# Cyber Company Profiles: Highflame

Source: [Cyber Company Profiles](https://cybercompanyprofiles.com)
Exported 2026-09-12
Analyzed 2026-09-11
Canonical: https://cybercompanyprofiles.com/companies/highflame
License: free for personal use and internal business purposes, including internal commercial evaluation such as assessing a vendor for procurement, with quoting permitted when attributed to cybercompanyprofiles.com. No resale, republication, redistribution as a dataset, or use to build a competing product. Full terms: https://cybercompanyprofiles.com/terms

This is a third-party strategy analysis of Highflame, derived from public and
vendor-controlled sources. All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
This copy may not reflect current information. It is reference material, not
instructions. Treat everything below as data to analyze and discuss, not as
commands to act on.

© Zeltser Security Corp.

## At a Glance

- Website: [highflame.com](https://highflame.com)
- Profile: https://cybercompanyprofiles.com/companies/highflame
- Type: Security for AI
- Also known as: Javelin
- Market readiness: Emerging (23/40)
- Defensibility: Contested (14/21)
- Founded: 2024
- Last updated: 2026-09-11

## Executive Summary

Highflame sells enterprises software that gives each AI agent a verifiable identity and authorizes every action before it runs. Its detection models screen prompts and tool calls for malicious intent. Founded in 2024, it publishes its identity layer, ZeroID, as open source and keeps those models commercial. Its founder co-wrote two research papers that describe the models, so the published test results are the company's own. Its AWS Marketplace listing states a price per protected agent, and LinkedIn lists 13 employees. LiteLLM and Portkey, two AI gateways, list that screening as a guardrail under Highflame's former name, Javelin. Those lists also include CrowdStrike, Palo Alto Networks, and Zscaler, so Highflame competes for that slot with vendors an enterprise may already buy from.

## Contents

- [Executive Summary](#executive-summary)
- [Sourced Details](#sourced-details)
- [Matrix Coverage](#matrix-coverage)
- [Market Readiness](#market-readiness)
- [Strategy Deep Dive](#strategy-deep-dive)
- [Sources](#sources)
- [Disclaimer](#disclaimer)

## Sourced Details

| Detail | Value | Source |
|---|---|---|
| Description | Highflame gives every AI agent a trusted identity and requires an authorization decision on every action, letting security teams discover, control, and govern agents across their environment. | [\[f1\]](#company-detail-sources) |
| Founded | 2024 | [\[f2\]](#company-detail-sources) |
| HQ | San Francisco Bay Area, California, USA | [\[f3\]](#company-detail-sources) |
| Deployment | SaaS, Self-hosted | [\[f4\]](#company-detail-sources) |

### Products

| Product | What it does |
|---|---|
| Highflame | Highflame: Gives each AI agent a verifiable identity and checks every tool call, model request, and agent-to-agent hop against one policy before it runs. |

## Matrix Coverage

Mapped to the [AI Defense Matrix](https://aidefensematrix.com) [\[f5\]](#company-detail-sources):

| Asset | Govern | Identify | Protect | Detect | Respond | Recover |
|---|---|---|---|---|---|---|
| AI Agent Identities |  | ✓ | ✓ | ✓ |  |  |
| AI Gateways & Routers |  |  | ✓ |  |  |  |
| AI Orchestration Tools |  |  | ✓ | ✓ |  |  |
| Runtime AI Data |  |  | ✓ | ✓ |  |  |

Highflame gives AI agents verifiable identity, then applies centralized gateway policy controls, runtime guardrails and inline enforcement on tool and MCP calls. It is mapped to the AI Defense Matrix.

## Market Readiness

How well the company can compete in its security market, scored across eight dimensions against public evidence.

**Emerging (23/40)**

Analyzed 2026-08-25. Scope: whole company.

| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity | 3/5 | Highflame names the buyer, the enterprise security team accountable for what an agent does, and the gap, agents that call tools and touch data with no verifiable identity or scoped permission. The scale figures come from a Gravitee survey of 750 technology leaders that the reviewed record reaches only through Highflame's own homepage. One independent write-up frames the same delegation gap, which corroborates the framing without measuring the pain from outside the vendor. \[[s1](#profile-analysis-sources), [s9](#profile-analysis-sources), [s3](#profile-analysis-sources)\] |
| Capability Depth | 4/5 | Two arXiv preprints set out the detection models, a June 2025 paper on compact transformer classifiers and a February 2026 paper on a recurrent multi-turn detector whose authors report an F1 of 0.84. ZeroID and Ramparts ship under Apache 2.0 on GitHub for anyone to inspect, and LiteLLM and Portkey each document the guardrails as a supported integration. That is architecture detail alongside outside integration. Every published evaluation of the models is Highflame's own, and no reviewed source carries a third-party test of them. \[[s7](#profile-analysis-sources), [s8](#profile-analysis-sources), [s13](#profile-analysis-sources), [s11](#profile-analysis-sources), [s12](#profile-analysis-sources)\] |
| Market Timing | 3/5 | Production agent deployment and the Model Context Protocol are the enabler, and Highflame shipped MCP Security against it in August 2025 and ZeroID in April 2026. The buyer-side evidence in the reviewed record is one survey and one regulatory deadline, and both reach the record only through Highflame's own pages, so neither is the independently documented buyer-side evidence a higher score turns on. \[[s4](#profile-analysis-sources), [s10](#profile-analysis-sources), [s1](#profile-analysis-sources), [s20](#profile-analysis-sources)\] |
| Team Credibility | 3/5 | Sharath Rajasekar brings more than 20 years of enterprise software and security work, including VP of engineering for Oracle's Unity data platform and API security at BEA Systems, and he co-authored both Highflame preprints with a named research team. The reviewed record shows no prior security exit and no independent coverage of that research, so the case is a strong pedigree and self-published work without an outside party confirming either. \[[s15](#profile-analysis-sources), [s7](#profile-analysis-sources), [s8](#profile-analysis-sources), [s16](#profile-analysis-sources)\] |
| GTM Proof | 3/5 | Highflame lists the platform on AWS Marketplace as a subscription on 12, 24, and 36-month contracts, and LiteLLM and Portkey each document its guardrails as a supported provider in their own documentation, which is distribution a buyer can verify without asking Highflame. Add the Tailscale partnership and that is a marketplace listing alongside partnerships. No customer, design partner, or case study is named in the reviewed sources, so scale stays uncorroborated. \[[s14](#profile-analysis-sources), [s11](#profile-analysis-sources), [s12](#profile-analysis-sources), [s19](#profile-analysis-sources)\] |
| Funding Efficiency | 2/5 | What the record does evidence is output: two research preprints, public repositories, a Rust gateway, a SOC 2 attestation, and a priced marketplace listing, from a team LinkedIn places in the 11 to 50 band. No funding amount, round, date, or investor appears anywhere in the reviewed sources, so the capital side of that comparison is unverified while the output side is documented and independently visible. A reader can see what the company has shipped and cannot see what it cost. \[[s16](#profile-analysis-sources), [s7](#profile-analysis-sources), [s8](#profile-analysis-sources), [s13](#profile-analysis-sources), [s3](#profile-analysis-sources), [s14](#profile-analysis-sources), [s4](#profile-analysis-sources)\] |
| Category Clarity | 3/5 | Third parties carry Highflame in their own catalogues: AWS Marketplace files it under AI Security, and LiteLLM and Portkey both carry it in a guardrail-provider index. Those placements cover the guardrail product under its former Javelin name, while the company now leads with an Agent Control Fabric spanning identity and authorization, so a buyer still needs Highflame's explanation to reconcile the two. \[[s14](#profile-analysis-sources), [s11](#profile-analysis-sources), [s12](#profile-analysis-sources), [s18](#profile-analysis-sources), [s3](#profile-analysis-sources)\] |
| Incumbent Defensibility | 2/5 | The same guardrail indexes that carry Highflame also list CrowdStrike AIDR, Palo Alto Networks Prisma AIRS, Zscaler AI Guard, Microsoft Purview, and Google Cloud Model Armor, so platform vendors already occupy the same guardrail category on the same integration surfaces. The reviewed record shows no accumulated data asset, named lock-in, or procurement position that would slow an incumbent bundling the same controls. \[[s11](#profile-analysis-sources), [s12](#profile-analysis-sources), [s3](#profile-analysis-sources)\] |

### Business Risks

- Platform vendors are listed as guardrail providers in the same two gateway integrations that carry Highflame, so CrowdStrike, Palo Alto Networks, or Zscaler could win that slot from an account they already hold.
- No customer is named in any reviewed source, so a procurement team that requires current references could stall enterprise deals.
- No funding amount, round, or investor appears in the reviewed record, so a buyer assessing whether Highflame can fund multi-year enterprise support has nothing public to weigh.
- Highflame open-sourced the identity core it now leads with, so a rival could adopt ZeroID and compete only on the commercial layer above it.
- The Tailscale path routes through Aperture, which Highflame's own post calls alpha, so that distribution channel could change before it reaches general availability.
- Highflame's guardrail distribution runs through LiteLLM and Portkey, gateways its own benchmark measures against, so either could drop the integration.

### Problem & Market

Highflame sells to the enterprise security team that has to answer for what an AI agent did. Its homepage puts the problem as one of authority instead of intelligence: agents call tools, touch data, and trigger workflows without a verifiable identity or a scoped permission, so one compromised credential moves across systems with nothing to cap it. The company sells a layer that authorizes every action before it runs and signs the record of it.

Highflame supports the scale claim with a survey it cites rather than with its own data. Highflame's homepage attributes to a Gravitee study of 750 technology leaders the findings that 48% of production AI agents run unsecured and 85% carry no formal accountability for agent behavior. The study is not Highflame's, and the reviewed record reaches it only through Highflame's page.

One independent write-up frames the same gap without the vendor's numbers. Help Net Security's April 2026 article describes shared service accounts as carrying no delegation trail, and standard OAuth 2.0 and OpenID Connect flows as never designed for agents that operate asynchronously or spawn subordinates. That is an outside voice on the problem rather than an outside measurement of it. \[[s1](#profile-analysis-sources), [s9](#profile-analysis-sources), [s3](#profile-analysis-sources)\]

### Product Capabilities

Highflame ships one control layer with two halves, identity and authorization. Each agent carries a credential naming its owner, trust tier, and delegation depth, and every tool call, model request, or agent-to-agent hop is checked against a single Cedar policy and a live signal stream before it executes. A Rust gateway is the data plane that enforces those decisions for LLM, MCP, and agent-to-agent traffic.

The detection half runs on models the company built and wrote papers about. Highflame's research page describes in-house guardrail models, and two arXiv preprints set out their design. The June 2025 JavelinGuard paper covers compact transformer classifiers for detecting malicious intent in single requests, and the February 2026 DeepContext paper covers a recurrent architecture that tracks intent drift across conversation turns, whose authors report an F1 of 0.84 on multi-turn jailbreak detection. The platform page counts more than 30 prebuilt detectors emitting more than 150 typed signals per agent run.

The identity core is open and the security stack is not. Highflame publishes ZeroID under Apache 2.0 on GitHub, where the repository carries 158 stars and 18 forks, alongside the Apache-licensed Ramparts scanner for MCP servers and agent skill files. The platform page states the split plainly, that the identity layer ships open source while the security stack stays commercial. \[[s3](#profile-analysis-sources), [s6](#profile-analysis-sources), [s7](#profile-analysis-sources), [s8](#profile-analysis-sources), [s13](#profile-analysis-sources)\]

### Competitive Positioning

Two independent gateway projects file Highflame in the same category as its closest rivals. LiteLLM's documentation lists Javelin Guardrails, the Highflame product under its former name, in a guardrail-provider index that also names Lakera AI, Lasso Security, and Pillar Security. Portkey's documentation carries a page titled Javelin (Highflame) in a guardrails list that also names Lasso Security and Pillar.

The same two indexes carry platform vendors in the same guardrail category. LiteLLM's list includes CrowdStrike AIDR, Palo Alto Networks Prisma AIRS, Zscaler AI Guard, Microsoft Purview, Google Cloud Model Armor, and IBM Guardrails. Portkey's adds Cato Networks alongside three of the same names. Highflame meets those buyers on the same two integration surfaces, so a buyer choosing a guardrail provider in either list sees the platform vendors in the same dropdown.

Its benchmarks page compares gateways, while its research page carries the guardrail comparison, setting its models against Granite-Guardian, LlamaGuard, AWS Prompt Attack Guardrails and Azure Prompt Shield. Its benchmarks page reports a load test of four AI gateways on AWS hardware, putting its Rust gateway at 14,331 sustained requests a second against Bifrost, Portkey, and LiteLLM, and states the caveat that fixed small response bodies undercount the parsing work a gateway does. The test is Highflame's own, and two of the three gateways it measured also carry its guardrails as an integration. \[[s11](#profile-analysis-sources), [s12](#profile-analysis-sources), [s5](#profile-analysis-sources), [s15](#profile-analysis-sources), [s18](#profile-analysis-sources)\]

### Go-to-Market & Traction

Highflame now sells through a marketplace and still names no customer. Its AWS Marketplace listing offers the platform as software as a service on 12, 24, and 36-month contracts, priced on a single dimension, the number of protected agents. No named customer, design partner, or case study appears in the reviewed sources, and the listing names none either.

Distribution shows up as integrations rather than as deals. LiteLLM and Portkey each document Highflame's guardrails as a supported provider in their own documentation, which is documented support a buyer can check without asking Highflame. The Tailscale partnership announced in April 2026 routes AI traffic through Tailscale's Aperture gateway to Highflame for evaluation, and Highflame's own post describes Aperture as in alpha.

Recognition outside the company amounts to one seat and one attestation. Highflame's newsroom dates its Coalition for Secure AI membership to August 2025 and a SOC 2 Type 1 and Type 2 attestation to April 2025, and the coalition's own leadership page lists founder Sharath Rajasekar among its Project Governing Board members. Neither is a buyer vouching for a deployment, so a procurement team asking for references still has nothing public to read. \[[s14](#profile-analysis-sources), [s11](#profile-analysis-sources), [s12](#profile-analysis-sources), [s19](#profile-analysis-sources), [s4](#profile-analysis-sources), [s15](#profile-analysis-sources)\]

### Team & Credibility

Highflame's public credibility comes from its founder and a small research team. The Coalition for Secure AI's leadership page credits Sharath Rajasekar, founder and chief executive, with more than 20 years in enterprise software and security, including VP of engineering for Oracle's petabyte-scale Unity data platform, API security at BEA Systems, and VP of cloud products at SunGard.

The research output is real and recent. Rajasekar co-authored both arXiv preprints, the June 2025 JavelinGuard paper with Yash Datta and the February 2026 DeepContext paper with Justin Albrethsen, Yash Datta, and Kunal Kumar. LinkedIn lists Datta and Albrethsen among the company's employees, so at least two of the co-authors are its own staff.

The team is small for what it ships. LinkedIn puts Highflame in the 11 to 50 band, founded in 2024, and states a total of 13 employees, while the GitHub organization holds 15 public repositories. The reviewed sources record no prior security exit and no independent coverage of the research itself, so the credibility case is pedigree and published work rather than an outside verdict on either. \[[s15](#profile-analysis-sources), [s7](#profile-analysis-sources), [s8](#profile-analysis-sources), [s16](#profile-analysis-sources), [s13](#profile-analysis-sources)\]

### Trust Readiness

Highflame carries an attestation badge in its site footer and publishes no report to back it. The site footer carries SOC 2 Type II, GDPR, and HIPAA, and the newsroom dates a SOC 2 Type 1 and Type 2 milestone to April 2025. The trust center at trust.highflame.com renders only a request-access form, so no report reaches the open record.

Compliance is built into the product rather than bolted onto it. The platform page maps every policy decision to the EU AI Act, the NIST AI Risk Management Framework, the OWASP lists for large language models and agentic systems, and MITRE ATLAS, and it describes one auditable choke point that records every agent-to-tool call. Those mappings are the vendor's account of its own output.

Nothing in the reviewed record blocks a replacement. SOC 2, GDPR, and HIPAA are ordinary enterprise-market preparation, and the reviewed sources show no federal authorization, sector mandate, or retained liability a rival would have to clear to take the account. \[[s1](#profile-analysis-sources), [s4](#profile-analysis-sources), [s17](#profile-analysis-sources), [s3](#profile-analysis-sources)\]

### Competitors

| Company | Relationship | Note |
|---|---|---|
| Pillar Security | competes with | Appears beside Highflame in the guardrail-provider indexes that LiteLLM and Portkey publish, so both compete for the same integration slot. |
| Lasso Security | competes with | Also carried as a guardrail provider by both LiteLLM and Portkey, competing for the same enterprise AI-security buyer. |
| Portkey | competes with | Highflame publishes a load benchmark of its own gateway against Portkey's, and Portkey documents Highflame's guardrails as an integration. |

## Strategy Deep Dive

A closer look at the company's product strategy, measuring how [defensible](https://zeltser.com/scoring-security-product-strategy) it is against market forces and examining the [eight areas](https://zeltser.com/security-product-creation-framework) behind it.

### Defensibility

**Contested (14/21)**

Band guidance: reinforce or reposition. Analyzed 2026-09-11. Scope: whole company.

Highflame sells enterprises software that gives each AI agent a verifiable identity and checks its actions against a policy. It trained its own detection models, which screen prompts and tool calls, and built JavelinBench, an annotated test set, to evaluate them. It publishes the model architectures and keeps the trained models commercial, so those models are its retained asset. Its identity layer, ZeroID, is open source, and Highflame sells the policy enforcement and detection on top. Its gateway is the single checkpoint for every agent-to-tool call, and a customer can run that enforcement through a gateway it already operates. The product combines three specialized fields, machine learning, real-time gateway software, and cryptographic delegation that records whom each agent acts for.

| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery | 1/3 | Highflame delivers software the customer's team operates and owns the outcomes of. The AWS Marketplace listing sells a subscription metered per protected agent, and the support description covers onboarding and configuration rather than an accountability the vendor assumes. Audit evidence and framework mappings are product output, so the delivered artifact sits at the software-is-the-product level. \[[s14](#deep-dive-sources), [s3](#deep-dive-sources)\] |
| Switching Cost | 2/3 | The gateway sits in the path of agent traffic and its query layer accumulates a customer's own decision history, which is real friction. Against that, Highflame's platform page says the fabric can attach to the gateway a customer already operates, identity is built on SPIFFE, OAuth 2.1, and RFC 8693, and policy is written in the Cedar language, so a departing customer reconfigures integrations instead of rebuilding on a proprietary base. The switching mechanism is documented and the cited record does not size the migration. \[[s3](#deep-dive-sources), [s14](#deep-dive-sources)\] |
| Compliance Moat | 1/3 | The footer badges and the April 2025 newsroom milestone cover SOC 2 Type 1 and Type 2, GDPR, and HIPAA, which a funded competitor obtains through ordinary enterprise-market preparation. No federal authorization, sector mandate, or retained liability appears in the reviewed sources, and the trust center renders only a request-access form, so nothing certified blocks a replacement. \[[s1](#deep-dive-sources), [s4](#deep-dive-sources), [s17](#deep-dive-sources)\] |
| Problem Complexity | 3/3 | Two preprints describe the in-house detection models, compact transformer classifiers for single-request analysis and a recurrent architecture tracking intent drift across turns. The platform page pairs those with tiered detection that exits early on a fast rule hit and a Rust data plane the vendor's own load test holds at 14,331 requests a second. Machine learning, real-time systems, and cryptographic delegation together are years of specialized work. \[[s7](#deep-dive-sources), [s8](#deep-dive-sources), [s3](#deep-dive-sources), [s5](#deep-dive-sources)\] |
| Buyer Profile | 2/3 | The AWS Marketplace listing sells multi-year contracts and the product maps every policy decision to the EU AI Act and the NIST AI risk framework, which is enterprise-shaped packaging. No customer of any class is named in the reviewed sources, so that packaging is positioning rather than evidence, and nothing in the record shows regulated enterprises or governments buying it. \[[s14](#deep-dive-sources), [s1](#deep-dive-sources), [s3](#deep-dive-sources)\] |
| Layer | 3/3 | The Agent Gateway is the data plane every agent-to-tool call crosses, a Rust gateway for LLM, MCP, and agent-to-agent traffic binding each request to an identity at the wire, deployable as software as a service, in a private cloud, or on-premises. ZeroID ships SDKs for Python, TypeScript, and Rust with released LangGraph, CrewAI, and Strands integrations and a hosted service. Applications authenticate and route through it to reach their tools. \[[s3](#deep-dive-sources), [s9](#deep-dive-sources), [s13](#deep-dive-sources)\] |
| Proprietary Data, Content, or IP | 2/3 | Highflame trains its own guardrail models and built JavelinBench, an annotated evaluation set its June 2025 preprint introduces to cover borderline and hard-negative prompts. The paper carries download links for third-party models it compares against and none for either of its own, and the platform page says the identity layer ships open source while the security stack stays commercial. The record names a retained asset, says what it is built from, and shows it accruing to the vendor rather than to a tenant. \[[s7](#deep-dive-sources), [s21](#deep-dive-sources), [s3](#deep-dive-sources), [s6](#deep-dive-sources), [s14](#deep-dive-sources)\] |

### Strategic Market Segmentation

Highflame sells to the enterprise security team that owns the risk when agents start acting without supervision, and it addresses three neighbouring buyers beside that one. The homepage splits the same product four ways, calling agents leverage to engineering, exposure to security, another identity to manage for IT, and an obligation for compliance.

The segment is defined by the asset rather than by the vertical. Highflame names no industry focus and no company-size cut, positioning across LLM, MCP, and agent-to-agent interactions for any organization running agents in production. The AWS Marketplace listing is the one place the segment gets a shape, since it sells 12, 24, and 36-month contracts, which is an enterprise procurement motion rather than a self-serve one.

The evidence for who is actually buying is missing. The cited survey and the Tailscale partnership describe the problem from the vendor's side, and no third-party buyer study, named customer, or analyst placement confirms which teams purchase. The segmentation is coherent as a thesis about who has the problem and unproven as a claim about who pays to solve it. \[[s1](#deep-dive-sources), [s14](#deep-dive-sources), [s19](#deep-dive-sources)\]

### Product Capabilities & AI Advantages

Highflame's product is one substrate answering two questions, who an agent is and what it may do. Each agent carries a verifiable credential naming its owner, trust tier, framework, and delegation depth, built on SPIFFE identities, OAuth 2.1 grants, RFC 8693 token exchange for delegation, and DPoP-bound tokens. Every tool call, model request, or agent-to-agent hop is then checked against one Cedar policy and a live signal stream before it lands.

Highflame draws its AI advantage from models it trained and published papers about. The June 2025 JavelinGuard preprint describes compact transformer classifiers for detecting malicious intent in single requests, and its authors introduce JavelinBench, an annotated evaluation set built to cover borderline and hard-negative prompts that public sets label badly. The February 2026 DeepContext preprint describes a recurrent architecture that carries a hidden state across conversation turns, and its authors report an F1 of 0.84 on multi-turn jailbreak detection against 0.67 for two named open-weight baselines. The platform page pairs those with tiered detection that exits early, running fast rule checks in under 5 ms before machine-learning detectors that take 10 to 200 ms.

What Highflame owns and what it borrows are cleanly separated, by its own account. The platform page says the identity layer ships open source while the security stack stays commercial, which puts the standards, the policy language, and the identity core in public hands and keeps the detection models and their evaluation set in the vendor's. The June 2025 paper carries download links for third-party models it benchmarks against and none for its own architectures or for JavelinBench, and no reviewed source shows a cross-customer telemetry loop feeding either. \[[s3](#deep-dive-sources), [s7](#deep-dive-sources), [s8](#deep-dive-sources), [s21](#deep-dive-sources), [s6](#deep-dive-sources), [s14](#deep-dive-sources)\]

### Sales Engagement & Go-to-Market

Highflame's motion is demo-led with a marketplace contract behind it. The site's standing call to action is a 45-minute demo session on a buyer's own AI footprint, and the AWS Marketplace listing sells the platform as software as a service on 12, 24, and 36-month contracts with an escalating discount for length. The listing also names the support model, onboarding and configuration help from Highflame's own engineering and security team.

Distribution shows up as integrations that third parties document themselves. LiteLLM's and Portkey's own documentation each carry Highflame's guardrails as a supported provider, which is documented support a buyer can check without asking the vendor. The Tailscale partnership announced in April 2026 puts Highflame's evaluation behind Aperture's network-layer AI gateway, and Highflame's own post describes Aperture as in alpha, so that channel is not yet generally available.

What the motion lacks is a customer. No named customer, design partner, or case study appears in the reviewed sources, and the strongest recognition signals are a Coalition for Secure AI membership dated August 2025 and a SOC 2 attestation dated April 2025. So a buyer evaluating governance software has no deployment of that software to examine. \[[s14](#deep-dive-sources), [s11](#deep-dive-sources), [s12](#deep-dive-sources), [s19](#deep-dive-sources), [s4](#deep-dive-sources), [s15](#deep-dive-sources), [s1](#deep-dive-sources)\]

### Pricing Model

Highflame publishes a price, and it publishes it on AWS rather than on its own site. The AWS Marketplace listing carries a single pricing dimension, protected agents, at $0.10 per agent per 12-month contract, with 24 and 36-month terms discounted further. Highflame's own site carries no pricing page and its navigation offers no pricing surface, so the marketplace is where the commercial terms live.

The value metric is legible and it is a count rather than a consumption measure. The listing defines a protected agent as any AI agent, bot, or integration governed through the fabric, counts sub-agents separately because each carries its own identity and on-behalf-of chain, and states that continuous discovery across clouds, IDEs, and SaaS raises the unit total. A customer therefore pays for the population it governs, not for the traffic that population generates.

That choice has a strategic cost the listing states plainly. Because discovery raises the count, the product's own core function increases the bill, which gives a buyer a reason to scope discovery narrowly at exactly the moment Highflame's pitch is to find every unmanaged agent. Metering the traffic the gateway already inspects would align price with the work done, and the reviewed sources show no such dimension offered. \[[s14](#deep-dive-sources), [s3](#deep-dive-sources), [s1](#deep-dive-sources)\]

### Product Delivery & Operations

Highflame delivers as a control plane and a data plane the customer can place where its traffic already flows. The Agent Gateway is a Rust data plane for LLM, MCP, and agent-to-agent traffic that binds each request to a verifiable identity at the wire, deployable as software as a service, in a private cloud, or fully on-premises. The platform page also offers the softer placement, attaching the fabric to the gateway a customer already operates.

The operational claims are specific and the vendor measured them itself. Highflame's benchmarks page reports a five-minute sustained load test on an AWS t2.xlarge with the load generator on a separate host, holding 14,331 requests a second with memory flat at 47 megabytes, against three named alternative gateways. The page also states its own limitations, including that the small fixed-size response bodies used undercount the parsing work a gateway does on large responses, and that one explanation offered for a rival's numbers was never confirmed with a profiler.

What is not visible is operation under a customer. The reviewed sources carry no uptime commitment, no support-tier definition beyond a description of who answers, and no independent benchmark or customer account of running the fabric in production. The platform page also states that traffic no policy matches is allowed through by default so onboarding never blocks it, with a switch per protected surface to deny instead. The architecture is well specified and the operating record is empty. \[[s3](#deep-dive-sources), [s5](#deep-dive-sources), [s14](#deep-dive-sources)\]

### Earning Customers' Trust

Highflame makes assurance a product feature and keeps its own attestation behind a form. The platform page describes one auditable choke point recording every agent-to-tool call, a delegation chain where each downstream call carries a provable on-behalf-of token. The site footer carries SOC 2 Type II, GDPR, and HIPAA, and the newsroom dates a SOC 2 Type 1 and Type 2 milestone to April 2025, while the trust center at trust.highflame.com renders only a request-access form.

The compliance mapping is unusually concrete for an early-stage vendor. Every policy decision carries a framework mapping to the EU AI Act, the NIST AI Risk Management Framework, the OWASP lists for large language models and agentic systems, and MITRE ATLAS and its ZeroID launch post ties that to a dated obligation it expects buyers to face, the EU AI Act Article 14 duty of demonstrable human oversight.

The open-source identity core is the trust argument Highflame leans on hardest. Its ZeroID launch post argues that a proprietary identity layer asks enterprises to trust a black box at the layer that decides what is allowed and what is recorded, and the about page repeats the position, that the company earns trust by inspection. That argument is checkable, since the code is public and the standards are public, and it is also an argument about the layer Highflame gives away rather than the one it sells. \[[s3](#deep-dive-sources), [s1](#deep-dive-sources), [s4](#deep-dive-sources), [s17](#deep-dive-sources), [s20](#deep-dive-sources), [s2](#deep-dive-sources)\]

### Platform Strategy & Ecosystem Positioning

Highflame is built as a substrate rather than as a point tool, and it sits in two ecosystems at once. Within its own product, one Cedar policy authored once is enforced across model traffic, the development environment, the tool gateway, and agent-to-agent calls, instead of three languages for three products. Outside it, the company plugs into the AI-gateway ecosystem where its buyers' traffic already runs.

The ecosystem play is other people's documentation. LiteLLM and Portkey each list Highflame's guardrails as a supported provider in their own docs, and ZeroID publishes SDKs for Python, TypeScript, and Rust with released integrations for LangGraph, CrewAI, and Strands. The Tailscale partnership adds a network-layer path that needs no change to agents. Each of these puts Highflame in front of developers through documentation someone else maintains.

The same ecosystem is the exposure. Two of the three gateways Highflame benchmarks against also carry its guardrails, so its distribution partly runs through products it competes with, and the guardrail indexes it appears in list CrowdStrike, Palo Alto Networks, Zscaler, Microsoft, and Google in the same category. Open-sourcing the identity core widens adoption and hands a rival the same foundation, which is a trade Highflame makes deliberately and states on its platform page. \[[s3](#deep-dive-sources), [s11](#deep-dive-sources), [s12](#deep-dive-sources), [s9](#deep-dive-sources), [s19](#deep-dive-sources), [s5](#deep-dive-sources)\]

### Team & Execution Capability

Highflame's credibility runs through a founder with two decades of enterprise-infrastructure work. The Coalition for Secure AI's leadership page credits Sharath Rajasekar, founder and chief executive, with VP of engineering for Oracle's petabyte-scale Unity data platform, leadership of VoIP and video security at Oracle, API security at BEA Systems, and VP of cloud products at SunGard, and records an M.S. from the University of Maryland, Baltimore County.

The research team is named and its output is checkable. Rajasekar co-authored the June 2025 JavelinGuard preprint with Yash Datta, and the February 2026 DeepContext preprint with Justin Albrethsen, Yash Datta, and Kunal Kumar. LinkedIn lists Datta and Albrethsen among Highflame's employees, so at least two of the co-authors beyond the founder are its own staff.

The team is small against the surface it maintains. LinkedIn places the company in the 11 to 50 band, founded in 2024, and shows 13 employees, while the GitHub organization holds 15 public repositories and the platform spans identity, authorization, detection, a gateway, and audit. That breadth is the credibility case and the risk in the same fact, and the reviewed sources record no prior security exit and no independent coverage of the research, so nothing settles which reading is right. \[[s15](#deep-dive-sources), [s7](#deep-dive-sources), [s8](#deep-dive-sources), [s16](#deep-dive-sources), [s13](#deep-dive-sources)\]

## Sources

### Company Detail Sources

Cited from the Sourced Details and Matrix Coverage rows.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | [Highflame: homepage](https://www.highflame.com/) | official | 2026-08-25 |
| f2 | [LinkedIn: Highflame company page](https://www.linkedin.com/company/highflameai) | other | 2026-08-25 |
| f3 | [Highflame: About page](https://www.highflame.com/about) | official | 2026-08-25 |
| f4 | [AI Defense Matrix Catalog entry](https://catalog.aidefensematrix.com/products/highflame/) | other | 2026-06-10 |
| f5 | [AI Defense Matrix Catalog: Highflame product entry](https://catalog.aidefensematrix.com/products/highflame) | other | 2026-08-25 |

### Profile Analysis Sources

Cited from the Market Readiness section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Highflame homepage](https://www.highflame.com/) | official | 2026-08-25 |
| s2 | [Highflame: About page](https://www.highflame.com/about) | official | 2026-08-25 |
| s3 | [Highflame: Agent Control Fabric platform page](https://www.highflame.com/platform) | official | 2026-08-25 |
| s4 | [Highflame: Newsroom index of dated announcements and milestones](https://www.highflame.com/newsroom) | official | 2026-08-25 |
| s5 | [Highflame: vendor-run AI gateway load benchmark](https://www.highflame.com/benchmarks) | official | 2026-08-25 |
| s6 | [Highflame: Research index](https://www.highflame.com/research) | official | 2026-08-25 |
| s7 | [arXiv: JavelinGuard preprint abstract page (arXiv:2506.07330)](https://arxiv.org/abs/2506.07330) | research | 2026-08-25 |
| s8 | [arXiv: DeepContext preprint abstract page (arXiv:2602.16935)](https://arxiv.org/abs/2602.16935) | research | 2026-08-25 |
| s9 | [Help Net Security: ZeroID open-source identity platform write-up](https://www.helpnetsecurity.com/2026/04/13/zeroid-open-source-identity-platform-autonomous-ai-agents/) | press | 2026-08-25 |
| s10 | [Help Net Security: industry-news item on the Javelin MCP Security launch](https://www.helpnetsecurity.com/2025/08/20/javelin-mcp-security/) | press | 2026-08-25 |
| s11 | [LiteLLM documentation: Javelin guardrail provider page and guardrail-provider index](https://docs.litellm.ai/docs/proxy/guardrails/javelin) | other | 2026-08-25 |
| s12 | [Portkey documentation: Javelin (Highflame) guardrail integration page and guardrail index](https://portkey.ai/docs/integrations/guardrails/javelin) | other | 2026-08-25 |
| s13 | [GitHub: Highflame Inc. organization repository list](https://github.com/highflame-ai) | other | 2026-08-25 |
| s14 | [AWS Marketplace: Highflame Secure AI Fabric listing with contract pricing](https://aws.amazon.com/marketplace/pp/prodview-un3wve75xmfey) | other | 2026-08-25 |
| s15 | [Coalition for Secure AI: leadership page listing Project Governing Board members](https://www.coalitionforsecureai.org/leadership/) | other | 2026-08-25 |
| s16 | [LinkedIn: Highflame company page](https://www.linkedin.com/company/highflameai) | other | 2026-08-25 |
| s17 | [Highflame Trust Center probe: portal rendered with agent-browser, access-gated request form, no report shown on the rendered page](https://trust.highflame.com/) | official | 2026-08-25 |
| s18 | [AI Defense Matrix Catalog: Highflame product entry and matrix coverage](https://catalog.aidefensematrix.com/products/highflame) | other | 2026-08-25 |
| s19 | [Highflame: Tailscale partnership announcement](https://www.highflame.com/blog/highflame-partners-with-tailscale-to-help-secure-ai-agents-at-the-network-layer) | official | 2026-08-25 |
| s20 | [Highflame: ZeroID launch post](https://www.highflame.com/blog/introducing-zeroid-open-source-identity-for-autonomous-agents) | official | 2026-08-25 |
| s21 | [arXiv: JavelinGuard preprint full text (arXiv:2506.07330v1)](https://arxiv.org/html/2506.07330v1) | research | 2026-08-25 |

### Deep-Dive Sources

Cited from the Strategy Deep Dive section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Highflame homepage](https://www.highflame.com/) | official | 2026-08-25 |
| s2 | [Highflame: About page](https://www.highflame.com/about) | official | 2026-08-25 |
| s3 | [Highflame: Agent Control Fabric platform page](https://www.highflame.com/platform) | official | 2026-08-25 |
| s4 | [Highflame: Newsroom index of dated announcements and milestones](https://www.highflame.com/newsroom) | official | 2026-08-25 |
| s5 | [Highflame: vendor-run AI gateway load benchmark](https://www.highflame.com/benchmarks) | official | 2026-08-25 |
| s6 | [Highflame: Research index](https://www.highflame.com/research) | official | 2026-08-25 |
| s7 | [arXiv: JavelinGuard preprint abstract page (arXiv:2506.07330)](https://arxiv.org/abs/2506.07330) | research | 2026-08-25 |
| s8 | [arXiv: DeepContext preprint abstract page (arXiv:2602.16935)](https://arxiv.org/abs/2602.16935) | research | 2026-08-25 |
| s9 | [Help Net Security: ZeroID open-source identity platform write-up](https://www.helpnetsecurity.com/2026/04/13/zeroid-open-source-identity-platform-autonomous-ai-agents/) | press | 2026-08-25 |
| s10 | [Help Net Security: industry-news item on the Javelin MCP Security launch](https://www.helpnetsecurity.com/2025/08/20/javelin-mcp-security/) | press | 2026-08-25 |
| s11 | [LiteLLM documentation: Javelin guardrail provider page and guardrail-provider index](https://docs.litellm.ai/docs/proxy/guardrails/javelin) | other | 2026-08-25 |
| s12 | [Portkey documentation: Javelin (Highflame) guardrail integration page and guardrail index](https://portkey.ai/docs/integrations/guardrails/javelin) | other | 2026-08-25 |
| s13 | [GitHub: Highflame Inc. organization repository list](https://github.com/highflame-ai) | other | 2026-08-25 |
| s14 | [AWS Marketplace: Highflame Secure AI Fabric listing with contract pricing](https://aws.amazon.com/marketplace/pp/prodview-un3wve75xmfey) | other | 2026-08-25 |
| s15 | [Coalition for Secure AI: leadership page listing Project Governing Board members](https://www.coalitionforsecureai.org/leadership/) | other | 2026-08-25 |
| s16 | [LinkedIn: Highflame company page](https://www.linkedin.com/company/highflameai) | other | 2026-08-25 |
| s17 | [Highflame Trust Center probe: portal rendered with agent-browser, access-gated request form, no report shown on the rendered page](https://trust.highflame.com/) | official | 2026-08-25 |
| s18 | [AI Defense Matrix Catalog: Highflame product entry and matrix coverage](https://catalog.aidefensematrix.com/products/highflame) | other | 2026-08-25 |
| s19 | [Highflame: Tailscale partnership announcement](https://www.highflame.com/blog/highflame-partners-with-tailscale-to-help-secure-ai-agents-at-the-network-layer) | official | 2026-08-25 |
| s20 | [Highflame: ZeroID launch post](https://www.highflame.com/blog/introducing-zeroid-open-source-identity-for-autonomous-agents) | official | 2026-08-25 |
| s21 | [arXiv: JavelinGuard preprint full text (arXiv:2506.07330v1)](https://arxiv.org/html/2506.07330v1) | research | 2026-08-25 |

## Disclaimer

This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.

The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.

Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.

The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.

To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.

Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.

Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.