Lakera Review (2026)

Acquired by Check Point, and it went well

Check Point acquired Lakera in September 2025, in a deal reported at around $300 million.

The acquisition brought Lakera Guard, Lakera Red and the Gandalf community dataset into Check Point’s AI security platform, and Check Point based its Global Center of Excellence for AI Security on the Lakera team.

Most importantly for anyone evaluating it: the Zurich research team still maintains Guard’s detection models.

That is the good version of this outcome, and it is worth naming because this site has documented the bad versions repeatedly. Helicone went into maintenance mode after Mintlify acquired it. Humanloop was acqui-hired and shut down. Traceloop’s platform became a feature of a governance product. Lakera is still being developed by the people who built it, inside a company whose core business is security.

The change buyers will feel is commercial rather than technical: new sales route through Check Point enterprise procurement. Expect a heavier process than signing up for an API.

The data is the moat

The technical case for Lakera rests on something competitors cannot easily replicate.

Its detection models are reported to learn from over 100,000 new adversarial samples daily, drawn partly from Gandalf - a public prompt injection game that has collected more than 80 million prompts from people genuinely trying to break an LLM.

That matters because of where the difficulty actually lies. Building a prompt injection classifier is not especially hard. Getting a large, continuously refreshed corpus of real attack attempts to train and evaluate it against is very hard. Lakera solved that by making a game people play voluntarily, and it has been compounding ever since.

The performance claims, and how to treat them

Lakera reports 98%+ detection, sub-50ms latency, and false positive rates below 0.5%, screening 100+ languages.

What makes those figures notable is that they claim strength on all three axes at once, which is the genuinely hard part. Any detector can hit high recall by flagging everything; the false positive rate determines whether your users can actually use the product. A guardrail that blocks 5% of legitimate requests is unusable no matter how good its detection looks.

These are vendor-reported and we have not verified them. If this is a serious evaluation, insist on testing against your own traffic. Detection performance is workload-specific, and the number that matters is your false positive rate on your users’ real inputs, not a benchmark figure.

The 100+ language coverage deserves more attention than it usually gets. A standard and effective bypass is writing the malicious instruction in a language your filtering was never tested against. English-only detection has a large, trivially exploitable blind spot, and broad language coverage is the kind of feature that shows up as an absence of failures you never see rather than as a headline capability.

Third-party information here is unusually unreliable

A specific warning, because it affected our own research.

We found aggregator listings describing Lakera as generic website security software with no API - which flatly contradicts what the vendor sells. That is not a stale figure or a nuance, it is a completely wrong product category.

Add that much comparison content has not registered the Check Point acquisition at all, and the practical conclusion is that almost all third-party information about Lakera should be treated as unreliable. Go to Check Point or the vendor’s own documentation.

The commercial friction

No published pricing on any tier. Community, Pro and Enterprise exist, a free plan is available, and you contact them for a quote. Since the acquisition, enterprise sales run through Check Point.

We are recording this as not published rather than estimating.

The trade-off worth being explicit about: NeMo Guardrails and Guardrails AI are free and open source. What you are buying from Lakera is detection quality backed by an adversarial dataset nobody else has, plus managed operation and enterprise support. What you are giving up is transparency, self-hosting, and the ability to know what it costs before you talk to someone.

Should you use it?

Use Lakera if prompt injection is a real threat to your product, you want managed low-latency detection with enterprise support, and an enterprise sales process is normal for you.

Don’t use it if you need to inspect or self-host what makes your security decisions, you need published pricing, or an open-source guardrail would suffice.

Bottom line: the strongest managed prompt injection defence available, with a training-data advantage that is genuinely hard to compete with, now inside a security company that appears to be looking after it. Test the false positive rate on your own traffic before committing, and expect procurement rather than a signup form.

---

Acquisition, team status and product claims verified against contemporaneous reporting and vendor sources on 3 August 2026. Detection performance figures are vendor-reported and have not been independently tested. Pricing is not published and has not been estimated. Several third-party aggregator descriptions of this product were found to be factually wrong and were disregarded. This is a researched directory entry - we have not yet instrumented this platform with our reference application.