Prisma AIRS
Battle Cards

Where PAN Wins

• Deeper model scanning: AIRS inspects 35+ model file types and detects 25+ threat categories (backdoors, deserialization, embedded code). Cisco/Robust Intelligence lacks equivalent deep architectural model analysis — Protect AI technology gives AIRS the depth advantage.
• Continuous autonomous red teaming: AIRS uses 500+ specialized attack types in an agentic, continuously-adapting approach. Cisco has no equivalent red teaming capability of comparable depth.
• Agentic endpoint security (Koi): The pending Koi acquisition adds AI agent security at the endpoint — securing agents, plugins, scripts, and model artifacts on devices. Cisco has no equivalent capability.
• Full lifecycle coverage: AIRS covers model supply chain → posture → red teaming → runtime → agentic endpoint. Cisco's AI security remains stitched across Security Cloud products without a unified AI security platform.
• MLOps pipeline integration: AIRS integrates directly into Hugging Face, Artifactory, GitLab, and cloud storage for pre-deployment scanning. Cisco's AI security story is primarily network-insertion based.
• Enterprise AI platform integrations: Native integrations with Factory, Glean, IBM WatsonX, and ServiceNow. Cisco has no confirmed equivalent native AI platform integrations.

Where They're Strong

• Massive distribution through Cisco install base: Cisco's networking and security footprint gives them broad access to enterprise customers, creating a natural upsell path for AI security capabilities.
• Talos threat intelligence: 620B+ daily requests make Talos one of the largest threat intelligence operations globally. Strong foundation for AI threat detection.
• OWASP/MITRE ATLAS mapping: Robust Intelligence maps AI detections to established standards, making compliance and audit reporting straightforward.
• Deep networking integration potential: Cisco can embed AI security into Webex and networking infrastructure more natively than a pure-security vendor.

Landmines to Set

• "Ask Cisco how their AI security capabilities integrate end-to-end — from the ML pipeline (Hugging Face, GitLab, Artifactory model registries) all the way to runtime — and how that's managed in a single console."
• "Ask Cisco to demonstrate how they detect backdoors in ONNX or PyTorch model weights at the architecture level — not just inspecting inputs/outputs at the network layer."
• "Where is Cisco's AI security integrated into the Cisco Security Cloud today — can you see a live demo of end-to-end AI security from the ML pipeline to runtime to network blocking in one console?"

Traps They Set

• "We're already a Cisco shop — it's simpler to add their AI security" — Counter: Cisco acquired Robust Intelligence 18 months ago and the product is still being integrated into Security Cloud. AIRS has already completed its Protect AI integration and is a production-ready platform today. Being a Cisco shop for networking doesn't mean waiting for their AI security to mature.
• "Cisco Talos gives us the best threat intelligence" — Counter: Talos is exceptional for network threats. For AI-specific threats, PAN has huntr (17,000+ AI-focused security researchers), WildFire model scanning intelligence, and Unit 42 — purpose-built for the AI threat landscape. Cisco has no equivalent AI-specific researcher community.

Key Objections

Where PAN Wins

• Platform integration vs. point solution: HiddenLayer is a standalone AI security tool — no integration with NGFW, SASE, XSIAM, or any broader security ecosystem. AIRS is natively integrated into the PAN platform stack with single-pane management through SCM.
• Inline network-layer blocking: HiddenLayer cannot block AI threats at the network traffic level. AIRS blocks threats inline via NGFW and Prisma SASE infrastructure — not just at the application layer.
• Agentic endpoint security (Koi): HiddenLayer has no equivalent to Koi's agentic endpoint security for AI agents running on devices.
• Continuous autonomous red teaming: AIRS uses 500+ attack types in a continuously-adapting agentic approach. HiddenLayer's Attack Simulation is periodic, not continuous.
• Threat intelligence depth: huntr (17K+ researchers) + WildFire + Unit 42 vs. HiddenLayer's smaller research team.
• Enterprise AI platform integrations: Native integrations with Factory, Glean, IBM WatsonX, and ServiceNow. HiddenLayer has Databricks Unity Catalog only.

Where They're Strong

• Non-invasive architecture: AIDR does NOT need access to customer's sensitive data or proprietary models — strong pitch for highly regulated industries (financial services, healthcare, federal) concerned about data sovereignty.
• Deep patented adversarial AI research: Strong academic and patent portfolio in adversarial ML — reputation for elegant, lightweight technology.
• Databricks Unity Catalog integration: Automated model scanning on registration — seamless for Databricks-centric data science teams.
• Vertical depth: Strong presence in financial services, healthcare, and federal/government environments.

Landmines to Set

• "Ask HiddenLayer how they integrate with your NGFW/SASE policy enforcement for blocking AI threats inline at the network layer — or with your SOC platform for correlated response."
• "HiddenLayer doesn't send models to the cloud for analysis — how do they provide inline blocking of runtime threats at the network layer without network integration?"
• "How does HiddenLayer's red teaming (Attack Simulation) stay current against new attack patterns — is it continuous and autonomous, or periodic?"

Traps They Set

• "HiddenLayer doesn't require access to your models — PAN does" — Counter: AIRS AI Model Security performs in-place model scanning — keeping proprietary models and data within the customer's own environment. This is explicitly designed to reduce IP exposure and simplify compliance. The "non-invasive" framing is misleading — in-place scanning IS non-invasive.
• "HiddenLayer is best-of-breed for AI model security" — Counter: HiddenLayer is excellent at model artifact security — it's one of the best point solutions for that specific use case. But it doesn't block threats at the network/SASE layer, doesn't do continuous red teaming with 500+ attacks, doesn't provide agentic endpoint security, and has no native enterprise AI platform integrations. AIRS does all of that plus model security.

Key Objections

Where PAN Wins

• Comprehensive platform vs. prompt firewall: Lakera is primarily an LLM prompt/response protection tool. AIRS covers the entire AI security lifecycle — model scanning, posture management, red teaming, runtime protection, and agentic endpoint security.
• AI model scanning: Lakera has no model scanning capability at all. AIRS inspects 35+ model file types for 25+ threat categories including backdoors, deserialization attacks, and embedded malicious code.
• AI posture management: Lakera cannot inventory, discover, or govern AI agents and models in your environment. AIRS provides full AI-SPM with Shadow AI detection.
• NGFW/SASE/SOC integration: Lakera has no integration with network security, SASE, or SOC platforms. AIRS is natively integrated with PAN's full platform stack for inline blocking and correlated response.
• Enterprise governance: Lakera is a developer API tool — not designed to meet enterprise CISO requirements for comprehensive governance, compliance, and audit. AIRS is enterprise-grade from the ground up.

Where They're Strong

• Industry-leading runtime latency: Sub-50ms latency with 0.01% false positive rate — best-in-class for real-time LLM prompt protection at scale (1M+ transactions per app/day).
• Developer-first adoption: API-first, SaaS-native deployment model is easy for dev teams to adopt quickly without security team involvement. Low friction onboarding.
• 100+ language support: Context-aware threat detection across 100+ languages — not just keyword matching.
• Gandalf threat community: 1M+ ethical hackers contributing to threat research via Gandalf platform. Cited in OWASP LLM and GenAI Security Landscape Guide 2025.

Landmines to Set

• "Lakera is a prompt firewall. Ask them how they inventory and govern all AI agents and models in your environment — or how they prevent model-layer attacks (backdoors, deserialization) that happen before a prompt is ever sent."
• "How does Lakera discover shadow AI agents your team didn't build? Can it detect unsanctioned AI agents still holding access to sensitive data?"
• "What happens when an attack bypasses the prompt layer entirely — like model poisoning, backdoor injection, or supply chain compromise of a model before deployment?"

Traps They Set

• "Lakera has lower latency than AIRS" — Counter: Lakera optimizes for prompt-level latency because that's all it does. AIRS provides multi-layer protection across model, posture, red team, runtime, and endpoint. Comparing latency on a single layer ignores the 4 other layers of protection Lakera can't provide.
• "AIRS is too expensive — we can get Lakera for less" — Counter: Lakera covers one layer (prompt/response protection). Equivalent coverage to AIRS requires Lakera + HiddenLayer + a red teaming vendor + a posture management tool = 4+ vendors, 4+ integrations, 4+ contracts — at higher total cost with gaps between them.

Key Objections

Where PAN Wins

• Runtime enforcement, not just alerting: Wiz AI-SPM alerts on posture issues. AIRS blocks threats inline at the network and application layer in real-time. Being alerted after data has leaked is not security.
• AI model scanning depth: Wiz has no deep AI model scanning — no inspection of model architecture, weights, operators, or embedded code. AIRS scans 35+ model file types for 25+ threat categories.
• Continuous AI red teaming: Wiz has no AI red teaming capability. AIRS provides continuous, autonomous red teaming with 500+ specialized attack types.
• Agentic endpoint security: Wiz has no agentic AI security and no endpoint coverage. AIRS + Koi covers the full agent lifecycle including endpoint.
• On-prem and edge coverage: Wiz is cloud-centric — does not cover on-premise or edge AI deployments. AIRS covers cloud, on-prem, and edge through NGFW/SASE integration.
• Acquisition stability: Google just acquired Wiz 9 days ago. The combined product roadmap is still being built. AIRS has been continuously shipping and expanding for 12+ months.

Where They're Strong

• Best-in-class cloud AI posture: Agentless inventory of AI services across AWS, Azure, GCP with deep CNAPP integration. AI attack path analysis extends Wiz Security Graph to include AI.
• Massive enterprise customer base: Strong existing CNAPP customer base provides a natural expansion path for AI-SPM adoption.
• Google backing: Gemini integration roadmap, Google Threat Intelligence, and Mandiant provide long-term platform potential.
• DSPM for AI: Data flowing to unauthorized AI platforms is tracked and governed — strong data governance story for compliance-focused organizations.

Landmines to Set

• "Wiz alerts on posture issues. What is the response/blocking mechanism — how does Wiz stop an active runtime attack against an LLM application?"
• "Ask Wiz how they protect AI models running outside the cloud — on-prem, at the edge, inside your own data center — and how they block threats at runtime rather than just alerting."
• "Given that Google just acquired Wiz, what is the combined product roadmap for AI security — and who is your account team during the integration transition?"

Traps They Set

• "We already have Wiz for AI-SPM — we don't need AIRS" — Counter: Wiz AI-SPM provides posture and inventory. AIRS provides posture plus model scanning, continuous red teaming, and inline runtime blocking. These are complementary but AIRS goes dramatically deeper. And given the March 2026 Google acquisition, Wiz's AI security roadmap is now subject to Google Cloud strategy.
• "Google's scale will make Wiz the leader" — Counter: Google closed the acquisition 9 days ago. Integration takes years, not days. Meanwhile, AIRS has been production-ready and continuously expanding for 12+ months. Gartner named PAN "the company to beat" in AI Security Platforms in December 2025 — not Google.

Key Objections

Where PAN Wins

• AI model scanning depth: AIRS inspects 35+ file types and detects 25+ threat categories at the model architecture and weights level. CrowdStrike has no equivalent — an AI model backdoor installed during training will execute on the endpoint and bypass endpoint detection.
• Continuous AI red teaming: AIRS provides continuous, autonomous red teaming with 500+ specialized attack types. CrowdStrike has no equivalent red teaming capability.
• NGFW/SASE layer for network-level AI protection: CrowdStrike has no network security layer for inline AI traffic inspection and blocking. AIRS blocks AI threats at the network layer via NGFW and Prisma SASE.
• AI posture management: AIRS provides full AI-SPM with Shadow AI discovery, permission management, and configuration drift monitoring. CrowdStrike has no AI posture management equivalent.
• Enterprise AI platform integrations: Native integrations with Factory, Glean, IBM WatsonX, and ServiceNow. CrowdStrike has no equivalent native enterprise AI platform integrations.
• Product maturity: AIRS 2.0 completed Protect AI integration in October 2025. CrowdStrike's AIDR was announced in Fall 2025 and Pangea integration is still nascent.

Where They're Strong

• Unmatched endpoint telemetry: Falcon's single-sensor architecture and petabyte-scale threat intelligence make CrowdStrike the leader in endpoint protection. 100% detection rate in 2025 MITRE ATT&CK Enterprise Evaluation.
• AI agent identity security: Falcon Next-Gen Identity Security covers human, machine, and AI agent identities — strong story for securing AI agent access and preventing identity impersonation.
• GenAI data protection: Real-time protection for sensitive data across browsers, local apps, and shadow AI tools. Strong governance for employee AI usage.
• Massive installed base: Gartner Magic Quadrant Leader for Endpoint Protection 5 consecutive years. Natural expansion path for AI security add-ons.
• 2026 Global Threat Report validation: CrowdStrike's own intelligence confirms the AI threat landscape (breakout time 29 min, AI-enabled attacks up 89%) — validates the need for AIRS-class protection.

Landmines to Set

• "CrowdStrike secures endpoints. Ask them how Falcon protects the AI model supply chain — specifically, how do they detect backdoors and malicious code embedded inside an ONNX or PyTorch model file before it ever runs on an endpoint?"
• "How does CrowdStrike govern AI agent identities and permissions before deployment — or does that protection only kick in after an agent is running on an endpoint?"
• "CrowdStrike AIDR is brand new (Fall 2025). Can you show how it detects a hidden backdoor inside a model file at the architecture/weights level — not at the endpoint behavior level?"

Traps They Set

• "CrowdStrike already has AIDR and Pangea — we're covered on endpoint" — Counter: CrowdStrike's AIDR secures AI at the endpoint. AIRS secures the AI model itself — the supply chain, the architecture, the training data — before it ever runs on an endpoint. An AI model backdoor installed during training will execute on the endpoint and bypass endpoint detection. You need both layers, or a platform that covers both.
• "CrowdStrike has the best threat intelligence" — Counter: CrowdStrike's adversary intelligence (265+ profiles) is excellent for endpoint and identity threats. For AI-specific threats, PAN has huntr (17K+ AI-focused researchers), WildFire model scanning, and Unit 42. CrowdStrike's own 2026 Global Threat Report confirms AI-specific attacks are accelerating — that's exactly the threat surface AIRS was built to cover.

Key Objections