tenure independently.

The founders carry the technical record. Co-founder and CTO James Stewart holds a PhD and presented TrojAI's adversarial-AI approach at a University of New Brunswick research seminar, a talk titled Redefining Enterprise Cybersecurity in the Age of Adversarial AI, and Stephen Goddard is the other co-founder. That independent university seminar corroborates Stewart's technical background and adversarial-AI subject matter beyond the company's own pages.

The credibility basis is operator pedigree and a shipping product line rather than a research-disclosure stream. TrojAI earns its public standing through two delivered products and named integrations, so a buyer verifies the team through what it built and a verifiable senior security-operator record rather than a benchmark or vulnerability-research history. [s4, s7, s10]

TrojAI leans its trust posture on a self-hosted deployment model. The company describes a platform that runs inside the customer environment so data stays local, which answers the exposure question a security buyer raises early when a product inspects proprietary AI systems and traffic.

TrojAI publishes certification evidence on its footer-linked security page. The page displays a SOC 2 Type II badge and a Controlled Goods Program badge, and the body text describes the SOC 2 Type 2 audit as in process, confirmed by an independent CPA report, with certification expected in early 2024. That date has passed and the page does not say a report is downloadable, so a procurement team would still request the current SOC 2 report directly.

The acquisition adds a data-sovereignty argument. A10 positions the combined offering for customers who want to keep sensitive AI assets in environments they control, extending the self-hosted posture rather than changing it. The readiness gap is a verifiable current report rather than an absent program. [s5, s3, s11]

Add analyzed competitors to compare them side by side with TrojAI.

TrojAI sells to the enterprise security team standing up AI in a core workflow. The company frames the buyer as an organization deploying AI models, applications, and agents into production, and pitches security for both the build phase and runtime. The homepage leads with securing agent actions against prompt injection, tool misuse, and unsafe behavior, naming the buyer that already runs agents and feels the exposure.

The two products widen the segment without a managed-service tier. A team red teams its models before launch with Detect and filters production traffic with Defend, and the Defend page says its browser extensions let employees use third-party GenAI and co-pilot applications safely, extending runtime coverage to that traffic. The A10 announcement describes protection across on-premises, cloud, and hybrid environments with customers keeping control of sensitive assets, a pitch aimed at the security-conscious enterprise, while TrojAI's own security page describes its production applications as hosted in a secure cloud environment.

The named demand is thin and indirect. No fetched press names a paying customer, and the clearest independent customer signal is five Gartner Peer Insights reviews in the AI Security Testing market alongside platform integrations rather than disclosed logos. A10 now points the line at its own customer base, so the open segment question is which buyers convert soonest under a parent that sells into networks and service providers.

TrojAI splits its capability across the AI lifecycle. TrojAI Detect runs automated red teaming at build time with an extensive built-in library of security and safety tests plus custom tests, attacking models to surface weaknesses and mapping findings to recognized AI security standards such as OWASP. TrojAI Defend is a runtime firewall that monitors, alerts, blocks, redacts, and logs the inputs and outputs of AI applications in production.

The runtime line has extended toward agentic workflows. Help Net Security covered TrojAI Defend for MCP, which monitors traffic to and from Model Context Protocol servers and enforces policy across agents and MCP gateways. Pairing build-time testing with runtime filtering in one vendor is the capability claim that separates TrojAI from single-product rivals.

The durable engineering is real but the data advantage is undemonstrated. Building adversarial test generation and an inline firewall that decides in real time is genuine applied-security work, and the Detect page says testing can be accelerated using TrojAI's proprietary fine-tuned adversarial models and custom datasets. Yet those models and datasets carry no name, size, or exclusivity mechanism in fetched sources, the cited record does not show whether or how quickly the accumulating test library could be reproduced, and no third-party accuracy benchmark appears. The advantage is craft and coverage breadth rather than a demonstrated proprietary data asset.

TrojAI's go-to-market rested on platform reach more than a customer roster. The company landed an OpenAI ChatGPT Enterprise Compliance API integration, which connected it to ChatGPT Enterprise compliance data, and a Microsoft for Startups Pegasus placement, which exposed it through Microsoft channels and customers, and it hired a long-tenured enterprise-security operator to lead the motion. The OpenAI integration paired compliance visibility with runtime protection across enterprise AI interactions.

Verifiable paying-customer proof stayed thinner than the partner motion. No fetched press names a paying customer, though BetaKit quotes an investor describing a production implementation at a major financial-services company, unnamed, and the clearest independent customer signal is five Gartner Peer Insights reviews rating TrojAI 4.2 out of 5. The customer evidence amounts to who TrojAI integrates with, that unnamed deployment, and a handful of reviewers rather than a disclosed reference roster, in an enterprise-direct, partner-assisted motion routing prospects to a contact-sales flow.

The acquisition resolved the standalone question and reset the motion. A10 says it bought TrojAI to sell the combined offering into its base of more than 7,000 customers, a post-acquisition distribution opportunity distinct from TrojAI's own demonstrated traction, so the test shifts from whether partner reach converts to whether A10's channel does. The integration breadth A10 inherited still lacks the named reference roster a buyer requiring customer proof would ask for.

TrojAI does not publish pricing in fetched sources, so the charged unit and list price stay private. A vendor that hides prices usually targets large negotiated enterprise deals, which fits the complex-enterprise buyer the company describes and the contact-sales flow it routes prospects through. The absence withholds the budget-anchoring signal some peers publish openly.

The two products imply two value meters that the public materials do not separate. Build-time red teaming reads as a testing subscription priced by models or scans, while the runtime firewall reads as production coverage priced by traffic or applications, and the firewall dashboard the site shows counts over 500,000 events. What TrojAI charges by, models, applications, events, or seats, is not stated publicly.

The inferable belief is that buyers pay for AI risk coverage rather than per-feature tooling. Confirming the unit and whether consumption is metered would require a sales conversation, which the hidden-price posture signals is the intended path, and A10's ownership may fold the line into its own enterprise contracting.

TrojAI delivers software with deployment flexibility rather than a documented single hosting model. The A10 announcement describes protecting AI across on-premises, cloud, and hybrid environments with customers keeping control of sensitive assets, while TrojAI's own security page describes its production applications as hosted in a secure cloud environment, so the operating split between vendor and customer is not fully documented. Detect runs the build-time scans and Defend runs the inline production firewall.

The runtime path carries the operational weight. Defend monitors, alerts, blocks, redacts, and logs inputs and outputs in production, the Defend for MCP line enforces policy on agent tool connections, and the Defend page describes browser extensions that cover employee use of third-party GenAI and co-pilot applications. The firewall sits in the live request flow, so its availability and latency become the customer's production concern.

The delivery model is software, not a managed outcome. The fetched pages describe no analyst service that accepts hands-on responsibility for results, so the offering reads as a platform the buyer operates against its own accountability. Published uptime or support service levels do not surface in fetched pages, and A10 frames the value as preserving the latency and availability its hardware customers already rely on.

TrojAI leans its trust posture on customer control of sensitive assets and a documented security program. The security page documents AES 256-bit encryption at rest and describes a SOC 2 Type 2 audit as in process, and the A10 announcement emphasizes protecting AI wherever it runs with customers keeping control of sensitive assets. That gives an enterprise buyer baseline procurement information for a product that inspects privileged AI models and traffic.

The attestation posture is in-progress rather than a moat. The in-process SOC 2 audit does not itself demonstrate an exclusive compliance advantage, the page frames the Type 2 audit as in process rather than a finished report, and fetched pages do not show a downloadable current report. A procurement team would verify whether the SOC 2 Type 2 audit completed and request the current report.

The acquisition adds a sovereignty argument to the trust story. A10 positions the combined offering for customers with strict data-sovereignty requirements who want to keep sensitive AI assets in environments they control, extending the customer-control posture rather than changing it. The trust gap remains a verifiable current report rather than an absent program.

TrojAI positions itself as lifecycle coverage for enterprise AI rather than a point tool. It pairs build-time red teaming with a runtime firewall and agent-tool policy enforcement, so TrojAI grounds the platform claim in owning both the pre-launch testing and the production defense for a customer's models, applications, and agents. Gartner Peer Insights places it in the AI Security Testing market, and integrations reach into tools enterprises already use to build and ship AI.

That breadth raises the bar for a bundled replacement. Combining build-time testing and runtime defense in one vendor can reduce the need to assemble the stack from two tools, though the cited record carries no competitor-by-competitor comparison, so the sources demonstrate bundled breadth without establishing a structural replacement barrier.

The exposure is that the platforms TrojAI integrates with own the buyer relationship and the model itself. Model providers can test and protect the AI built on their own infrastructure, and security platforms that bought AI security rivals can fold both jobs into deals an enterprise already signs. A10 resolved the independence question by acquiring the line, pairing a neutral third-party pitch with a parent that has hardware and an installed base.

TrojAI pairs technical founders with an enterprise-security operator at the top. Co-founder and CTO James Stewart holds a PhD and built with his co-founder the platform that secures models at build time and runtime. CEO Lee Weiner brings more than 25 years of B2B software experience and, the about page says, 11 years as a senior Rapid7 executive leading the company through revenue growth.

The team's standing is independently corroborated rather than self-asserted. BetaKit confirms Weiner's Rapid7 tenure, and Stewart was listed as a featured speaker for a University of New Brunswick research seminar on TrojAI's adversarial-AI approach, so a buyer can verify the team through what it built and an outside academic platform rather than a stream of vendor disclosures.

The acquisition is itself a team signal. Weiner is quoted in the A10 announcement, and the engineering that built Detect and Defend is what changed hands. Whether the founders and engineers stay under A10 is a standard post-acquisition question the fetched record does not address.