Head to head · updated 2026-09
AEGIS vs Lakera Guard
Both mediate LLM tool calls at runtime. AEGIS is an MIT-licensed engine with a peer-reviewed cost-aware cascade and a cryptographic audit chain that can be verified by anyone. Lakera Guard is a mature managed API with a broad multi-lingual content-safety detector catalogue. The choice usually turns on data sovereignty, evidence requirements, and cost at scale.
Written by the AEGIS team. Facts cross-referenced against lakera.ai, docs.lakera.ai, and Lakera's public case studies as of 2026-09. Where a number is not publicly published we say so.
TL;DR
- AEGIS wins on open-source engine, cryptographic audit, air-gap deploy, peer-reviewed benchmark, and cost-per-call at volume.
- Lakera wins on managed-service ergonomics, multi-lingual content-safety detectors, and a longer commercial track record.
- They agree on the category (runtime mediation at the LLM boundary) and on the need for enterprise-grade compliance evidence.
Head-to-head capability matrix
Core positioning. Every row cites a fact that is either shipped or documented in a public source.
| Capability | AEGIS | Lakera Guard | Notes |
|---|---|---|---|
| Category | Runtime firewall + cryptographic audit | Runtime firewall (content safety focus) | Both mediate at the LLM tool-call / prompt boundary. Lakera positions primarily around content safety (prompt injection, PII, unsafe output); AEGIS positions around the enforcement path plus tamper-evident audit. |
| Open-source engine | MIT (full engine) | No | AEGIS ships an MIT-licensed engine that runs unmodified in the paid tiers. Lakera Guard is a commercial closed-source API; there is no self-inspectable engine to compile. |
| Deployment model | Self-host (default) + optional hosted | Hosted API + enterprise on-prem | AEGIS runs as a single binary + optional Postgres in customer infra by default. Lakera Guard is primarily a hosted API; on-prem is available on enterprise contracts. |
| Air-gap / no-egress deploy | Yes (single binary, verifier in Node stdlib) | Enterprise only, contract-gated | AEGIS enforcement + audit verification work with zero outbound network. Lakera on-prem is offered but requires an enterprise sales conversation and contract. |
| Detection technique | Cost-aware cascade (rules → XGBoost L2 → LLM judge) | Proprietary detector stack + LLM classifiers | AEGIS uses a documented three-layer cascade published in arXiv:2603.12621, short-circuiting at the cheapest confident layer. Lakera runs a proprietary detector stack; detector composition is not fully documented publicly. |
| Peer-reviewed benchmark | Yes (arXiv:2603.12621, v2) | No | The AEGIS cascade is evaluated on ToolGuard-Bench (5,525 records from InjecAgent + ToolEmu + OWASP LLM Top-10). Lakera publishes case studies and dataset counts but no peer-reviewed benchmark with head-to-head baselines. |
| Published block rate on public bench | 99.9% at 1.06 ms P50 (cascade full) | Not published | AEGIS numbers on ToolGuard-Bench: rules-only 1.2%, cascade + XGB no-LLM 99.8% @ 0.82 ms, cascade + XGB + Haiku 99.9% @ 1.06 ms @ $0.05 total. Adversarial (10 obfuscation transforms) block rate ≥ 97.5%. Lakera does not publish comparable per-call numbers on a public benchmark. |
| Latency (P50) | ~1 ms local cascade | Managed API round-trip (network-dependent) | AEGIS runs the cascade in-process for the L1/L2 hot path; only the L3 fallback (LLM judge) crosses the network, and only for the small ambiguous residual. Lakera Guard is a hosted API — every call is an HTTPS round-trip to their region. |
| Cryptographic audit chain | Yes (Ed25519 + SHA-256 hash chain, RFC 6962 style) | No | AEGIS produces a tamper-evident log verifiable by any third party with a 245-line Node stdlib verifier. Lakera stores decision logs but does not ship a third-party-verifiable audit primitive. |
| EU AI Act Article 12–15 evidence pack | Yes (signed JSON export) | Not offered as a first-class artefact | AEGIS exports a signed evidence pack aligned to Articles 12 (record-keeping), 13 (transparency), 14 (human oversight), 15 (accuracy/robustness). Lakera does not publish an equivalent first-class export. |
| SOC 2 evidence | Type II on Enterprise tier | Type II + ISO 27001 | Lakera has both SOC 2 Type II and ISO 27001 as a mature commercial vendor. AEGIS ships SOC 2 Type II on the Enterprise tier; ISO 27001 is on the roadmap. |
| Framework SDK coverage | 14 frameworks (2-line auto()) | Direct REST + a few SDKs | AEGIS: Anthropic, OpenAI, LangChain, CrewAI, Gemini, Bedrock, Mistral, LlamaIndex, smolagents (Python); Anthropic, OpenAI, LangChain, Vercel AI SDK (JS/TS); Go. Lakera provides REST + a smaller set of first-party SDKs — integrations are typically written by hand. |
Which one should you deploy?
Choose AEGIS if
- Data sovereignty (banks, health, government) is non-negotiable.
- Regulators require cryptographic tamper-evidence, not just log storage.
- You need air-gap or on-prem deploy without an enterprise sales cycle.
- You want a peer-reviewed benchmark to point auditors at.
- Call volume is high (> 100k/mo) and per-call pricing gets expensive.
- You want to inspect and modify the engine (MIT).
Choose Lakera Guard if
- You want a managed API with zero infrastructure to run.
- Multi-lingual content-safety detection is a first-class requirement.
- Your content risk profile is prompt/output safety more than tool-call side effects.
- ISO 27001 (in addition to SOC 2) is required by procurement.
- Detector catalogue maturity outweighs open-source auditability.
Many teams end up deploying both — Lakera for content-safety detection on the input/output surface and AEGIS as the runtime firewall + evidence layer for tool calls. The two do not conflict; risk signals from one can flow into the other.
Frequently asked
Is AEGIS a Lakera Guard alternative?
Yes, both mediate at the LLM tool-call boundary. AEGIS differs on three axes: it ships an MIT-licensed engine (Lakera is closed-source), it produces a cryptographically verifiable audit chain (Lakera does not), and it can run air-gapped with no outbound network. Lakera wins on managed-service ergonomics and content-safety detector maturity for non-English languages.
Does AEGIS block prompt injection like Lakera Guard?
Yes. On the 5,525-record ToolGuard-Bench (InjecAgent + ToolEmu + OWASP LLM Top-10), the AEGIS cost-aware cascade achieves 99.9% block rate at 1.06 ms P50 and $0.05 total run cost. Under 10 obfuscation transforms (base64, hex, Unicode homoglyphs, paraphrase, …) the block rate never drops below 97.5%. Full ablation and adversarial numbers in arXiv:2603.12621.
How does AEGIS pricing compare to Lakera Guard?
AEGIS is open-core: the engine is free forever with unlimited self-host. Paid tiers are Pro $29/mo, Team $99/mo, Enterprise custom. Lakera pricing is quote-based; publicly reported deals start around $2k/mo and scale with call volume. For teams with 100k+ calls/month, self-hosted AEGIS is materially cheaper.
Can I run AEGIS in air-gapped or on-prem environments?
Yes, by default. AEGIS is a single Go/Node binary plus optional Postgres; the audit chain uses Ed25519 signatures verifiable with a 245-line Node stdlib verifier. Lakera on-prem is available on enterprise contracts.
Should I deploy AEGIS or Lakera Guard?
Choose AEGIS if data sovereignty, open-source auditability, cryptographic evidence, or air-gap deployment are hard requirements; if you want a peer-reviewed benchmark to point at; or if cost-per-call at high volume matters. Choose Lakera if you prefer a managed service with a broader multi-lingual content-safety detector catalogue and can accept vendor lock-in on decisions and logs.
Try AEGIS
MIT-licensed engine. Two-line SDK integration. Downloadable for macOS Apple Silicon, Windows x64, Linux .deb.