Vendor Status Tracker

Against the company's own channels wherever possible - a banner on their site, a repository archival notice, an SEC filing, a press release. Comparison articles and directory listings are not sufficient, because they are almost never pruned. Where we could not confirm something we say so rather than inferring it. Martian, for example, is listed as pivoted rather than shut down, because its homepage no longer sells a router but no discontinuation was ever announced.

Because the outcomes differ enormously and the label alone does not tell you which you are getting. Lakera was acquired by Check Point and its original team still maintains the detection models. Helicone was acquired by Mintlify and placed in maintenance mode with no roadmap. Protect AI was acquired by Palo Alto and its open-source LLM Guard was archived roughly a year later. Same word, three very different consequences for anyone who had built on them.

Look at the company's own homepage and ask what it currently sells, not what a directory says it sells. For open-source projects, check the date of the last substantive commit, whether pull requests are being merged or accumulating, and whether issues get responses. A polished README with eleven unmerged pull requests is a specific and common failure pattern. The absence of shutdown news is not evidence a vendor is still independent.

Because a licence protects your right to the code, not whether anyone keeps improving it. LLM Guard was MIT licensed, and MIT preserved the code perfectly while the project was archived and its detection models stopped being updated. For a guardrail, where the value lives in continuously updated detection rather than in the source, that distinction is the entire thing. An archived guardrail keeps returning confident passes while missing every attack technique invented after it stopped.