Somewhere in your organization, someone has connected an AI model to something that matters. A customer service system. An internal knowledge base. A workflow that touches contracts, or patient records, or payroll. It went in fast, because that is how AI goes in.

Now ask your security team a simple question. What happens when someone types a sentence into that system designed to make it betray you?

In almost every company I talk to, the honest answer is that nobody knows.

Why your existing security cannot see it

Every security control you own was built for a world of deterministic software. A firewall inspects packets. A web application firewall parses HTTP requests. An endpoint agent watches process trees. All of them are looking for something malformed, something that does not belong.

An attack on an AI system is none of those things. It is a well-formed request carrying a perfectly valid payload. The payload just happens to be English. Or Spanish, or base64, or Unicode characters your eye cannot see. Your WAF reads it, finds nothing structurally wrong, and passes it straight through to the model.

“ The attack is not in the packet. It is in the meaning. “

This is not theory, and it is not next year.

In December 2023 a car dealership's chatbot was talked into offering a Chevrolet Tahoe for one dollar and stating that the offer was legally binding. It took one person and a few sentences.

In 2024, a competition put a pot of money behind an AI agent instructed never to release it. A user won $47,316 by talking it out of that instruction in about 30 seconds.

And there is a category of attack called LLM jacking, where an attacker steals your model credentials and runs their own workload on your account. One documented case turned a $400 monthly bill into $67,000 over 11 days. The victim found out from the invoice.

That last detail is the one I would sit with. Most will companies find out they were under attack when the bill arrives.

The industry's answer, and the flaw in it

So a market appeared. Dozens of companies launched to solve AI security, and most of them arrived at the same architecture:

They put an AI in front of your AI. Yes, really.

The idea is intuitive and logical. An attack written in natural language needs something that understands natural language to catch it, so you deploy a smaller model as a judge. Also AI is going to be so smart one day that it will be able spot these attacks just as if a super-charged human was doing the work. It reads every prompt and decides whether it looks malicious.

But think about what this actually means….

If a clever sentence can talk your production model out of following its instructions, the same type of sentence can talk the guard model out of following its instructions. The defense shares the exact weakness of the thing it is defending. You have not added a wall. You have added a second door with the same lock.

There’s another compelling reason not to rely on a stochastic, probabilistic LLMs for security: speed. Although reasoning models will undoubtedly become faster as AI advances, they currently take at least four seconds to produce results that are far less reliable than those from our 20-millisecond pipeline. To get that in perspective 4 seconds is almost 200x slower than 20-milliseconds. Users simply will not tolerate an additional four-second delay on every AI call when there are 200x faster alternatives in the market.

Figure 1. The industry's default AI-security architecture, and why we rejected it. A guard model shares the attack surface of the model it is defending.

Our CTO and the master brain behind all of our products, Tilesh Maharaj - aka: MrT, put it to me the first time we discussed it and I have never found a way around it.

“ You cannot jailbreak math.”

An LLM guarding an LLM is a house of cards. A regex engine has no opinion, no context window and no persuadability. It cannot be flattered, confused or role-played into standing aside.

“ Math does not have bad days. Math cannot be tricked. “

The system we built

Before the detail, the philosophy behind our system. We organize everything around four words, and I will use them as I go:

Pilot: you run it against your own traffic before you spend a dollar. ‘ Try before you buy.’

Protect: deterministic enforcement, inline, on every request. ‘ 100% coverage from all known AI attacks.’

Prove: continuous adversarial testing, so the protection is verified rather than assumed. ‘Trust but verify.’

Pays: it should cut enough cost to pay for itself. ‘ All AI should have ROI and therefore be self-funding.’

These 4Ps are not a marketing sequence. It is the order you will move through the with adoption of AI-Sentinel and AI-Armory in your organization.

AI Sentinel is a security layer that sits in-line between your applications and whatever AI models you use. Every request going to the model passes through it first. Every response coming back passes through it before it reaches a user. Nothing gets to the model that we have not inspected. Nothing gets to your customer that we have not checked on the way out.

Figure 2. A synchronous gate on both the request and the response path. Not a scanner, not a dashboard, not a log.

Three decisions define it.

It is deterministic. Roughly 95% of our detection is compiled pattern matching and mathematical heuristics, not model inference. The same input produces the same decision every time, and every decision traces back to a rule a human being can read. When your auditor asks why something was blocked, you get an answer, not a probability.

Written completely in Rust, not Python. That sounds like an engineering detail and it is not. Python is the standard language for AI and therefore most LLMs are written in Python; so other firms automatically go to their ‘python playbook’ when building AI security applications. Python in security tools typically add 100 to 500 milliseconds to every request, from interpreter overhead and garbage collection. Security that slows your product down does not get adopted. It gets switched off, or routed around, usually by the same engineers who asked for it. We hold under 20ms of overhead at any scale, with clean requests averaging under 8ms and rejections returning in 2 to 4ms. Rust also gives us memory safety by construction, which matters when the software you are installing is itself a target.

Figure 3. Inspection overhead added to every request. Source: AI Sentinel measured performance, June 2026.

It inspects in depth, not in one pass. The few direct comparisons we have found on the market only use 1-2 layers – so shallow and shameful – could be the terms used to define their offerings. Our traffic runs through nine distinct layers, each targeting a different class of attack, from encoding tricks that hide a payload through to a tamper-evident audit log where each record is cryptographically chained to the one before it. What evades one layer is caught by the next. Figure 4 sets out all nine.

Figure 4. The nine-layer inspection pipeline. Each layer is configurable per endpoint, per model and per tenant.

We do use AI in the system. It simply is not allowed to make decisions and comes after our deterministic pipelines so everything is safe before it reaches any possibility of a vulnerability. Our AI tiers observe, analyze, propose and orchestrate new detection rules on the entire system. A deterministic validator and a human have to approve anything before it goes live. AI is an untrusted evidence generator here, never a policy author. Switch every AI feature off and the enforcement engine is provably byte-identical.

The numbers, since numbers are the point. 100% of the applicable MITRE ATLAS techniques, 55 of 55. 100% of the OWASP LLM Top 10. 1,237 automated tests. Around 205,000 lines of Rust across 16 crates. Averaging 27,000 requests per second per instance.

The word applicable is doing real work in that first claim, and I want to be straight about it. MITRE ATLAS catalogs many techniques that happen on an attacker's own machine, long before any traffic reaches you. No inline security layer can touch those. Of the techniques a system in our position can address, we cover all of them, and we will show you the mapping. I would rather explain the caveat than let you find it.

Why independence matters more than it used to

Now the part that made this into a company with a massive opportunity. Between October 2024 and October 2025, the AI security market consolidated almost completely. Cisco acquired Robust Intelligence. Palo Alto Networks acquired Protect AI, reportedly for more than $500 million. Check Point acquired Lakera at around $300 million. F5 acquired CalypsoAI at around $180 million. Five of the seven credible independent pure-plays were gone inside twelve months.

Figure 5. The consolidation of the independent AI-security market, October 2024 to October 2025. Values are publicly reported and approximate.

Every one of those deals validated the category. More than a billion dollars says AI security is a requirement, not a nice to have.

Every one of them also created a problem for you. A technology that used to work with anyone's stack now works best inside one company's ecosystem. If you run models across more than one cloud, or you have a firewall from one vendor and a data platform from another, you are being asked to pick a side just to get AI security at all.

That is a strange position to be in for a control layer. Your AI stack is going to change. You will swap models, add providers, move workloads. Your security policies should travel with your stack, not with your vendor.

We stayed independent. Partly on principle. Mostly because buyers kept describing the same problem and nobody left was in a position to solve it.

Protection is only half of it

There is a second product, and it exists because protection you cannot verify is just a claim.

AI Armory is our adversarial testing platform. It attacks your AI systems the way a competent adversary would, on a schedule, using playbooks mapped to the same MITRE ATLAS taxonomy. Roughly 50,000 tests in a full run.

Most security programs test once a year and call it assurance. That made sense when attacks were written by people. It does not now. Modern models generate, adapt and retry attacks faster than any human team, which means the question is not whether your defenses worked in March. It is whether they work today.

So the pair is simple. Sentinel protects. Armory proves. Protection without proof is marketing. Proof without protection is a report you cannot act on. That is the second and third ‘P’, and only together they mean something.

What actually changes

Let me describe the outcome in the terms that matter to whoever signs it off.

The security lead stops guessing. They know which attacks worked, which failed and where residual risk sits, because it has been tested rather than assumed.

The board conversation changes in one sentence. Instead of "we believe our AI is secure," it becomes "we protected it, we tested it, we can prove it with this report." Those are very different sentences to say to a regulator.

Engineering gets freedom instead of friction. The team can build on GPT, Claude, Gemini, open-source models or whatever replaces them, without asking permission from a security layer tied to one provider. No rule rewrites when you switch.

Finance gets a ceiling and a reduction. Hard daily spend caps and abuse detection mean an LLM jacking incident stops being a five-figure surprise, and the optimizer layer takes redundant model calls off the monthly invoice whether or not anyone ever attacks you. That is the fourth P, and I come back to it below.

Compliance gets evidence rather than assurances. A tamper-evident log of what was tested, what was blocked, what was allowed, and why.

So price – bluntly…

This kind of capability is normally sold for $250,000 - $500,000 a year and up.

We charge either $100 per user per month or $4,000 a month for a company of up to 100 people - providing a complete package for $48,000 a year which is $40 per user per month or roughly $1.33 a day per employee. That is $3,500 a month for the shield and $500 a month for the testing.

People assume there is a catch, so let me handle it directly. We could be charging 3-4 times more for this product, so this must be the AI-Sentinel ‘lite’ version. There is no ‘lite’ version as there can be only one AI-Sentinel, which is 100% coverage on all known AI attacks. The price is a strategic choice and we will own it. We would rather define and own this part of the market than defend a premium margin. Part of the mission is that every company should be able to afford to prove its AI is safe, and they can only do that if it is affordable. Everyone will benefit with good AI guard rails in place.

For context on what the alternative costs: the average data breach runs about $4.5 million, EU AI Act penalties reach €35 million or 7% of worldwide turnover, and enterprises currently spend roughly 17 times more on AI tools than on securing them. That gap is the whole story of this market.

Pays: the fourth ‘ P ’

This is the one I am least willing not to explain, because a product that claims to pay for itself is making a financial claim, and financial claims get checked. So here is the arithmetic, mechanism by mechanism.

It caps your spend. AI Sentinel enforces a hard daily ceiling on model spend, per-session token budgets and a limit on tool calls. Remember the LLM jacking case: a $400 monthly bill became $67,000 over 11 days. A ceiling turns that into a $400 bill and an alert on day one. One prevented incident of that size covers roughly two years of the license.

It removes calls you are paying for twice. The optimizer layer caches responses and routes requests to an appropriate model rather than sending everything to the most expensive one available. For any organization spending meaningfully on inference, that lands on the model invoice every month, attacked or not.

It includes compliance work you would otherwise buy. Every deployment can ship with the auditor-ready package: 13 documents for ISO 42001 and 8 for the EU AI Act, plus the tamper-evident audit chain that feeds them. That is work a consultancy quotes for and bills by the month.

It replaces four products with one. MITRE ATLAS is a grid. Tactics across the top, techniques underneath, and most products cover a slice. To reach roughly 90% coverage a buyer typically stitches together four or five tools, each with its own license, its own integration and its own renewal conversation. We cover 100% of the applicable techniques in a single product at $48,000.

It saves your context. So you are not trapped into an LLM where all your workflows are synchronized with that model’s outputs, where sudden price increase mean you have no alternatives than to keep using them. With AI-Sentinel you can easily switch LLM models, using cheaper or more niched models to get more efficient answers to your questions. We see users naively using top-flight cloud models to check their email or find out what the weather is going to be like. The telemetry layer in AI-Sentinel automatically choses the correct model type for the type of call.

Here is what I am not going to do. I am not going to add the $4.5 million average breach cost to that total and call it a return. Avoiding a loss you might never have suffered is insurance, not a saving, and vendors who blur the two are the reason finance teams discount these conversations before they start. The four items above are arithmetic you can run against your own invoices. The breach number is context for why you are having the conversation at all.

Current numbers show clients saving roughly 30% monthly on their AI LLM bills. So if your LLM spend is $30,000 a month then you’ll save $10,000 a month and have a pay-back for your yearly cost of AI-Sentinel in five months. Simple really.

Pilot, Protect, Prove, Pays. The first three are why a security team says yes. The fourth is why your finance team will love you.

We would rather show you than tell you

Here is the part I would care about most if I were on the other side of this conversation.

You should not have to spend six figures before you are allowed to see what a tool does to your own system. That is how this category has worked, and it is backwards.

So we run Monitor Mode. We deploy non-blocking against your live traffic. It integrates in minutes and it cannot break anything, because it is not in the enforcement path yet. It watches.

Then, within days, we hand you a list of what is already getting through. The injections, the extraction attempts, the leaks your current stack never flagged. On your traffic, not in a demo environment.

Figure 6. The Monitor Mode entry path. No change to your enforcement path and no commitment.

That conversation is usually uncomfortable, and it should be. In a pilot with a managed services provider running live production traffic across multiple model endpoints, we recorded zero confirmed data exfiltrations across 3,000 live attacks, an 85.1% adversarial action rate against a 1,000-payload red team campaign, and 100% of system-prompt extraction and cost-amplification probes blocked. Those probes were passing through a traditional WAF, because a WAF has no idea what a system prompt is.

Figure 7. Results from the managed services provider pilot, June 2026. One environment, and not a guarantee of results elsewhere.

“ Then you decide. The audit is free. The blind spot is not.”

Where we actually are…

Some honesty about the stage, because a security company that oversells, is a security company you should not buy from.

We have paying customers and others on Monitor Mode with live pilots. You can ask us for a login and watch AI-Sentinel running on your data. We are not a large company and our ISO 42001 documentation is complete and the organizational certification process is underway, so I am not going to tell you we are certified today. We are technically compliant with FIPS, HIPAA and the EU AI Act, and with GDPR for clients with European exposure, and we have the materials to evidence it.

I will also say the thing most founders bury. Bluntly, there is no pure IP in what we have done. No patents, no secret lab. What no one else has done is bring the combination together: Rust, deterministic detection, full applicable ATLAS and OWASP coverage, sub-20ms latency, inline enforcement and continuous adversarial validation, in one product suite, at a price a mid-sized company can sign off. That combination is not on anyone else's public roadmap. We came at the problem from a different direction, and that is what made it a different product.

On the fourth ‘ P ’ specifically: the mechanisms are real and running today, and the cap and the caching are things you can watch work in a pilot. What we do not yet have is a long enough run of customer invoices to publish an average payback period across many companies to give a statistically substantive number. When we do, we will publish it with the workings.

Every claim in this piece is one we will show you the evidence for. That is deliberate. IT security is fairly binary – you are either secure and protected or you are not. So the whole argument rests on being transparent and checkable. Trust but verify.

Figure 8. The four Ps. Each one is a thing you can check rather than a thing you have to believe.

Why the 4Ps is difficult to copy

Any competitor can claim better detection. Any competitor can lower prices. Any competitor can build another feature. What they cannot easily replicate is a philosophy that integrates proof before purchase, best-in-class protection, continuous validation, and measurable economic return into a single operating model.

These four principles reinforce one another. Together, they define how we build products, how we sell them, how we price them, and how we measure customer success. All our products and services are built to reinforce this philosophy.

These are not features – they are the foundation of the company.

The part that is not optional

AI is going into production everywhere, faster than anyone is securing it. The models are getting better at attacking more quickly than most organizations are getting better at defending. That is not a reason to panic, and it is certainly not a reason to slow your AI program down.

It is a reason to know your data and company is protected rather than hope you don’t get attacked.

Do not take my word for any of it. Put us in Monitor Mode against your own traffic and see what comes back.

“ Math does not have bad days. Neither should your AI Security.”

--------------------------------------------------------------------------------

Hugh Dunkerley is Co-founder and CEO of AI Sentinel. To learn more about AI-Sentinel or to start running a Monitor Mode pilot against your own AI traffic, contact info@onnexglobal.com or visit www.ai-sentinel.on-nex.us.

All charts are original work by AI Sentinel, redrawn from values stated in the text of the paper. No source artwork is reproduced.

This article was drafted using artificial intelligence tools to assist with content generation, and subsequently reviewed, heavily edited, and fact-checked by a human editor to ensure accuracy, quality, and originality.