Lakera Guard vs LLM Guard vs NeMo Guardrails (2026): LLM Firewall Compared

If you are choosing runtime defences for an LLM application in 2026, the Lakera Guard vs LLM Guard decision has a blunt answer: do not build on LLM Guard, because Protect AI archived it on 9 July 2026 and it is no longer maintained. That leaves Lakera Guard as the managed detection service and NeMo Guardrails as the self-hosted open-source option, and they solve overlapping but different problems. This post compares all three on detection coverage, latency, deployment, licensing, and maintenance status, so you can pick an LLM firewall that will still be defended a year from now.

The short answer

• Lakera Guard - a commercial, continuously updated detection API for prompt injection protection runtime, covering prompt attacks, content moderation, data leakage, malicious links, and agent behaviour. Acquired by Check Point in 2025 and now the foundation of its AI security line. Pick it when you want managed detection that keeps pace with attackers and you can accept a hosted service.
• LLM Guard - Protect AI’s MIT-licensed input and output scanner stack, with roughly 15 input scanners and 20 output scanners. Archived on 9 July 2026. The code still works. Nobody is updating it.
• NeMo Guardrails - NVIDIA’s Apache 2.0 toolkit for programmable rails, defined in Colang across input, dialog, retrieval, execution, and output stages, self-hostable as a library or a Kubernetes microservice. Pick it when data residency or licence freedom is non-negotiable, or when dialogue control matters as much as filtering.

Deciding factor to pick

Rule of thumb: Lakera Guard buys you maintained detection, NeMo Guardrails buys you control and data residency, and LLM Guard buys you a maintenance liability.

What each tool is

• Lakera Guard is a detection service you call from your application to screen user input and reference content before it reaches the model, and to screen what comes back. Its documented defences cover prompt defence (direct and indirect prompt injection, jailbreaks), content moderation, data leakage prevention (PII and system-prompt leakage), malicious link detection, and agent behaviour defence with tool allow and deny lists. Lakera is a Swiss company best known publicly for Gandalf, the prompt-injection game whose player attempts fed its threat data. Check Point announced its acquisition of Lakera in September 2025, reported around $300 million, and the product now appears in Check Point’s documentation as its AI Guardrails offering. Vendor marketing cites figures like 98%+ detection and sub-50ms latency; treat those as claims to validate on your own traffic, not benchmarks.
• LLM Guard was Protect AI’s open-source security toolkit for LLM interactions, MIT licensed, built around composable scanners: roughly 15 input scanners including PromptInjection, Anonymize, BanTopics, Secrets, Toxicity, Gibberish, InvisibleText, and TokenLimit, and roughly 20 output scanners including Sensitive, MaliciousURLs, NoRefusal, FactualConsistency, Bias, and Deanonymize. Palo Alto Networks completed its acquisition of Protect AI on 22 July 2025 and folded the technology into Prisma AIRS. The llm-guard repository was archived on 9 July 2026 and is read-only.
• NeMo Guardrails is NVIDIA’s open-source toolkit for adding programmable guardrails to LLM applications, Apache 2.0, now maintained in the NVIDIA-NeMo/Guardrails repository. Behaviour is defined in Colang, with rails at five stages: input, dialog, retrieval, execution, and output. Colang 2.0 has been supported since version 0.8 with Colang 1.0 remaining the default while 2.0 completes its beta. It also ships as a production NeMo microservice container for Kubernetes within NVIDIA AI Enterprise, and configurations are portable between the library and the microservice.

Lakera Guard vs LLM Guard vs NeMo Guardrails: head-to-head

Verdict by use case

You are starting fresh and want the least operational burden. Lakera Guard. Detection models that get retrained against new attack data are the entire value proposition of a managed LLM firewall, and that is precisely what an archived project cannot give you.

You are in a regulated or air-gapped environment. NeMo Guardrails. Apache 2.0, fully self-hostable, and the microservice path gives you a supported production deployment on Kubernetes without prompt content leaving your estate.

You are building a conversational assistant, not just an API endpoint. NeMo Guardrails. Per-request scanning cannot express “this conversation is drifting off-scope” or “this retrieved document should not be treated as an instruction.” Rails can.

You are already a Palo Alto Networks customer. Look at Prisma AIRS rather than resurrecting LLM Guard, since that is where the Protect AI technology now lives.

You are already running LLM Guard in production. Migrate, but do it with an inventory first. Several LLM Guard scanners are thin wrappers around other open-source models and libraries that are still maintained independently, so the migration is often “call the underlying model directly” rather than “replace the whole stack.” Rank by risk: the PromptInjection and jailbreak scanners age fastest because attacker technique moves fastest, while a regex or token-limit scanner ages not at all.

You want defence in depth. Run a fast detection layer inline and NeMo Guardrails for dialogue and execution control. They are not competitors so much as different layers.

The uncomfortable part: guardrails get bypassed

Every option here is a probabilistic filter, and published research on evasion attacks against prompt injection and jailbreak detection systems has consistently shown that classifier-based defences can be defeated with obfuscation, encoding, translation, character substitution, and adversarial phrasing. Attackers iterate faster than detection models are retrained, which is exactly why maintenance status is the first thing to check on this comparison rather than a footnote.

The controls that actually bound the damage are architectural, not filtering:

• Least-privilege tool access. An agent that cannot delete records cannot be talked into deleting records.
• Human approval on consequential actions. Payments, deletions, external sends, and privilege changes should not be one successful injection away.
• Treat retrieved content as data, not instructions. Indirect injection through documents, web pages, and tool output is the attack that most request-level scanning misses entirely.
• Encode output before rendering. Cross-site scripting through model output is still a live class of bug.
• Log and alert on refusals and blocks. A spike in blocked prompts is reconnaissance in progress.

For how attackers actually get through, see our breakdown of prompt injection bypass techniques.

Cost comparison

• Lakera Guard is commercial. A free community tier has been available for evaluation with a modest monthly request allowance, with paid tiers priced per request and enterprise agreements covering SLAs and compliance evidence. Published figures have moved during the Check Point integration, so get a current quote rather than working from a blog post, this one included.
• LLM Guard is free under MIT, and always was. The cost was never the licence; it is the inference capacity to run the scanner models plus, now, the engineering time to maintain a fork of an archived security tool.
• NeMo Guardrails is free under Apache 2.0. Your spend is the compute to run it and the model calls that any LLM-backed rail makes, which is the item teams underestimate: a config where several rails call a judge model on every turn can rival the cost of the primary generation.

Whichever you pick, budget by model-backed checks per request, not by licence. That is the number that drives both your bill and your latency.

Common pitfalls

• Deploying an unmaintained security control. This is the headline. An archived detection stack decays silently, because it keeps returning confident results while attacker technique moves past it.
• Filtering input but not output. Data leakage, malicious links, and unsafe rendered content all leave through the response, and plenty of deployments scan only what goes in.
• Ignoring indirect injection. Scanning the user’s message does nothing about a poisoned document your retrieval layer just pulled in. Our OWASP LLM Top 10 for 2026 walks through where that sits.
• Trusting vendor detection rates. Datasheet numbers come from the vendor’s own test set. Yours is different.
• Skipping the latency budget. Stacking several model-backed checks on a single turn is how a snappy assistant becomes a slow one. Measure end to end, under load.
• Never testing the config. A guardrail you have not attacked is a guardrail you have not verified. See our AI red teaming tools comparison for the tooling side of that job.

Related reading

• Prompt injection bypass techniques - how attackers get past detection layers in practice
• OWASP LLM Top 10 (2026) - where runtime filtering fits in the wider risk model
• AI red teaming tools compared - what to attack your guardrail configuration with
• More on the infosec.qa blog - AI security intelligence, attack surface, and LLM defence analysis

Getting help

We help Series A-C AI companies pick a runtime defence stack that will still be maintained next year, then prove it holds. An LLM Red Teaming engagement attacks your deployed guardrail configuration with real injection and jailbreak campaigns and reports attack success rates with remediation guidance, and an AI Attack Surface Assessment maps the retrieval and tool paths a request-level filter never sees.

Book a free scope call.