EvalLayer vs Lakera: AI security vs action authorization
Lakera is an AI security platform: real-time defense against prompt injection, jailbreaks, data leakage, and unsafe content, acquired by Check Point in 2025. EvalLayer is an authorization layer for commercial agent actions: whether the discount, commitment, or claim an agent is about to make is inside the business's policy. One defends against adversaries, the other enforces commercial authority, and the incidents that motivate each are different. Teams shipping public-facing agents with real authority often need both.
What Lakera is
Lakera, founded in Zurich, builds runtime security for LLM applications and agents. Its flagship product, Lakera Guard, sits between users and the model as a low-latency screening layer: inputs and outputs pass through its detection engine, which flags or blocks prompt injection attempts, jailbreaks, data leakage, and unsafe content before they do damage. Lakera Red handles pre-deployment red teaming, and the company's threat intelligence is famously fed by Gandalf, its public prompt-injection game, which generated one of the largest known datasets of real attack attempts. In September 2025, Check Point announced its acquisition of Lakera, in a deal reported around $300 million, making Lakera the AI security core of a major enterprise security vendor.
What Lakera is designed for
Lakera answers a security question: is someone attacking this AI system, and is harmful content flowing through it? The natural fit:
- Screening user input for prompt injection and jailbreak patterns before it reaches the model.
- Catching leakage of sensitive data or system prompts in model output.
- Content moderation across user-generated and model-generated text.
- Red teaming agents pre-deployment to find exploitable behavior, then monitoring in production.
- Enterprises that want AI security consolidated with their existing security stack, especially post-acquisition.
What Lakera does not try to do
Lakera models threats, not commercial authority. Its detectors are trained on attacks and unsafe content, so an agent cheerfully exceeding its discount authority for a legitimate customer presents nothing to detect: no injection, no leakage, nothing toxic. There is no vocabulary in a security policy for spend authority in dollars, forbidden commitment types, approved claims, or required disclaimers, and no decision ladder that routes an over-authority action to a human approver. That is not a criticism; it is scope. The Air Canada chatbot was never attacked. It invented a policy on its own, for a sincere customer, and no attack detector has a reason to fire on that.
What EvalLayer does
EvalLayer is an independent assurance API for agent work and agent actions. POST /evaluate scores completed work. POST /authorize checks a proposed action against a commercial policy: max_discount_pct, commitment_authority_usd, forbidden_commitments, approved_claims, required_disclaimers, blocked_topics. Countable rules are checked deterministically, semantic rules get one AI pass, and the result is one of four decisions, allow, rewrite, require_approval, or block, with violations listed, an approved rewrite when available, and every decision stored as an audit record. Pricing starts at $0.01 per check.
Comparison table
| Dimension | Lakera | EvalLayer |
|---|---|---|
| Primary job | AI security: prompt injection, jailbreaks, data leakage, unsafe content | Authorization of commercial agent actions against business policy |
| Checking layer | Security screen on inputs and outputs around the model | Independent policy gate at the action boundary |
| Policy model | Threat detection models plus configurable security policies | Commercial policy object: caps, authority, commitments, claims, disclaimers, topics |
| Decisions returned | Flag or block detected threats and policy-violating content | allow, rewrite, require_approval, or block, plus violations and rewrite |
| Audit records | Security monitoring and reporting within the platform | Every decision stored as an audit record with policy and violations |
| Pricing model | Commercial enterprise platform (Check Point); pricing on request | Hosted, from $0.01 per check |
When to use which
Use Lakera when
- Your AI surface is public and adversarial pressure is real: injection attempts, scraping, abuse.
- Data leakage is the risk that keeps security awake: system prompts, PII, internal context.
- Your security organization wants AI risk handled inside its existing vendor stack.
Use EvalLayer when
- Your agent quotes, refunds, commits, or claims, and the failure mode is over-authority rather than attack.
- You need decisions and records that read as compliance evidence: which policy, which violations, who approved.
- You want a bound on damage that holds even if an upstream defense misses.
When to use both
Security and authorization are complementary layers with almost no overlap in what they inspect, which is why running both adds coverage rather than redundancy. The UK discount jailbreak is the argument for the pair in one incident. The input side was manipulation, an hour of social engineering that security tooling is built to notice. The output side was a commercial violation, an invented 80% discount, that a deterministic max_discount_pct check kills regardless of how the conversation got there. Input defense reduces how often your agent is steered; action authorization caps what a steered agent can give away. More incidents and their missing controls are cataloged in the incident database, and the authorization half is runnable in the live demo.