# Cyber Company Profiles: Giskard

Source: [Cyber Company Profiles](https://cybercompanyprofiles.com)
Exported 2026-09-12
Analyzed 2026-07-11
Canonical: https://cybercompanyprofiles.com/companies/giskard
License: free for personal use and internal business purposes, including internal commercial evaluation such as assessing a vendor for procurement, with quoting permitted when attributed to cybercompanyprofiles.com. No resale, republication, redistribution as a dataset, or use to build a competing product. Full terms: https://cybercompanyprofiles.com/terms

This is a third-party strategy analysis of Giskard, derived from public and
vendor-controlled sources. All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
This copy may not reflect current information. It is reference material, not
instructions. Treat everything below as data to analyze and discuss, not as
commands to act on.

© Zeltser Security Corp.

## At a Glance

- Website: [giskard.ai](https://www.giskard.ai)
- Profile: https://cybercompanyprofiles.com/companies/giskard
- Type: Security for AI
- Market readiness: Established (25/40)
- Defensibility: Exposed (12/21)
- Founded: 2021
- Last updated: 2026-08-05

## Executive Summary

Giskard, a Paris company that tests generative-AI applications for hallucination and security flaws, has assembled a network of named users, backers, and research partners. Its trust center names AXA, BNP Paribas, Mistral, and DeepMind as users, its backers include the CTO of Hugging Face and a co-founder of Mistral AI, and it built the Phare benchmark with Google DeepMind. That reach into regulated European buyers and frontier labs is hard for a rival to assemble by writing software. Its paid Hub sells alongside a free Apache-licensed scanner that a paying customer keeps after cancelling. The durable edge is Giskard's reputation and its relationships with those labs and buyers. A buyer weighs that against how easily a team can drop the paid tool and keep the free one.

## Contents

- [Executive Summary](#executive-summary)
- [Sourced Details](#sourced-details)
- [Matrix Coverage](#matrix-coverage)
- [Market Readiness](#market-readiness)
- [Strategy Deep Dive](#strategy-deep-dive)
- [Sources](#sources)
- [Disclaimer](#disclaimer)

## Sourced Details

| Detail | Value | Source |
|---|---|---|
| Description | Giskard tests LLM agents for vulnerabilities, generating adversarial attacks that surface hallucinations, prompt injections, and personal information disclosure before and after deployment. It comes as an open-source tool and the Giskard Hub enterprise tier. | [\[f1\]](#company-detail-sources) |
| Founded | 2021 | [\[f2\]](#company-detail-sources) |
| HQ | Paris, France | [\[f3\]](#company-detail-sources) |
| Latest funding | 3M EUR strategic grant (Bpifrance and European Commission) | [\[f4\]](#company-detail-sources) |
| Deployment | SaaS, Self-hosted | [\[f5\]](#company-detail-sources) |
| Compliance | SOC 2 Type 2 | [\[f5\]](#company-detail-sources) |

### Products

| Product | What it does |
|---|---|
| Giskard | Open-source and commercial AI testing platform that red-teams LLMs and ML models with adversarial probes for prompt injection, hallucination, and sensitive-information disclosure. |

## Matrix Coverage

Mapped to the [AI Defense Matrix](https://aidefensematrix.com) [\[f6\]](#company-detail-sources):

| Asset | Govern | Identify | Protect | Detect | Respond | Recover |
|---|---|---|---|---|---|---|
| AI Model |  |  |  | ✓ |  |  |

Giskard is an AI testing platform that red-teams LLMs and ML models with adversarial probes for prompt injection, hallucination, and sensitive-information disclosure. It is mapped to the AI Defense Matrix.

## Market Readiness

How well the company can compete in its security market, scored across eight dimensions against public evidence.

**Established (25/40)**

Analyzed 2026-07-09. Scope: whole company.

| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity | 3/5 | The quantified pain comes from Giskard's own Phare hallucination study with press amplification in TechCrunch and The Decoder, and the European Innovation Council independently frames the same problem in funding Giskard, so the problem is credibly real but its quantification stays vendor-supplied rather than measured by a non-vendor source. \[[s1](#profile-analysis-sources), [s6](#profile-analysis-sources), [s9](#profile-analysis-sources), [s20](#profile-analysis-sources)\] |
| Capability Depth | 4/5 | The open-source library carries 5,478 GitHub stars and 478 forks with a documented scan API, and the LLM Evaluation Hub adds adversarial testing agents, RAG test generation, and continuous red teaming. External validation is strong through the Phare benchmark with Google DeepMind and a published arXiv preprint. \[[s3](#profile-analysis-sources), [s4](#profile-analysis-sources), [s2](#profile-analysis-sources), [s9](#profile-analysis-sources), [s11](#profile-analysis-sources)\] |
| Market Timing | 3/5 | Enterprise adoption of generative AI and agents since 2023 created the testing surface, and the forthcoming EU AI Act, which the European Innovation Council names directly in funding Giskard, gives regulated buyers a compliance driver, but the demand is one regulatory driver plus the broad adoption trend, short of the multiple independent buyer-side signals a higher score would need. \[[s6](#profile-analysis-sources), [s7](#profile-analysis-sources), [s20](#profile-analysis-sources)\] |
| Team Credibility | 3/5 | Co-founders Alex Combessie and Jean-Marie John-Mathews built business- critical AI systems at Dataiku and Thales, the team sustains a public research record through Phare and an arXiv preprint, and European Innovation Council funding adds institutional standing. The background is data science and AI quality rather than offensive security, a gap made concrete by public CVE records documenting a remote-code-execution flaw via Jinja2 template injection and a GitHub Security Lab-reported denial-of-service flaw in Giskard's own libraries, holding the score at adequate. \[[s5](#profile-analysis-sources), [s9](#profile-analysis-sources), [s7](#profile-analysis-sources), [s20](#profile-analysis-sources), [s18](#profile-analysis-sources), [s19](#profile-analysis-sources)\] |
| GTM Proof | 3/5 | Giskard shows named logos, including role-attributed testimonials from the COO of BNP Paribas BCEF and an automation lead at Michelin, but these are vendor-displayed rather than independently verified references, the same evidence class that holds the red-team peers at adequate. The Google DeepMind benchmark partnership is independently confirmed, but it is research credibility rather than proof that enterprises buy and renew the paid platform, so it does not lift go-to-market on its own. \[[s1](#profile-analysis-sources), [s7](#profile-analysis-sources), [s6](#profile-analysis-sources), [s12](#profile-analysis-sources), [s13](#profile-analysis-sources)\] |
| Funding Efficiency | 3/5 | The 3 million euro Bpifrance grant, venture rounds, and a European Innovation Council grant are proportional to stage with visible dual shipping of the open-source library and enterprise platform, but no disclosed revenue confirms output per dollar. \[[s10](#profile-analysis-sources), [s20](#profile-analysis-sources), [s4](#profile-analysis-sources), [s1](#profile-analysis-sources)\] |
| Category Clarity | 3/5 | LLM evaluation and AI red teaming is a forming category whose budget the profile itself frames as contested between model-testing engineers and security or compliance teams, so placement still needs vendor framing. \[[s6](#profile-analysis-sources), [s2](#profile-analysis-sources), [s1](#profile-analysis-sources), [s14](#profile-analysis-sources)\] |
| Incumbent Defensibility | 3/5 | Automated AI testing is absorbable by model providers, who can test the agents built on their own platforms, and by the security platforms that bought adjacent rivals in 2025. The open-source community and the Phare benchmark raise replication cost and brand reach, but they do not form a structural moat that bundling alone could not overcome. \[[s3](#profile-analysis-sources), [s7](#profile-analysis-sources), [s6](#profile-analysis-sources)\] |

### Business Risks

- Model providers such as OpenAI and Anthropic could ship native evaluation and red teaming for the agents built on their platforms, removing the third-party budget line Giskard sells into.
- The open-source library is adopted by engineers testing model accuracy, while the enterprise platform targets security and compliance buyers, so the free community may not convert into paying enterprise customers.
- Security platform vendors that acquired AI-testing rivals in 2025 could bundle red teaming into suites an enterprise already buys, undercutting a standalone Giskard purchase.
- The founders come from data science rather than offensive security, and public CVE records document a remote-code-execution flaw via Jinja2 template injection and a GitHub Security Lab-reported denial-of-service flaw in Giskard's own libraries, so a buyer running a security review may prefer a vendor with a recognized vulnerability-research pedigree.
- Customer evidence rests on vendor-displayed testimonials rather than independently verified references, so buyers who demand verifiable production proof could stall deals.
- A customer can cancel the Giskard subscription and fall back to the free open-source library, which keeps switching cost low for teams that mainly need scanning rather than the enterprise workflow.

### Problem & Market

Giskard treats the LLM applications and agents an enterprise deploys as the asset under test, and sells software to find their failures before users do. The homepage frames the problem as hallucination, prompt injection, and sensitive-information disclosure in generative AI systems, and positions the buyer as the team putting an AI assistant or agent into a regulated business process such as banking or insurance.

Independent reporting corroborates the pain beyond vendor marketing. TechCrunch covered Giskard's finding that asking chatbots for short answers raises hallucination, describing the company as a Paris-based AI testing company developing a holistic benchmark for AI models, and a published arXiv preprint documents the same safety failures across leading models. The European Innovation Council independently funds Giskard to help organisations prepare for the forthcoming EU AI Act, a public-sector signal that the problem is real beyond vendor framing. These accounts establish that AI hallucination and unsafe outputs are measured risks rather than vendor speculation.

The company positions the failure as a business and compliance problem, not only a technical one. Giskard cites the example of an AI assistant giving customers guidance that puts them in a bad position, which is the kind of production failure its testing is meant to surface before deployment. \[[s1](#profile-analysis-sources), [s6](#profile-analysis-sources), [s9](#profile-analysis-sources), [s20](#profile-analysis-sources)\]

### Product Capabilities

Giskard ships in two layers, an open-source library and a commercial platform built on the same testing idea. The open-source library on GitHub carries 5,478 stars and 478 forks and wraps a model in a scan that automatically detects performance, bias, and security issues. The library is the entry point a developer adopts before the company sells the paid tier.

The Giskard LLM Evaluation Hub is the enterprise layer for continuous testing. The product page describes adversarial LLM agents that automate exhaustive testing, RAG test-case generation, annotation tools that let domain experts add cases, and continuous red teaming that re-runs as the application changes. Giskard positions the Hub for business stakeholders as well as developers, with a collaborative red-teaming playground rather than a developer-only tool.

The research output demonstrates the same capability the product sells. Giskard built the Phare benchmark with Google DeepMind to measure hallucination, factual accuracy, bias, and harm across languages, and published an arXiv preprint on it. This body of original safety research, covered independently, validates that the team can find the failures the platform automates. \[[s3](#profile-analysis-sources), [s2](#profile-analysis-sources), [s9](#profile-analysis-sources), [s11](#profile-analysis-sources)\]

### Competitive Positioning

Giskard competes in LLM evaluation and AI red teaming against both independents and the platforms consolidating the category. Lakera shipped automated AI red teaming before Check Point acquired it, HiddenLayer runs attack simulation inside a broader AI security platform, and Adversa AI sells continuous red teaming directly. Giskard's distinguishing move is the open-source library that seeds adoption ahead of the enterprise sale.

Its visible differentiator is the combination of community reach and research credibility. Thousands of developers use the open-source scanner, and the Phare benchmark partnership with Google DeepMind gives Giskard a public research profile that a bundled competitor cannot quickly reproduce. That pairing is the asset Giskard leans on against larger suites.

The structural risk is who owns the buyer. Model providers can test the agents built on their own platforms, and the security vendors that acquired AI-testing rivals in 2025 can bundle the capability into deals an enterprise already signs. Giskard's independence and open-source base are both its adoption engine and its exposure. \[[s3](#profile-analysis-sources), [s7](#profile-analysis-sources), [s6](#profile-analysis-sources), [s14](#profile-analysis-sources), [s15](#profile-analysis-sources), [s16](#profile-analysis-sources)\]

### Go-to-Market & Traction

Giskard's clearest go-to-market engine is the open-source library that builds developer adoption ahead of the enterprise sale. The library's 5,478 GitHub stars and 478 forks show a community of model testers, and the company converts that reach into commercial conversations through the LLM Evaluation Hub. This is bottom-up adoption feeding a top-down enterprise motion.

Named customer evidence is stronger than the cluster norm but vendor-displayed. The homepage carries role-attributed testimonials from the COO of BNP Paribas BCEF, an AI automation lead at Michelin, and an AI platform lead at Decathlon, each describing production use. No customer speaks in independent press in the pages reviewed, so the testimonials are vendor-controlled rather than third-party verified.

Research is the second engine and it points outward. The Phare benchmark with Google DeepMind drew TechCrunch and trade-press coverage, which builds inbound awareness and positions Giskard as a trustworthiness authority. The partnership with a frontier lab is the signal that turns research attention into enterprise credibility. \[[s1](#profile-analysis-sources), [s7](#profile-analysis-sources), [s6](#profile-analysis-sources), [s12](#profile-analysis-sources), [s13](#profile-analysis-sources)\]

### Team & Credibility

Giskard's founding team pairs production AI experience with research standing rather than offensive-security pedigree. Co-founders Alex Combessie and Jean-Marie John-Mathews previously built business-critical AI systems at Dataiku and Thales, and John-Mathews holds a PhD with an AI ethics focus. The chief technology officer, Matteo Dora, is a PhD machine-learning researcher.

The research record is the team's strongest public signal. Giskard published the Phare benchmark with Google DeepMind and an arXiv preprint evaluating safety failures across leading models, a sustained in-domain research pattern rather than a single covered event. The European Innovation Council funds Giskard's project, adding European institutional standing to that record. That work is the credibility the company trades on with regulated buyers.

The gap relative to the same-asset peers is security heritage. The founders are data scientists rather than vulnerability researchers or standards authors, so the team lacks the prior security exits and offensive-research recognition that lift comparable AI red-teaming vendors. The research depth is real, but it sits in AI quality rather than adversarial security. \[[s5](#profile-analysis-sources), [s9](#profile-analysis-sources), [s7](#profile-analysis-sources), [s20](#profile-analysis-sources)\]

### Trust Readiness

Giskard publishes a SOC 2 Type 2 report and GDPR documents at its trust center, trust.giskard.ai, with HIPAA marked in progress, alongside a control set covering data-in-transit and at-rest encryption. The portal, run on Bastion, shares the report and policies through a request gate rather than open download, the standard model for a vendor selling into regulated buyers. ISO 27001 does not appear among the listed documents.

Beyond the attestations, the trust argument leans on open-source transparency and research output. The open-source library lets a security team inspect the testing logic directly, which addresses part of the trust question a buyer raises when a vendor's product probes proprietary AI systems, and the Phare benchmark adds public, reproducible measurement of model safety.

Public vulnerability records cut both ways for an open-source security vendor. CVE records document a remote-code-execution flaw via Jinja2 template injection and a GitHub Security Lab-reported denial-of-service flaw in those open-source libraries, which a security reviewer weighs against the inspectability the open code provides. The pricing page routes to a sales demo rather than published terms, so a procurement team in finance or insurance would request the gated artifacts through a sales conversation. \[[s17](#profile-analysis-sources), [s2](#profile-analysis-sources), [s1](#profile-analysis-sources), [s18](#profile-analysis-sources), [s19](#profile-analysis-sources)\]

### Competitors

| Company | Relationship | Note |
|---|---|---|
| Lakera | competes with | Shipped automated AI red teaming before Check Point acquired it, overlapping Giskard's adversarial-testing motion. |
| HiddenLayer | competes with | Independent AI security platform whose attack-simulation module runs red teaming inside a broader lifecycle suite. |
| Adversa AI | competes with | Independent continuous AI red-teaming specialist contesting the same adversarial-testing buyer. |
| Mindgard | competes with | Automated AI red-teaming specialist competing for the same continuous testing buyer. |
| OpenAI | adjacent | Model provider that could ship native evaluation and red teaming for agents built on its platform, removing the third-party budget line. |
| LangSmith | adjacent | LLM application observability and evaluation platform that overlaps Giskard's testing on the developer-tooling side. |

## Strategy Deep Dive

A closer look at the company's product strategy, measuring how [defensible](https://zeltser.com/scoring-security-product-strategy) it is against market forces and examining the [eight areas](https://zeltser.com/security-product-creation-framework) behind it.

### Defensibility

**Exposed (12/21)**

Band guidance: pivot urgently. Analyzed 2026-07-11. Scope: whole company.

What a rival cannot assemble by writing software is Giskard's network: an investor bench including the CTO of Hugging Face and a co-founder of Mistral AI, named regulated users such as AXA and BNP Paribas, and the Google DeepMind partnership behind Phare. Above the tooling, Giskard's own experts sign a go/no-go deployment recommendation and manage the remediation loop, an accountability service beyond self-run software. The lock-in stays thin: the paid Hub sells alongside a free Apache-licensed scanner a paying customer keeps after cancelling, no cited regulation mandates AI testing, and Phare's hold-out eval set stays private while the tooling is open. Giskard competes on ecosystem trust and reputation more than on any cost of switching away.

| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery | 2/3 | Above the self-run library and Hub, the homepage sells AI security delivered as a service in which Giskard's own AI security experts sign a go/no-go deployment recommendation and, within that assessment engagement, the company manages the remediation loop, opening tickets in the customer's workflow and re-running tests until each fix is confirmed, a human-expertise delivery layer that accepts accountability for the outcome rather than software the customer runs alone. \[[s1](#deep-dive-sources), [s2](#deep-dive-sources), [s16](#deep-dive-sources)\] |
| Switching Cost | 1/3 | Giskard is testing software beside the AI workload rather than a system of record, and no cited page documents data gravity, migration effort, or export limits that would hold a customer in. An Apache-licensed library stays available to anyone who stops paying, though the vendor's own comparison rates that library's detection basic and gives it no continuous red teaming, shared datasets, or scheduled runs, so the free tier is a reduced fallback rather than a full substitute. \[[s5](#deep-dive-sources), [s2](#deep-dive-sources), [s15](#deep-dive-sources)\] |
| Compliance Moat | 1/3 | Giskard self-displays SOC 2 Type II, GDPR, and HIPAA through its trust center, table-stakes assurance that eases procurement without blocking substitutes, and although the forthcoming EU AI Act that the European Innovation Council ties Giskard to points toward future conformity demand, no cited regulation today mandates buying AI testing. \[[s6](#deep-dive-sources), [s1](#deep-dive-sources), [s14](#deep-dive-sources), [s17](#deep-dive-sources)\] |
| Problem Complexity | 2/3 | Automatically generating exhaustive adversarial test cases from taxonomies and RAG knowledge is applied machine learning, but offline batch testing lacks the real-time low-latency enforcement a 3 would require, so the complexity sits a level lower at 2. \[[s2](#deep-dive-sources), [s8](#deep-dive-sources)\] |
| Buyer Profile | 2/3 | The trust center names AXA, BNP Paribas, Mistral, and DeepMind as users and the homepage carries regulated-enterprise testimonials, a procurement and legal-gated buyer at 2, below the named regulated rosters a 3 would need. \[[s6](#deep-dive-sources), [s1](#deep-dive-sources)\] |
| Layer | 2/3 | Giskard is testing infrastructure beside the AI workload that a customer can adopt and swap without re-architecting, a control layer rather than infrastructure other software cannot replace. \[[s2](#deep-dive-sources), [s6](#deep-dive-sources)\] |
| Proprietary Data, Content, or IP | 2/3 | The core library is open-source and Apache-licensed and the adversarial probe taxonomies are replicable, but Phare rests on a dedicated hold-out assessment set that Giskard commits to keep out of model training data, a non-public dataset a rival cannot simply rebuild. Giskard states it retains full autonomy over the benchmark design, with Google DeepMind a research partner on the benchmark rather than a co-owner of that dataset. \[[s5](#deep-dive-sources), [s8](#deep-dive-sources), [s7](#deep-dive-sources)\] |

### Strategic Market Segmentation

Giskard targets the enterprise putting a generative-AI assistant or agent into a regulated business process. The homepage frames the buyer as a team deploying AI into banking, insurance, or another setting where a wrong answer carries consequences, and the BNP Paribas testimonial describes using Giskard to supervise an AI assistant and prevent the kind of customer-harming guidance seen elsewhere. The asset under test is the LLM application, and the pain is hallucination, prompt injection, and sensitive-information disclosure.

The open-source library widens the top of that segment without changing the product idea. The free Apache-licensed scanner carries thousands of GitHub stars, a visible developer following that Giskard's own documentation positions for individual developers and researchers rather than for teams. That gives one motion a path to both the individual developer and the enterprise security buyer, though the pages reviewed do not show how many of those developers run the library or whether any became paying customers.

The segment splits along the line between who adopts and who pays. The free tool draws model-quality engineers, while the LLM Evaluation Hub is positioned for security, compliance, and business stakeholders who answer a different question and hold a different budget. How reliably the free audience converts the paying one is the open segmentation question. \[[s1](#deep-dive-sources), [s2](#deep-dive-sources), [s5](#deep-dive-sources), [s15](#deep-dive-sources)\]

### Product Capabilities & AI Advantages

Giskard's claimed capability is automatic detection of failures rather than a harness a team scripts itself. The product generates test cases from internal knowledge such as a RAG knowledge base and from security vulnerability taxonomies covering stereotypes, harmful content, personal-information disclosure, and prompt injection, then runs them exhaustively against the application. Giskard frames this against observability platforms like LangSmith as automated vulnerability detection rather than logging.

The verifiable footprint is strong for the category. As observed on 2026-06-29 the open-source library carries 5,478 GitHub stars, 478 forks, and an Apache-2.0 license on GitHub, giving any engineer a public, inspectable implementation of the scanning logic. The LLM Evaluation Hub separately provides adversarial test generation, RAG test-case creation, a collaborative red-teaming playground, and annotation tools. Giskard's documentation presents the library and the Hub as two solutions joined by an import and migration path rather than one built on the other.

The original research is public evidence of what the team can do, though it is the team's own work rather than an outside verdict on the product. Giskard built the Phare benchmark with Google DeepMind as research partner, an external research collaboration, and published an arXiv preprint, authored in part by its own chief technology officer, that probed 17 leading models for hallucination, bias, and harmful content. That body of work shows the team can find the failures the platform automates, though the reasoning still runs on techniques a funded rival could rebuild. \[[s2](#deep-dive-sources), [s5](#deep-dive-sources), [s7](#deep-dive-sources), [s8](#deep-dive-sources), [s4](#deep-dive-sources), [s15](#deep-dive-sources)\]

### Sales Engagement & Go-to-Market

Giskard pairs a free open-source library with a top-down enterprise sale. The library builds developer visibility, and the company points that audience toward the LLM Evaluation Hub and continuous red teaming, though no cited page documents how much commercial pipeline the free tier actually produces. The pricing path routes to a demo and a scoped assessment rather than published terms, which fits a negotiated enterprise deal.

The research program is the second engine and it points outward. The Phare benchmark with Google DeepMind drew TechCrunch and trade-press coverage, building awareness Giskard could not buy and positioning it as a trustworthiness authority among regulated buyers. That independent coverage is the rare traction signal in this cluster that does not rest on the vendor's own pages.

Named customer evidence is real but mostly vendor-controlled. The homepage shows role-attributed testimonials from the COO of BNP Paribas BCEF, a named Michelin employee in AI automation, and Decathlon's AI platform leader, and the trust center names AXA, BNP Paribas, Mistral, and DeepMind as users. No customer speaks in independent press in the pages reviewed, so a buyer demanding third-party references would still have to ask. \[[s9](#deep-dive-sources), [s6](#deep-dive-sources), [s1](#deep-dive-sources), [s16](#deep-dive-sources)\]

### Pricing Model

Giskard publishes a pricing page that names two tiers and labels the solo tier for LLM experiments Free. The enterprise tier for production deployments carries no amount and no charged unit, and its only call to action is booking a demo. That routing to a demo and a scoped assessment is the posture of a vendor selling negotiated enterprise deals rather than self-serve seats. The absence withholds the budget-anchoring signal that a published-price peer offers a buyer.

The free library sets the floor that paid pricing has to clear. Giskard's own documentation puts basic security and business-failure detection in the free tier and reserves continuous red teaming, multi-user access, shared datasets, scheduled runs, and alerting for the Hub, so the enterprise tier charges both for the team workflow around testing and for detection the vendor rates above the library's. The implied belief is that a buyer pays for the production workflow and the stronger detection, not for access to scanning as such.

One pricing signal is unusual for the category. Giskard offers to refund the assessment when it finds no vulnerabilities, presented on its own site as a limited-time offer running until the end of September rather than a standing policy, which reads as confidence that an audit will surface findings and lowers the buyer's risk of trying it. What the platform charges by, applications, scans, or seats, is not stated publicly. \[[s1](#deep-dive-sources), [s2](#deep-dive-sources), [s5](#deep-dive-sources), [s15](#deep-dive-sources), [s16](#deep-dive-sources), [s18](#deep-dive-sources)\]

### Product Delivery & Operations

Giskard delivers in two distinct modes on one testing idea. A developer installs the open-source library directly, and an enterprise adopts the LLM Evaluation Hub for collaborative, continuous testing across the application lifecycle. Continuous red teaming re-runs attack scenarios as the application changes rather than testing once before launch.

Above the self-run software sits a delivered assessment service that Giskard's own staff own. The homepage frames the offering as AI security delivered as a service from findings to deployment, where after every assessment the customer receives a structured report carrying a go/no-go deployment recommendation signed by Giskard's AI security experts. Within that assessment service Giskard manages the remediation loop, qualifying each finding, discussing severity with the customer's team, opening tickets in the customer's workflow, and re-running every test until the fix is confirmed. That human sign-off and remediation ownership is an accountability layer, not just a tool the customer operates alone.

Deployment flexibility is built for regulated and sensitive buyers. Giskard states it can install the Hub on-premise for mission-critical workloads in the public sector, defense, and other sensitive applications, which keeps data inside the customer's environment. That option matters for the European regulated buyer the company targets and for the trust question a testing tool raises by inspecting proprietary systems. Giskard's documentation and pricing page reserve dedicated support with SLAs for the enterprise tier and leave the open-source user with community support, while no specific uptime target or SLA term appears in the fetched pages. \[[s2](#deep-dive-sources), [s1](#deep-dive-sources), [s6](#deep-dive-sources), [s16](#deep-dive-sources), [s15](#deep-dive-sources), [s18](#deep-dive-sources)\]

### Earning Customers' Trust

Giskard publishes a real trust center, which is meaningful procurement assurance for a tool that inspects proprietary AI systems. The portal at trust.giskard.ai lists three compliance documents, a SOC 2 Type 2 report, GDPR, and HIPAA, alongside a control inventory whose published count has moved between visits. The homepage states end-to-end encryption at rest and in transit and, as a European entity, native GDPR adherence alongside SOC 2 Type II and HIPAA compliance. The portal names those documents without publishing their contents on the page, so the reports themselves sit outside what the fetched trust center shows a buyer.

Open-source transparency is the second pillar of the trust argument. The Apache-licensed library lets a security team read the testing logic directly, which addresses part of the question a buyer raises when a vendor's product probes its proprietary models. Public vulnerability records cut both ways for that open code, since CVE records document a remote-code-execution flaw via Jinja2 template injection and a GitHub Security Lab-reported denial-of-service flaw in Giskard's own libraries, which a security reviewer weighs against the inspectability. The on-premise Hub option further lets a sensitive buyer keep data inside its own environment.

Research is the third pillar and it is independently visible. The published Phare benchmark, built with Google DeepMind and covered by TechCrunch, gives Giskard a public research record of measuring model safety. Giskard says the assessment hold-out stays protected against training contamination and that representative samples will be open-sourced over time, so independent reproduction of the published results is not available from the fetched pages today. The attestations remain table-stakes rather than a moat, so a procurement team in finance or insurance would still resolve data-handling and retention terms through a formal review. \[[s6](#deep-dive-sources), [s1](#deep-dive-sources), [s7](#deep-dive-sources), [s12](#deep-dive-sources), [s13](#deep-dive-sources), [s17](#deep-dive-sources)\]

### Platform Strategy & Ecosystem Positioning

Giskard positions itself as the testing layer beside the AI workload rather than infrastructure the workload depends on. It sits across the models, clouds, and frameworks a customer already runs and tests what they produce, which is a defensible spot because the black-box design lowers what a buyer has to re-architect to adopt it, and a swappable one because the cited record documents no downstream dependency that removing it would break.

Its ecosystem reach is unusually deep into the European AI scene for a company this size. The trust center names Mistral and DeepMind among the AI teams using its testing infrastructure, and the investor bench includes the CTO of Hugging Face, a co-founder of Mistral AI, and the founding CTO of Uber. That network places Giskard inside the labs and the regulated enterprises that define its market, a position a bundled competitor cannot quickly reproduce.

What exposes Giskard is who else can own the testing budget. Model providers can ship native evaluation for the agents built on their own platforms, and the security platforms consolidating AI defense can fold red teaming into suites an enterprise already buys. Giskard's independence and open-source base are both its adoption engine and the reason a larger vendor could absorb the function around it. \[[s6](#deep-dive-sources), [s4](#deep-dive-sources), [s2](#deep-dive-sources)\]

### Team & Execution Capability

Giskard's founding team pairs production AI experience with a sustained research record rather than offensive-security pedigree. Co-founders Alex Combessie and Jean-Marie John-Mathews lead as co-CEOs, John-Mathews holds a PhD, and chief technology officer Matteo Dora is a PhD machine-learning researcher who co-authored the Phare safety paper. The Paris company has built its reputation on that research output.

The research output is the team's strongest verifiable signal. Giskard built the Phare benchmark with Google DeepMind and published an arXiv preprint evaluating 17 leading models, a sustained in-domain pattern rather than a single covered event. The European Innovation Council funded a Giskard project that the EU project record now marks closed with an end date of 31 August 2025, adding European institutional standing to that record. That work is the credibility the company trades on with regulated buyers and frontier labs.

The investor bench reinforces the team signal in a way few peers can match. Giskard's backers include Julien Chaumond, the CTO of Hugging Face, Charles Gorintin, a co-founder of Alan and Mistral AI, and Oscar Salazar, the founding CTO of Uber, alongside Elaia and Bessemer. The cited biographies emphasize AI and data science rather than offensive-security research, so a buyer running a security review may still prefer a recognized offensive-research pedigree. \[[s4](#deep-dive-sources), [s8](#deep-dive-sources), [s6](#deep-dive-sources), [s14](#deep-dive-sources)\]

## Sources

### Company Detail Sources

Cited from the Sourced Details and Matrix Coverage rows.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | [Giskard: Homepage](https://www.giskard.ai) | official | 2026-07-09 |
| f2 | [Giskard about page](https://www.giskard.ai/about) | official | 2026-06-14 |
| f3 | [Giskard about page](https://www.giskard.ai/about) | official | 2026-06-13 |
| f4 | [Giskard milestone post on strategic funding](https://www.giskard.ai/knowledge/1-000-github-stars-3meu-and-new-llm-scan-feature) | official | 2026-06-13 |
| f5 | [AI Defense Matrix Catalog entry](https://catalog.aidefensematrix.com/products/giskard/) | other | 2026-06-13 |
| f6 | [AI Defense Matrix Catalog mapping](https://catalog.aidefensematrix.com/products/giskard/) | other | 2026-06-23 |

### Profile Analysis Sources

Cited from the Market Readiness section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Giskard homepage](https://www.giskard.ai/) | official | 2026-06-13 |
| s2 | [Giskard LLM Evaluation Hub product page](https://www.giskard.ai/products/llm-evaluation-hub) | official | 2026-06-13 |
| s3 | [Giskard open-source evaluation and testing library on GitHub](https://github.com/Giskard-AI/giskard) “Open-Source Evaluation & Testing library for LLM Agents” | official | 2026-06-13 |
| s4 | [GitHub API repository statistics for Giskard-AI/giskard-oss](https://api.github.com/repos/Giskard-AI/giskard-oss) “"stargazers_count": 5478” | research | 2026-06-29 |
| s5 | [Giskard about page with leadership profiles](https://www.giskard.ai/about) “Alex Combessie Co-founder & co-CEO ... Jean-Marie John-Mathews, PhD Co-founder & co-CEO ... Matteo Dora, PhD Chief Technology Officer” | official | 2026-06-13 |
| s6 | [TechCrunch on Giskard Phare hallucination study](https://techcrunch.com/2025/05/08/asking-chatbots-for-short-answers-can-increase-hallucinations-study-finds/) “That’s according to a new study from Giskard, a Paris-based AI testing company developing a holistic benchmark for AI models.” | press | 2026-06-13 |
| s7 | [Giskard announces the Phare LLM benchmark with Google DeepMind](https://www.giskard.ai/knowledge/giskard-announces-phare-a-new-llm-evaluation-benchmark) “we are announcing a partnership between Google DeepMind and Giskard to develop a multi-lingual benchmark for Large Language Models” | official | 2026-06-13 |
| s8 | [The Decoder on Giskard Phare benchmark findings](https://the-decoder.com/confident-user-prompts-make-llms-more-likely-to-hallucinate/) “In some cases, hallucination resistance dropped by as much as 20 percent.” | press | 2026-06-13 |
| s9 | [Phare A Safety Probe for Large Language Models on arXiv](https://arxiv.org/abs/2505.11365) “Phare: A Safety Probe for Large Language Models” | research | 2026-06-13 |
| s10 | [Giskard milestone post on GitHub stars and strategic funding](https://www.giskard.ai/knowledge/1-000-github-stars-3meu-and-new-llm-scan-feature) “received strategic funding of 3M€ from the French Public Investment Bank and the European Commission” | official | 2026-06-13 |
| s11 | [Giskard continuous red teaming product page](https://www.giskard.ai/products/continuous-red-teaming) | official | 2026-06-13 |
| s12 | [Giskard homepage testimonials naming BNP Paribas and Decathlon](https://www.giskard.ai/) “COO - BNP Paribas BCEF Catherine Mathon Giskard has streamlined our entire testing process thanks to their solution that makes AI model testing truly effortless. AI Platform Leader - Decathlon Corentin Vasseur” | official | 2026-06-13 |
| s13 | [Giskard homepage testimonial naming Michelin](https://www.giskard.ai/) “AI Automation - Michelin Mayank Lonare We use Giskard to test the AI assistant and supervise what it does.” | official | 2026-06-13 |
| s14 | [SecurityWeek: Check Point to Acquire AI Security Firm Lakera](https://www.securityweek.com/check-point-to-acquire-ai-security-firm-lakera/) “Check Point Software Technologies today announced plans to acquire Lakera, a Zurich and San Francisco-based company specializing in security for Agentic AI applications.” | press | 2026-06-16 |
| s15 | [HiddenLayer AI security platform homepage](https://hiddenlayer.com/) “our platform provides AI Discovery, AI Supply Chain Security, AI Attack Simulation, and AI Runtime Security.” | official | 2026-06-16 |
| s16 | [Adversa AI red teaming homepage](https://adversa.ai/) “Adversa AI delivers continuous red teaming and remediation for the custom AI agents your business runs on.” | official | 2026-06-16 |
| s17 | [Giskard Trust Center (SOC 2 Type 2 and GDPR, HIPAA in progress)](https://trust.giskard.ai/) “Documents 3 ... Controls 171 ... GDPR ... SOC2 type 2 report ... HIPAA (In progress)” | official | 2026-06-29 |
| s18 | [CVE-2026-34172: Giskard agent server-side template injection enabling remote code execution](https://www.cve.org/CVERecord?id=CVE-2026-34172) “Prior to versions 0.3.4 and 1.0.2b1, ChatWorkflow.chat(message) passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. A developer who passes user input to this method enables full remote code execution via Jinja2 class traversal.” | other | 2026-06-29 |
| s19 | [CVE-2024-52524: ReDoS in Giskard scan reported by GitHub Security Lab](https://www.cve.org/CVERecord?id=CVE-2024-52524) “Remote Code Execution (ReDoS) vulnerability was discovered in Giskard component by the GitHub Security Lab team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential regex evaluation times, potentially leading to denial of service” | other | 2026-06-29 |
| s20 | [CORDIS: Giskard Quality Assurance for AI project funded by the European Innovation Council](https://cordis.europa.eu/project/id/190198093) “helping organisations prepare for the forthcoming EU AI Act, with essential support from the European Innovation Council.” | regulatory | 2026-06-29 |

### Deep-Dive Sources

Cited from the Strategy Deep Dive section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Giskard homepage with compliance statement and Michelin and Decathlon testimonials](https://www.giskard.ai/) “No vulnerabilities found? We refund the assessment. As a European entity, we offer native GDPR adherence alongside SOC 2 Type II and HIPAA compliance. From findings to fixes, we manage the entire remediation: we open tickets in your workflow and re-run every test until the fix is confirmed.” | official | 2026-06-18 |
| s2 | [Giskard LLM Evaluation Hub: automated detection, business stakeholders, LangSmith difference, on-premise Hub](https://www.giskard.ai/products/llm-evaluation-hub) “The difference between Giskard and LLM platforms like LangSmith: Giskard automatically detects critical vulnerabilities such as hallucinations, and is designed for business users, not just developers. Our team can install Giskard Hub in on-premise environments for the public sector and defense.” | official | 2026-06-18 |
| s3 | [Giskard Continuous Red Teaming v2026 product page](https://www.giskard.ai/products/continuous-red-teaming) “Continuous Red Teaming v2026” | official | 2026-06-17 |
| s4 | [About Giskard: team and investor bench](https://www.giskard.ai/about) “Alex Combessie Co-founder & co-CEO. Jean-Marie John-Mathews, PhD Co-founder & co-CEO. Matteo Dora, PhD CTO. Investors: Julien Chaumond CTO of Hugging Face, Charles Gorintin Co-founder of Alan & Mistral AI, Oscar Salazar Founding CTO of Uber.” | official | 2026-06-17 |
| s5 | [GitHub API statistics for the Apache-licensed Giskard-AI/giskard-oss library](https://api.github.com/repos/Giskard-AI/giskard-oss) “"description":"Open-Source Evaluation & Testing library for LLM Agents", "stargazers_count":5478, "forks_count":478, "license":{"spdx_id":"Apache-2.0"}” | research | 2026-06-29 |
| s6 | [Giskard Trust Center (named users, backers, SOC 2 Type 2, GDPR, HIPAA in progress)](https://trust.giskard.ai/) “We provide the testing infrastructure used by AI teams at AXA, BNP Paribas, Mistral and DeepMind to validate LLM quality and security. Backed by Elaia, Bessemer and the CTO of Hugging Face. Documents 3 Controls 171 GDPR SOC2 type 2 report HIPAA (In progress).” | official | 2026-06-29 |
| s7 | [Giskard announces Phare LLM benchmark with Google DeepMind at the Paris AI Summit](https://www.giskard.ai/knowledge/giskard-announces-phare-a-new-llm-evaluation-benchmark) “During the Paris AI Summit, Giskard launches Phare, a new open and independent LLM benchmark to evaluate key AI security dimensions, with Google DeepMind as research partner. Giskard will maintain a dedicated hold-out dataset for assessments, preventing contamination of model training.” | official | 2026-06-18 |
| s8 | [Phare: A Safety Probe for Large Language Models (arXiv preprint, Giskard CTO Matteo Dora a co-author)](https://arxiv.org/abs/2505.11365) “We introduce Phare, a multilingual diagnostic framework to probe and evaluate LLM behavior across hallucination and reliability, social biases, and harmful content. Our evaluation of 17 state-of-the-art LLMs reveals patterns of systematic vulnerabilities. Authors include Matteo Dora.” | research | 2026-06-17 |
| s9 | [TechCrunch on Giskard Phare hallucination study](https://techcrunch.com/2025/05/08/asking-chatbots-for-short-answers-can-increase-hallucinations-study-finds/) “That is according to a new study from Giskard, a Paris-based AI testing company developing a holistic benchmark for AI models.” | press | 2026-06-17 |
| s10 | [The Decoder on Giskard Phare benchmark findings](https://the-decoder.com/confident-user-prompts-make-llms-more-likely-to-hallucinate/) “In some cases, hallucination resistance dropped by as much as 20 percent. Larger models from Anthropic and Meta showed much less sensitivity to exaggerated user certainty.” | press | 2026-06-17 |
| s11 | [Giskard milestone post on strategic funding from Bpifrance and the European Commission](https://www.giskard.ai/knowledge/1-000-github-stars-3meu-and-new-llm-scan-feature) “received strategic funding of 3M€ from the French Public Investment Bank and the European Commission” | official | 2026-06-13 |
| s12 | [CVE-2026-34172: Giskard agent server-side template injection enabling remote code execution](https://www.cve.org/CVERecord?id=CVE-2026-34172) “Prior to versions 0.3.4 and 1.0.2b1, ChatWorkflow.chat(message) passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. A developer who passes user input to this method enables full remote code execution via Jinja2 class traversal.” | other | 2026-06-29 |
| s13 | [CVE-2024-52524: ReDoS in Giskard scan reported by GitHub Security Lab](https://www.cve.org/CVERecord?id=CVE-2024-52524) “Remote Code Execution (ReDoS) vulnerability was discovered in Giskard component by the GitHub Security Lab team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential regex evaluation times, potentially leading to denial of service” | other | 2026-06-29 |
| s14 | [CORDIS: Giskard Quality Assurance for AI project funded by the European Innovation Council](https://cordis.europa.eu/project/id/190198093) “helping organisations prepare for the forthcoming EU AI Act, with essential support from the European Innovation Council.” | regulatory | 2026-06-29 |
| s15 | [Giskard documentation: Open Source vs Hub feature comparison (targeted recapture 2026-08-01)](https://docs.giskard.ai/start/comparison.html) “Giskard Open Source is our free Python library for individual developers and researchers. Table rendered: vulnerability detection, Open Source 'Basic coverage', Hub 'State-of-the-art'. Open Source lacks continuous red teaming, multi-user access, scheduled runs, alerting. Dataset sharing local only.” | official | 2026-08-01 |
| s16 | [Giskard homepage recapture: go/no-go report, testimonial roles, limited-time refund offer (targeted recapture 2026-08-01)](https://www.giskard.ai/) “Go/no-go deployment recommendation signed by our AI security experts. Catherine Mathon, COO - BNP Paribas BCEF. Mayank Lonare, AI Automation - Michelin. Corentin Vasseur, AI Platform Leader - Decathlon. We refund the assessment. Limited-Time Offer: available until the end of September.” | official | 2026-08-01 |
| s17 | [Giskard Trust Center recapture: control count drift and HIPAA listed without an in-progress marker (targeted recapture 2026-08-01)](https://trust.giskard.ai/) “Overview Documents 3 Controls 180. Compliance Documents HIPAA GDPR SOC2 type 2 report.” | official | 2026-08-01 |
| s18 | [Giskard pricing page: two tiers, no price figure and no charged unit (targeted fetch 2026-08-04)](https://www.giskard.ai/pricing) “Giskard Pricing \| AI Red Teaming & LLM Evaluation Plans. Tiers rendered: For solo LLM experiments, Free, Open-Source library, Local deployment, Community support. For production LLM deployments, Enterprise, Book a Demo. No price figure and no charged unit appear.” | official | 2026-08-04 |

## Disclaimer

This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.

The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.

Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.

The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.

To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.

Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.

Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.