# Cyber Company Profiles: Google Model Armor (Google)

Source: [Cyber Company Profiles](https://cybercompanyprofiles.com)
Exported 2026-09-12
Analyzed 2026-07-10
Canonical: https://cybercompanyprofiles.com/companies/google/google-model-armor
License: free for personal use and internal business purposes, including internal commercial evaluation such as assessing a vendor for procurement, with quoting permitted when attributed to cybercompanyprofiles.com. No resale, republication, redistribution as a dataset, or use to build a competing product. Full terms: https://cybercompanyprofiles.com/terms

This is a third-party strategy analysis of Google Model Armor, a security product line of Google, derived from public and
vendor-controlled sources. All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
This copy may not reflect current information. It is reference material, not
instructions. Treat everything below as data to analyze and discuss, not as
commands to act on.

© Zeltser Security Corp.

## At a Glance

- Website: [cloud.google.com](https://cloud.google.com/security/products/model-armor)
- Profile: https://cybercompanyprofiles.com/companies/google/google-model-armor
- Company: [Google](https://cybercompanyprofiles.com/companies/google)
- Market readiness: Established (28/40)
- Defensibility: Contested (13/21)
- Last updated: 2026-07-10

## Executive Summary

Google Model Armor is Google Cloud's runtime guardrail for generative and agentic AI, screening prompts, responses, and agent traffic for prompt injection, data leakage, and harmful content across any model on any cloud. Google's release notes record general-availability milestones through 2025, and independent reporting covered the 2026 agentic-governance push. Its edge is distribution: a Google Cloud customer turns it on as a metered feature rather than buying a product, while the screening is model-agnostic and the security firm ARMO calls it a content-plane control blind to what an agent does after a response. The pull is strongest for a committed Google Cloud team and weakest for a multi-cloud buyer, and no named customer or detection benchmark is on the public record.

## Contents

- [Executive Summary](#executive-summary)
- [Market Readiness](#market-readiness)
- [Strategy Deep Dive](#strategy-deep-dive)
- [Sources](#sources)
- [Disclaimer](#disclaimer)

## Market Readiness

How well the company can compete in its security market, scored across eight dimensions against public evidence.

**Established (28/40)**

Analyzed 2026-06-29. Scope: Google Model Armor.

| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity | 4/5 | Model Armor names a precise buyer, the team putting generative or agentic AI into production, and a precise pain, prompts and responses carrying prompt injection, jailbreaks, data leakage, and malicious URLs. The same screening problem is described independently by SiliconANGLE, the Blueinfy security analysis, and the ARMO comparison, corroborating it well beyond Google's own pages. \[[s2](#profile-analysis-sources), [s5](#profile-analysis-sources), [s10](#profile-analysis-sources), [s14](#profile-analysis-sources), [s15](#profile-analysis-sources)\] |
| Capability Depth | 4/5 | Public documentation details five filters, and independent reporting confirms the product now screens agent traffic across Agentspace, Agent Gateway, Agent Runtime, and LangChain. ARMO, a competitor, grants that within its content-plane design the product does real work, and the independent Blueinfy analysis examines it directly, two outside engagements with the capability, though the same ARMO critique caps depth short of category-defining. \[[s5](#profile-analysis-sources), [s11](#profile-analysis-sources), [s12](#profile-analysis-sources), [s14](#profile-analysis-sources), [s15](#profile-analysis-sources)\] |
| Market Timing | 4/5 | Buyers moved generative and agentic AI into production through 2025 and 2026, and Model Armor shipped general availability on Google Kubernetes Engine and the Gemini Enterprise Agent Platform on that cadence. SiliconANGLE and InfoWorld independently covered the agentic-governance demand the product answers, multiple buyer-side signals within the year, though the timing is shared with the rival clouds. \[[s6](#profile-analysis-sources), [s7](#profile-analysis-sources), [s10](#profile-analysis-sources), [s11](#profile-analysis-sources), [s12](#profile-analysis-sources)\] |
| Team Credibility | 3/5 | Model Armor is built and run by Google Cloud and composes Sensitive Data Protection and Vertex AI tooling, so the capability is real, but the credibility is the parent platform's institutional record rather than a named, in-domain line team the way the standalone peers document one. Independent analyses by Blueinfy and ARMO engaging with the product confirm the engineering is usable. \[[s1](#profile-analysis-sources), [s14](#profile-analysis-sources), [s15](#profile-analysis-sources)\] |
| GTM Proof | 3/5 | Model Armor is offered both standalone and through Security Command Center and integrates no-code across Agentspace, LangChain, Google MCP servers, and the Gemini Enterprise Agent Platform, and SiliconANGLE and InfoWorld corroborate that agentic integration independently. No named end-customer speaks on the record in the reviewed sources and no usage or revenue figure is published, so the platform reach is an indirect signal and traction is present but unproven. \[[s1](#profile-analysis-sources), [s4](#profile-analysis-sources), [s10](#profile-analysis-sources), [s11](#profile-analysis-sources), [s12](#profile-analysis-sources)\] |
| Funding Efficiency | 3/5 | The visible output is a steady shipping cadence through 2025 and into 2026 under a metered, pay-as-you-go price ($0.10 per million tokens after a free tier), which SiliconANGLE and InfoWorld confirm buyers can adopt. No line-level revenue or staffing figure is published, so efficiency is present in delivery yet unconfirmed, and the score does not lean on Google's balance sheet. \[[s3](#profile-analysis-sources), [s7](#profile-analysis-sources), [s11](#profile-analysis-sources), [s12](#profile-analysis-sources)\] |
| Category Clarity | 4/5 | Runtime AI guardrails is a recognizable stack slot, and Google labels Model Armor an AI firewall that buyers place without coaching. SiliconANGLE and InfoWorld describe it in the same category language, and the Blueinfy analysis lists it alongside the other Google guardrail options, but no analyst has named a category around it, holding it short of category-defining. \[[s10](#profile-analysis-sources), [s12](#profile-analysis-sources), [s14](#profile-analysis-sources)\] |
| Incumbent Defensibility | 3/5 | The screening capability is substitutable: Google itself ships several configurable guardrails of its own per the Blueinfy analysis, and ARMO notes Model Armor inspects only the content plane. The edge is deep no-code embedding and distribution inside Google Cloud, which is reach into the buyer rather than a structural data or lock-in moat, so absorption friction exists without a moat bundling could not replicate. \[[s14](#profile-analysis-sources), [s15](#profile-analysis-sources), [s1](#profile-analysis-sources), [s5](#profile-analysis-sources)\] |

### Business Risks

- Google could let Model Armor settle into a Security Command Center checkbox rather than sustaining it as a named product. A future slowdown in named Model Armor releases, or documentation migrating solely under Security Command Center, would confirm this risk.
- Model providers, including Google's own Gemini safety layer, could make built-in moderation good enough that buyers skip a separate screening layer, closing the third-party guardrail budget line.
- Model Armor inspects prompts and responses but does not observe an agent's post-response runtime behavior, so an independent evaluation showing indirect prompt injection or tool misuse passing through would weaken its agentic-security positioning.
- No public detection benchmark or false-positive rate exists for Model Armor, so an independent evaluation showing weak efficacy or over-blocking would undercut the positioning.
- Model Armor's reach is strongest inside Google Cloud, so a multi-cloud or AWS-first buyer has weaker incentive to adopt it over a cloud-neutral guardrail vendor.
- No named Model Armor customer speaks publicly about production scale in the reviewed sources, so buyers who require current references could discount the platform-feature distribution signal.

### Problem & Market

Model Armor treats the live traffic of a deployed AI application as the asset to defend. The product screens prompts, responses, and agent interactions for prompt injection, jailbreaks, sensitive-data leakage, malicious URLs, and harmful content, the risks that conventional application controls do not inspect because the input is natural language to a probabilistic system.

The buyer is the security or platform team putting generative or agentic AI into production. The October 2025 Google blog frames the case for an external guardrail rather than relying on a model's built-in refusals, and the independent Blueinfy analysis describes the same screening problem inside Google Cloud, corroborating the pain beyond Google's own marketing.

The consequence Model Armor targets is an agent acting on a poisoned instruction. Because it inspects agent interactions and embedded files, it aims at indirect prompt injection, though the security firm ARMO notes the product sees only the request and response, not what the agent does after a screened response reaches it. \[[s2](#profile-analysis-sources), [s5](#profile-analysis-sources), [s14](#profile-analysis-sources), [s15](#profile-analysis-sources)\]

### Product Capabilities

Model Armor screens AI traffic in both directions through five filters. Documentation details prompt-injection and jailbreak detection, sensitive-data protection built on Google Cloud Sensitive Data Protection, malicious-URL detection, responsible AI content filtering across hate, harassment, sexual, and dangerous categories, and document screening for PDFs and Office files.

The reach now extends to agent traffic. SiliconANGLE reported inline protection for Agentspace in 2025 and runtime protection integrating with Agent Gateway, Agent Runtime, and LangChain in 2026, and InfoWorld describes Model Armor as a governance control in Vertex AI Agent Builder that blocks prompt injection alongside Cloud IAM agent identities.

The product is model and cloud agnostic, protecting non-Google models through a REST API. The ARMO comparison grants that the content-plane screening does real work within its design, while flagging that it does not observe the agent's syscalls, child processes, or network destinations after a response, the boundary a buyer should size before treating it as a complete control. \[[s5](#profile-analysis-sources), [s11](#profile-analysis-sources), [s12](#profile-analysis-sources), [s15](#profile-analysis-sources)\]

### Competitive Positioning

Model Armor competes in runtime AI guardrails from a position its standalone rivals do not have, inside the platform the buyer already pays for. Lakera, now part of Check Point, Prompt Security, now part of SentinelOne, Gray Swan, and Dynamo AI sell the same inline screening to the same buyer, but Model Armor is a metered feature a Google Cloud customer can switch on without onboarding a vendor.

The nearest comparison is platform against platform. Microsoft ships Azure AI Content Safety and Prompt Shields and Amazon ships Bedrock Guardrails as the equivalent cloud-native layer, so a buyer choosing a cloud often inherits its guardrail rather than selecting one.

The screening itself is replicable. The Blueinfy analysis shows Google offers several configurable guardrails of its own, so the differentiation is the no-code placement and distribution, not a detection capability a competitor could not build. \[[s1](#profile-analysis-sources), [s14](#profile-analysis-sources), [s15](#profile-analysis-sources)\]

### Go-to-Market & Traction

Distribution is Model Armor's go-to-market engine, and it generates reach rather than named logos. The product is offered both standalone and through Security Command Center and integrates no-code across Agentspace, LangChain, Google MCP servers, and the Gemini Enterprise Agent Platform, so adoption can ride existing Google Cloud relationships instead of a separate sales motion.

Independent reporting corroborates that motion. SiliconANGLE covered the Agentspace and Agent Gateway integrations across 2025 and 2026, and InfoWorld placed Model Armor among the governance controls in Vertex AI Agent Builder, both signals the product is used and positioned beyond Google's own pages.

The gap is named end-customer proof. No buyer speaks publicly about production scale or spend in the reviewed sources, and Google publishes no usage or revenue figure for the line, so the traction reads from the breadth of integrations and the release cadence rather than from referenceable deployments, which holds the motion as present but unproven. \[[s3](#profile-analysis-sources), [s10](#profile-analysis-sources), [s11](#profile-analysis-sources), [s12](#profile-analysis-sources)\]

### Team & Credibility

Model Armor is built and operated by Google Cloud, which gives it institutional capability rather than a named founding team. The product composes Google Cloud Sensitive Data Protection, Vertex AI tooling, and Security Command Center, infrastructure that reflects a sustained security-engineering and AI-research organization, and the InfoQ coverage notes it draws on Google and Mandiant security intelligence.

The public record documents the institution, not individuals. Unlike the standalone peers, whose founders and their in-domain research are named in press, Model Armor's credibility comes from the parent's track record and the documentation depth of the product itself.

Independent engagement is the outside signal. The Blueinfy security analysis and the ARMO comparison both examine the product directly, third-party scrutiny that confirms the engineering is real and usable beyond Google's own surfaces. \[[s1](#profile-analysis-sources), [s13](#profile-analysis-sources), [s14](#profile-analysis-sources), [s15](#profile-analysis-sources)\]

### Trust Readiness

Model Armor's trust posture comes from being a native Google Cloud service rather than from standalone attestations. It runs within the customer's Google Cloud project and Security Command Center, so procurement reviews the existing Google Cloud counterparty and contracts rather than a new vendor, and the release notes record FedRAMP High compliance in April 2026.

Data-handling controls are part of the capability. The product screens content inline and integrates Sensitive Data Protection to detect and prevent leakage of PII, financial data, and credentials in both prompts and responses, addressing the exposure a buyer raises when a control inspects production AI traffic.

The readiness gap is evidence of efficacy. Google publishes no detection benchmark or false-positive rate, and the ARMO comparison argues the content-plane design leaves post-response agent behavior unscreened, so a buyer evaluating accuracy relies on the documented filters and independent testing tools rather than a vendor-reported number. \[[s1](#profile-analysis-sources), [s4](#profile-analysis-sources), [s15](#profile-analysis-sources)\]

### Competitors

| Company | Relationship | Note |
|---|---|---|
| Lakera | competes with | Runtime AI guardrail screening prompts and agent traffic for the same buyer, now inside Check Point, overlapping Model Armor's inline protection motion. |
| Prompt Security | competes with | Inline screening of model and agent traffic across the same runtime AI data and orchestration assets, now part of SentinelOne. |
| Gray Swan AI | competes with | Ships the Cygnal runtime guardrail on the same runtime AI data and orchestration assets Model Armor screens. |
| Dynamo AI | competes with | Sells DynamoGuard runtime guardrails to regulated enterprises, overlapping Model Armor's prompt and response screening. |
| Microsoft | adjacent | Ships Azure AI Content Safety and Prompt Shields as the equivalent platform-native guardrail on a rival cloud. |
| Amazon Web Services | adjacent | Bundles Amazon Bedrock Guardrails as the platform-native AI screening layer competing for the same cloud buyer. |

## Strategy Deep Dive

A closer look at this line's product strategy, measuring how [defensible](https://zeltser.com/scoring-security-product-strategy) it is against market forces and examining the [eight areas](https://zeltser.com/security-product-creation-framework) behind it.

### Defensibility

**Contested (13/21)**

Band guidance: reinforce or reposition. Analyzed 2026-07-10. Scope: Google Model Armor.

What a customer buys from Model Armor is token-metered screening software it configures and runs in its own Google Cloud project. That screening is model-agnostic and substitutable: Google itself ships several configurable guardrails of its own, and the security firm ARMO notes Model Armor inspects only the content plane and not what an agent does after a screened response. No non-public cross-customer dataset and no regulation forces the choice, and FedRAMP High eases federal sales without blocking a rival. The remaining friction is modest, the work of re-integrating and re-tuning inline templates. So Model Armor is hard to displace for a committed Google Cloud buyer and easy to leave for one that moves off it.

| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery | 1/3 | Model Armor delivers software the customer configures and runs, a token-metered screening API and no-code filters priced from a free tier to subscription volume, the software-product level of delivery. \[[s3](#deep-dive-sources), [s2](#deep-dive-sources)\] |
| Switching Cost | 2/3 | The product runs inline with configured templates and floor settings, so replacing it means re-integrating and re-tuning those policies on a rival, work the cited record documents no migration path for, though the templates are declarative configuration rather than accumulated data, keeping the friction modest. \[[s1](#deep-dive-sources), [s2](#deep-dive-sources)\] |
| Compliance Moat | 1/3 | Model Armor reached FedRAMP High compliance in April 2026, which eases sales into regulated buyers, but no regulation mandates this specific AI prompt-screening tooling, and the other clouds' native guardrails could clear the same bars, so compliance eases adoption without blocking a rival. \[[s4](#deep-dive-sources)\] |
| Problem Complexity | 3/3 | A hybrid of rules-based controls, ML models, and reasoning models screening prompts and responses inline across multiple languages and document types is specialized ML and real-time-systems work, and ARMO grants the content-plane screening does real work within its design. \[[s8](#deep-dive-sources), [s2](#deep-dive-sources), [s14](#deep-dive-sources)\] |
| Buyer Profile | 3/3 | The buyers are enterprises running production AI on Google Cloud, and InfoWorld's account of Model Armor as enterprise agent-governance tooling inside Vertex AI Agent Builder implies a population with the formal procurement that comes with regulated workloads, though no named Model Armor customer speaks publicly about scale. \[[s1](#deep-dive-sources), [s12](#deep-dive-sources)\] |
| Layer | 2/3 | Model Armor is middleware that applications and Google services call in the request flow, and ARMO notes its data plane terminates at the response boundary, so customer applications keep functioning without it and it stops short of depended-on infrastructure. \[[s1](#deep-dive-sources), [s14](#deep-dive-sources)\] |
| Proprietary Data, Content, or IP | 1/3 | The asset is reuse of Google's Sensitive Data Protection and Vertex AI tooling plus Google Cloud distribution, not a named non-public cross-customer corpus, and the Blueinfy analysis shows Google offers several overlapping guardrails, so the data position is replicable rather than a proprietary moat. \[[s1](#deep-dive-sources), [s13](#deep-dive-sources)\] |

### Strategic Market Segmentation

Model Armor targets the security and platform teams that put generative and agentic AI into production, with the sharpest fit on Google Cloud. The product screens prompts, responses, and agent interactions, and Google positions it as an AI firewall for applications built on Vertex AI and the Gemini Enterprise Agent Platform, which points it at the team operating those workloads.

The model-agnostic REST API widens the segment beyond Google-hosted models. Google states Model Armor protects all LLMs including Gemini, OpenAI, Anthropic, and Llama through an API usable on any cloud, so a buyer running mixed or non-Google models is still in scope, though the no-code advantage concentrates where the buyer already uses Google services.

The proof of demand in the reviewed record is product-side and corroborated by independent press. Release notes show general-availability milestones on Google Kubernetes Engine and the Gemini Enterprise Agent Platform, and SiliconANGLE and InfoWorld cover the agentic-governance push, but no named buyer segment speaks publicly, so the addressable set is read from the integration surface rather than from disclosed deployments. \[[s1](#deep-dive-sources), [s6](#deep-dive-sources), [s7](#deep-dive-sources), [s11](#deep-dive-sources), [s12](#deep-dive-sources)\]

### Product Capabilities & AI Advantages

Model Armor screens AI traffic in both directions through five filters. Documentation and the October 2025 Google blog describe prompt-injection and jailbreak detection, sensitive-data protection, malicious-URL detection, responsible AI content filtering across hate, harassment, sexual, and dangerous categories, and document screening for PDFs and Office files.

The detection approach is layered rather than a single classifier. Google describes a hybrid defense-in-depth approach that combines rules-based controls, ML models, and AI reasoning models, and the Blueinfy analysis places Model Armor alongside Google's other configurable guardrails, which a buyer can use in combination.

The advantage that distinguishes it from a startup classifier is composition over invention, and its boundary is the content plane. ARMO grants the screening does real work within its design while noting it inspects only prompts and responses, not the agent's syscalls or network destinations after a response, and Google publishes no detection or false-positive benchmark. \[[s5](#deep-dive-sources), [s8](#deep-dive-sources), [s13](#deep-dive-sources), [s14](#deep-dive-sources)\]

### Sales Engagement & Go-to-Market

Model Armor's go-to-market is distribution, not a sales motion. It is offered both standalone and through Security Command Center and integrates no-code across LangChain, Google MCP servers, and the Gemini Enterprise Agent Platform, so a Google Cloud customer can adopt it by enabling a feature rather than onboarding a vendor.

That motion is the structural difference from the standalone peers. Where the standalone guardrail vendors must win a separate purchase, a Google Cloud customer can switch Model Armor on as a feature, so Model Armor benefits from Google Cloud distribution rather than from a moat of its own.

Independent reporting confirms the reach extends outward. SiliconANGLE covered the Agent Gateway, Agent Runtime, and LangChain integrations, and InfoWorld placed Model Armor among the governance controls in Vertex AI Agent Builder, showing the product positioned in front of developers beyond Google's own console. \[[s1](#deep-dive-sources), [s3](#deep-dive-sources), [s4](#deep-dive-sources), [s11](#deep-dive-sources), [s12](#deep-dive-sources)\]

### Pricing Model

Model Armor charges by screened token volume, the unit that matches a buyer's AI traffic. Pricing is a published $0.10 per million tokens after a free tier, with 2 million tokens per month free standalone and 3 billion included with a Security Command Center Enterprise subscription.

The unit choice ties Model Armor's cost to AI adoption rather than to seats. A customer pays more as more traffic flows through the screening layer, so revenue grows with the customer's AI usage, the same metering logic the standalone guardrail vendors use.

The pricing also reveals the competitive frame. A token-metered screening layer competes directly with free built-in model moderation, so the published rate is a wager that buyers will pay for control and breadth beyond what a model's native refusals provide, a case the October 2025 blog argues explicitly. \[[s3](#deep-dive-sources), [s9](#deep-dive-sources), [s5](#deep-dive-sources)\]

### Product Delivery & Operations

Model Armor delivers as a managed Google Cloud service with two deployment paths. Developers call a REST API directly for any model on any infrastructure, or enable no-code inline protection through Google service integrations, so the same capability serves both a custom application and a packaged Google workload.

Operational governance scales through templates and floor settings. Teams configure per-application templates, and an organization sets floor settings that impose a minimum baseline across every template in the resource hierarchy, which fits how a central security team enforces policy across many AI applications.

The product shipped a steady cadence of general-availability milestones, reaching Google Kubernetes Engine in September 2025 and the Gemini Enterprise Agent Platform in December 2025, with the record continuing into 2026 through MCP server integration and FedRAMP High compliance in April. The open operational question is efficacy at production scale, since Google documents the filters but publishes no latency, detection, or false-positive figures. \[[s1](#deep-dive-sources), [s2](#deep-dive-sources), [s6](#deep-dive-sources), [s7](#deep-dive-sources), [s4](#deep-dive-sources)\]

### Earning Customers' Trust

Model Armor's trust posture comes from being a native Google Cloud service. Because it runs inside the customer's Google Cloud project as a managed service rather than a separate product, a buyer can adopt it under existing Google Cloud terms instead of onboarding a new vendor, and the release notes record FedRAMP High compliance in April 2026.

Data-handling is built into the capability. The product screens content inline and integrates Sensitive Data Protection to detect and prevent leakage of PII, financial information, and credentials in both prompts and responses, addressing the exposure a buyer raises when a control inspects production AI traffic.

The readiness gap is independent evidence of efficacy. Google publishes no detection benchmark or false-positive rate, and the ARMO comparison argues the content-plane design leaves the agent's post-response behavior unscreened, so a buyer evaluating accuracy relies on the documented filters and independent testing tools rather than a vendor-reported number. \[[s1](#deep-dive-sources), [s2](#deep-dive-sources), [s4](#deep-dive-sources), [s14](#deep-dive-sources)\]

### Platform Strategy & Ecosystem Positioning

Model Armor is a layer within Google Cloud's platform rather than a platform of its own. Google integrates it across Security Command Center, LangChain, Google MCP servers, and the Gemini Enterprise Agent Platform, positioning it as the screening control that other Google AI services call.

Outward integrations keep it model and cloud agnostic. The REST API works with Gemini, OpenAI, Anthropic, and Llama on any infrastructure, and SiliconANGLE reports the runtime protection extending to Agent Gateway and Agent Runtime, so the ecosystem reaches beyond Google-hosted workloads even as the no-code path favors Google services.

The position cuts two ways. Belonging to Google's platform is the distribution advantage, but the Blueinfy analysis shows Google offers several overlapping guardrails, so Model Armor competes for attention inside Google's own roadmap as well as against external vendors. \[[s1](#deep-dive-sources), [s11](#deep-dive-sources), [s13](#deep-dive-sources)\]

### Team & Execution Capability

Model Armor is built and operated by Google Cloud, which substitutes institutional capability for the named founding team a startup leans on. The product composes Google Cloud Sensitive Data Protection, Vertex AI tooling, and Security Command Center, infrastructure that reflects a sustained security-engineering and AI-research organization.

The public record documents the institution, not individuals. Unlike the standalone peers, whose founders and in-domain research are named in press, Model Armor's credibility comes from the parent's track record and the depth of the product documentation itself.

Independent scrutiny is the outside signal. The Blueinfy security analysis and the ARMO comparison both examine the product directly, third-party engagement that confirms the engineering is real, while the public record gives no signal on the size or continuity of the team behind it. \[[s1](#deep-dive-sources), [s13](#deep-dive-sources), [s14](#deep-dive-sources)\]

## Sources

### Profile Analysis Sources

Cited from the Market Readiness section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Google Model Armor product page](https://cloud.google.com/security/products/model-armor) “Model Armor protects all LLMs (including Gemini, OpenAI, Anthropic, Llama, and more) via a REST API allowing developers to use it with any cloud or infrastructure.” | official | 2026-06-14 |
| s2 | [Model Armor overview documentation](https://cloud.google.com/security-command-center/docs/model-armor-overview) “When prompt injection and jailbreak detection is enabled, Model Armor scans prompts and responses for malicious content. If detected, Model Armor blocks the prompt or response.” | official | 2026-06-14 |
| s3 | [Security Command Center pricing (Model Armor token rates)](https://cloud.google.com/security-command-center/pricing) “In this standalone scenario, there is no cost for using Model Armor up to 2 million tokens per month. Use of Model Armor beyond this no-cost monthly allocation is billed at a rate of $0.10 per million tokens.” | official | 2026-06-14 |
| s4 | [Model Armor release notes: FedRAMP High and MCP server integration](https://docs.cloud.google.com/model-armor/release-notes) “April 06, 2026 Change Model Armor is FedRAMP High compliant. April 22, 2026 Feature Model Armor integration with Google and Google Cloud MCP servers is in General Availability.” | official | 2026-06-18 |
| s5 | [Google Cloud blog: How Model Armor can help protect your AI apps (October 22, 2025)](https://cloud.google.com/blog/products/identity-security/how-model-armor-can-help-protect-your-ai-apps/) “Model Armor has five main capabilities. Prompt injection and jailbreak detection ... Sensitive data protection ... Malicious URL detection ... Harmful content filtering ... Document screening” | official | 2026-06-14 |
| s6 | [Model Armor release notes: GKE integration general availability](https://docs.cloud.google.com/model-armor/release-notes) “September 15, 2025 Feature Model Armor integration with Google Kubernetes Engine is available in General Availability.” | official | 2026-06-14 |
| s7 | [Model Armor release notes: Gemini Enterprise Agent Platform general availability](https://docs.cloud.google.com/model-armor/release-notes) “December 03, 2025 Feature Model Armor integration with Gemini Enterprise Agent Platform is available in General Availability.” | official | 2026-06-14 |
| s8 | [Promptfoo: Testing Google Cloud Model Armor (third-party evaluation guide)](https://www.promptfoo.dev/docs/guides/google-cloud-model-armor/) “Model Armor is a Google Cloud service that screens LLM prompts and responses for security and safety risks. It integrates with Vertex AI, Gemini, and other services.” | research | 2026-06-14 |
| s9 | [TrueFoundry docs on integrating Google Model Armor as a gateway guardrail](https://www.truefoundry.com/docs/ai-gateway/google-model-armor) “Google Model Armor is a fully managed Google Cloud service that screens LLM prompts and responses for security and safety risks. It works with any model on any cloud platform, supporting multi-cloud and multi-model scenarios.” | other | 2026-06-14 |
| s10 | [SiliconANGLE: Google Cloud adds new protections for AI agents and cloud workloads at Security Summit 2025](https://siliconangle.com/2025/08/19/google-cloud-adds-new-protections-ai-agents-cloud-workloads-security-summit-2025/) “Model Armor, Google Cloud's in-line protection system that defends AI agents against threats such as prompt injection, data leakage and tool poisoning, is being enhanced with in-line protection for Google Agentspace prompts and responses.” | press | 2026-06-29 |
| s11 | [SiliconANGLE: Google rolls out new Security Operations agents, Wiz integrations and agent governance tools](https://siliconangle.com/2026/04/22/google-cloud-next-new-security-operations-agents-wiz-integrations-agent-governance-tools/) “Another feature, Model Armor, offers runtime protection for model and agent interactions and is integrating in preview with Agent Gateway, Agent Runtime and LangChain.” | press | 2026-06-29 |
| s12 | [InfoWorld: Google boosts Vertex AI Agent Builder with new observability and deployment tools](https://www.infoworld.com/article/4085736/google-boosts-vertex-ai-agent-builder-with-new-observability-and-deployment-tools.html) “New governance tools, such as agent identities tied to Cloud IAM and Model Armor, which block prompt injection attacks, are designed to improve security and compliance.” | press | 2026-06-29 |
| s13 | [InfoQ: Google Cloud's AI Protection: a Solution to Securing AI Assets](https://www.infoq.com/news/2025/03/gcp-ai-protection-security/) “AI Protection leverages advanced security intelligence and research from Google and Mandiant to effectively safeguard customers' AI systems.” | press | 2026-06-29 |
| s14 | [Blueinfy: Guardrails for AI Applications, Google Cloud](https://blog.blueinfy.com/2026/01/guardrails-for-ai-applications-google.html) “Google Cloud provides configurable guardrails and security options that allow teams to protect LLM and AI Agents against risks such as prompt injection, hallucinations, and adversarial inputs.” | research | 2026-06-29 |
| s15 | [ARMO: AI Workload Security on GKE, Google Cloud Native vs Third-Party Solutions](https://www.armosec.io/blog/gke-ai-workload-security-comparison/) “Model Armor is a content-plane control. It inspects prompts and responses well within its design intent. It does not see what the agent does after a screened response, the syscalls, child processes, and network destinations that determine the actual security outcome.” | research | 2026-06-29 |

### Deep-Dive Sources

Cited from the Strategy Deep Dive section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Google Model Armor product page](https://cloud.google.com/security/products/model-armor) “Model Armor protects all LLMs (including Gemini, OpenAI, Anthropic, Llama, and more) via a REST API allowing developers to use it with any cloud or infrastructure.” | official | 2026-06-18 |
| s2 | [Model Armor overview documentation](https://cloud.google.com/security-command-center/docs/model-armor-overview) “When prompt injection and jailbreak detection is enabled, Model Armor scans prompts and responses for malicious content. If detected, Model Armor blocks the prompt or response.” | official | 2026-06-14 |
| s3 | [Security Command Center pricing (Model Armor token rates)](https://cloud.google.com/security-command-center/pricing) “In this standalone scenario, there is no cost for using Model Armor up to 2 million tokens per month. Use of Model Armor beyond this no-cost monthly allocation is billed at a rate of $0.10 per million tokens.” | official | 2026-06-18 |
| s4 | [Model Armor release notes: FedRAMP High and MCP server integration](https://docs.cloud.google.com/model-armor/release-notes) “April 06, 2026 Change Model Armor is FedRAMP High compliant. April 22, 2026 Feature Model Armor integration with Google and Google Cloud MCP servers is in General Availability.” | official | 2026-06-15 |
| s5 | [Google Cloud blog: How Model Armor can help protect your AI apps (October 22, 2025)](https://cloud.google.com/blog/products/identity-security/how-model-armor-can-help-protect-your-ai-apps/) “Model Armor has five main capabilities. Prompt injection and jailbreak detection ... Sensitive data protection ... Malicious URL detection ... Harmful content filtering ... Document screening” | official | 2026-06-18 |
| s6 | [Model Armor release notes: GKE integration general availability](https://docs.cloud.google.com/model-armor/release-notes) “September 15, 2025 Feature Model Armor integration with Google Kubernetes Engine is available in General Availability.” | official | 2026-06-14 |
| s7 | [Model Armor release notes: Gemini Enterprise Agent Platform general availability](https://docs.cloud.google.com/model-armor/release-notes) “December 03, 2025 Feature Model Armor integration with Gemini Enterprise Agent Platform is available in General Availability.” | official | 2026-06-14 |
| s8 | [Google Model Armor product page: hybrid detection approach](https://cloud.google.com/security/products/model-armor) “It uses a hybrid defense in-depth approach that combines rules-based controls, ML models, and powerful AI reasoning models to provide adaptive defenses.” | official | 2026-06-18 |
| s9 | [Security Command Center pricing: Model Armor subscription token allocation](https://cloud.google.com/security-command-center/pricing) “Security Command Center tier Enterprise - subscription Tokens included at no cost (per month) 3 billion Cost per additional 1 million tokens (USD) $0.10” | official | 2026-06-18 |
| s10 | [Promptfoo: Testing Google Cloud Model Armor (third-party evaluation guide)](https://www.promptfoo.dev/docs/guides/google-cloud-model-armor/) “Model Armor is a Google Cloud service that screens LLM prompts and responses for security and safety risks. It integrates with Vertex AI, Gemini, and other services.” | research | 2026-06-14 |
| s11 | [SiliconANGLE: Google rolls out new Security Operations agents, Wiz integrations and agent governance tools](https://siliconangle.com/2026/04/22/google-cloud-next-new-security-operations-agents-wiz-integrations-agent-governance-tools/) “Another feature, Model Armor, offers runtime protection for model and agent interactions and is integrating in preview with Agent Gateway, Agent Runtime and LangChain.” | press | 2026-06-29 |
| s12 | [InfoWorld: Google boosts Vertex AI Agent Builder with new observability and deployment tools](https://www.infoworld.com/article/4085736/google-boosts-vertex-ai-agent-builder-with-new-observability-and-deployment-tools.html) “New governance tools, such as agent identities tied to Cloud IAM and Model Armor, which block prompt injection attacks, are designed to improve security and compliance.” | press | 2026-06-29 |
| s13 | [Blueinfy: Guardrails for AI Applications, Google Cloud](https://blog.blueinfy.com/2026/01/guardrails-for-ai-applications-google.html) “Google Cloud provides configurable guardrails and security options that allow teams to protect LLM and AI Agents against risks such as prompt injection, hallucinations, and adversarial inputs.” | research | 2026-06-29 |
| s14 | [ARMO: AI Workload Security on GKE, Google Cloud Native vs Third-Party Solutions](https://www.armosec.io/blog/gke-ai-workload-security-comparison/) “Model Armor is a content-plane control. It inspects prompts and responses well within its design intent. It does not see what the agent does after a screened response, the syscalls, child processes, and network destinations that determine the actual security outcome.” | research | 2026-06-29 |

## Disclaimer

This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.

The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.

Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.

The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.

To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.

Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.

Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.