Arcjet vs Prisma AIRS

Arcjet vs Prisma AIRS

Prisma AIRS is Palo Alto Networks' AI security platform, and Arcjet is an AI agent runtime security platform. The key difference is where each product decides. Prisma AIRS scans AI content through an API, Palo Alto Networks firewalls, or an AI gateway. Arcjet evaluates a policy in the path of each action: inside your code for the agents you build, and in the hooks that Claude Code, GitHub Copilot, Cursor, and OpenAI Codex already fire.

Prisma AIRS also covers model scanning, AI red teaming, and posture management, and it absorbed Protect AI in 2025. Choose Prisma AIRS when you want AI security from your network security vendor across models, cloud traffic, and red teaming. Choose Arcjet when you need a policy decision on each agent action with application context, one policy across four coding agents, self-serve pricing from $25 per month, and no gateway or firewall to route through.

Arcjet publishes this comparison. Competitor details come from Palo Alto Networks' public documentation, reviewed on September 25, 2026. Products change, so check the linked sources before you decide.

Prisma AIRS and Arcjet at a glance

The following table compares Prisma AIRS and Arcjet across 11 areas, from where each product enforces to how each is priced.

What is Prisma AIRS?

Prisma AIRS is Palo Alto Networks' platform for securing AI across its lifecycle. Palo Alto Networks' annual report describes it as a platform "designed to help organizations discover, assess, and protect AI agents, applications, models and data across the AI lifecycle." The product page lists six modules: AI Gateway, Agent Security, AI Red Teaming, AI Runtime Security, AI Model Security, and AI Posture Management.

Palo Alto Networks built much of Prisma AIRS through acquisitions. Palo Alto Networks completed its acquisition of Protect AI on July 22, 2025, adding model scanning, posture management, AI red teaming, runtime protection, and AI agent security. Its quarterly filing gives a total consideration of $700 million at signing. Prisma AIRS 3.0, announced in March 2026, added agent discovery, Agent Artifact Security, and an AI Agent Gateway in limited preview.

Palo Alto Networks completed the Koi acquisition in April 2026 to secure coding agents and other endpoint AI tools, and made Portkey the core AI Gateway for Prisma AIRS in May 2026. The Prisma AIRS AI Gateway reached general availability in July 2026 as a gateway for LLM, MCP, and agent-to-agent traffic. Portkey's own site states that "Portkey is now PRISMA AIRS AI Gateway." For how the Portkey gateway works, see Arcjet vs Portkey.

Prisma AIRS runs at runtime in two deployment modes: API intercept and network intercept. With API intercept, your application sends prompts and responses to a scan API, directly or through a Python SDK, and acts on the verdict. Network intercept inspects AI traffic inline through Palo Alto Networks firewalls in your cloud.

A Prisma AIRS API security profile configures nine detections: prompt injection, contextual grounding, custom topics, toxic content, malicious code, malicious URLs, sensitive data, database operations, and AI agent threats. Each detection is set to allow or block. MCP threat detection adds tool scanning to the same APIs.

For coding agents, Palo Alto Networks describes Cortex Agentic Endpoint Security, which runs on the device, names Claude Code and Cursor, and enforces allow or block verdicts from Prisma AIRS before an action completes. Palo Alto Networks also published a Claude Code integration that uses Claude Code hooks to scan prompts, tool calls, and tool outputs, with the integration guide on GitHub.

Prisma AIRS uses a bring-your-own-license model funded by Software NGFW credits. API intercept usage is measured in monthly tokens, where one token equals four characters.

What is Arcjet?

Arcjet is an AI agent runtime security platform that enforces policy in the path of the action, in code or in the agent's hook, not on the network. With Arcjet, you discover the agents that run in your organization, enforce policy across every action, prompt, and tool call, and keep the evidence of what happened.

For coding agents, Arcjet enforces policy on Claude Code, GitHub Copilot (CLI and cloud agent), Cursor, and OpenAI Codex through the hooks each agent already fires, with no SDK and no code change. One Arcjet policy applies across all four agents and decides before the tool call runs. You choose when the policy runs with Execute on: Tool call, Prompt, or Model switch.

Arcjet has 12 starter policies for coding agents, covering destructive commands, history rewrites, protected paths, credential access, piped installers, MCP allowlists, egress allowlists, destination threats, model allowlists, sensitive information, prompt injection, and npm publish. You install the hooks through managed settings or mobile device management (MDM), so developers can't remove them without admin access. For visibility without a hook, Arcjet ingests OpenTelemetry and the Claude Compliance API.

For agents and applications you build, Arcjet Guards run inside your code. The JavaScript, TypeScript, Python, and Go SDKs call guard() on tool calls, queue consumers, MCP handlers, and any action with no HTTP request, and protect() on HTTP routes. Integrations cover 15 agent frameworks: the Claude Agent SDK, Claude Managed Agents, Cloudflare Think, CrewAI, Genkit, Google ADK, LangChain, LangGraph, Mastra, OpenAI Agents, Strands Agents, TanStack AI, the Vercel AI SDK, Vercel Eve, and Microsoft Agent Framework for Go.

You manage Arcjet policies centrally, write them in Rego or with a builder, and publish them from the Arcjet Console or the Arcjet MCP server. Each rule runs in dry run before it goes live, and changes take effect in real time. Detectors include prompt injection, sensitive information, destination threat analysis, token budgets, and rate limits. The same SDK covers bot detection, Shield WAF, rate limiting, and email validation for web applications.

Coding-agent hooks have limits that the agent vendors set. Claude Code and Copilot HTTP hooks fail open by vendor design, while Cursor and Codex use a fail-closed command wrapper. Personal accounts don't load organization hooks, so you block those at the network or device. For details, see why coding agent hooks fail open.

How do Prisma AIRS and Arcjet differ?

Arcjet differs from Prisma AIRS in four ways: Arcjet evaluates a policy rather than a content scan, covers coding agents through their hooks rather than an endpoint product, runs with no gateway or firewall in the path, and sells self-serve plans. The following sections cover each difference.

A policy decision versus a content scan

A Prisma AIRS security profile classifies content, such as a prompt, a response, or a tool call, against threat categories and returns allow or block. Arcjet evaluates a policy that you write in Rego or the builder, over the inputs of the action: the command, the file path, the destination, the MCP server, the model, and any application value you pass.

An Arcjet policy can deny git push --force to main or a write to .github/workflows/, whether or not the content looks malicious. Arcjet detectors such as prompt injection and destination threat analysis feed into the same policy. For the difference in practice, see how to limit AI agent actions.

Coding agents

Palo Alto Networks covers coding agents with an endpoint product, Cortex Agentic Endpoint Security, that sends content to Prisma AIRS for a verdict. Arcjet uses the hooks that Claude Code, GitHub Copilot, Cursor, and Codex already fire, so there's no endpoint agent to deploy, and Arcjet evaluates your policy with starter policies, dry run, and managed-settings installation.

Arcjet evaluates hooks at the edge in over 300 data centers, which typically adds a few tens of milliseconds. Latency matters here because Claude Code and Copilot fail open on a slow hook. For a walkthrough, see how to secure AI coding agents.

No gateway or firewall in the path

Prisma AIRS network intercept and the AI Gateway see the traffic that you route through them. Arcjet runs where the action happens, in your tool handler or the agent's hook, so Arcjet covers tool calls that never cross a network boundary, such as a local shell command or a file read.

Prisma AIRS API intercept is also an in-code call. The difference is that Arcjet's SDKs wrap your framework's tool calls directly and return a policy decision, while API intercept returns a scan verdict that your code enforces. For the architecture, see AI agent security architecture, and for the general trade-off between a gateway and enforcement at the action, see AI gateway vs Arcjet.

Buying and deployment

Prisma AIRS is licensed through Palo Alto Networks Software NGFW credits, with API usage metered in tokens. Arcjet has self-serve plans (Individual at $25 per month, Startup at $299 per month) and custom Enterprise pricing, with usage at $50 per million agent requests. For plan details, see Arcjet pricing.

Who is Prisma AIRS for?

Choose Prisma AIRS when your organization runs Palo Alto Networks security and wants model scanning, red teaming, and network-layer AI inspection from the same vendor. Prisma AIRS fits when any of the following apply:

• You run Palo Alto Networks firewalls and want AI security under the same credit-based licensing.
• You need model scanning for third-party models, or automated AI red teaming.
• You want to inspect AI traffic inline at the network layer or through a central AI gateway.
• You want one vendor across network security, endpoint, identity, and AI security.

Who is Arcjet for?

Choose Arcjet when you need a policy decision on each agent action, in your own code or in your developers' coding agents, without deploying a gateway or firewall. Arcjet fits when any of the following apply:

• You need policy on the tool calls of Claude Code, GitHub Copilot, Cursor, and Codex, installed through managed settings.
• You build agents in code and want the check inside the tool handler, with your application's context.
• You want policies that express your rules, such as protected paths or allowed destinations, rather than only threat categories.
• You also need bot detection, rate limiting, and a WAF for the web application that hosts the agent.
• You want self-serve pricing and a free plan, without a firewall or gateway deployment.

Can you use Prisma AIRS and Arcjet together?

Yes. Prisma AIRS and Arcjet work at different layers, so you can run both. Prisma AIRS can scan models before deployment, red team your agents, and inspect AI traffic at the network or gateway, while Arcjet enforces policy on each action inside your agents and on your developers' coding agents.

Arcjet exports decisions to Datadog, Splunk, SentinelOne, Panther, and Amazon S3 on the Enterprise plan, so Arcjet decisions can reach the same SIEM as your Palo Alto Networks logs.

What are the alternatives to Prisma AIRS?

The alternatives to Prisma AIRS depend on which control you need: runtime enforcement, agent posture, employee AI usage controls, an application-side evaluator, or an AI gateway. The following products and categories are common alternatives:

• Arcjet: runtime enforcement in your code and in the hooks of Claude Code, GitHub Copilot, Cursor, and Codex, with self-serve pricing.
• Zenity: agent inventory, posture, and runtime boundaries, strongest on low-code and SaaS agents such as Copilot Studio.
• Prompt Security from SentinelOne: employee AI usage controls, code assistant redaction, and an MCP gateway.
• Datadog AI Guard: an evaluator you call from your application, configured in Datadog.
• Portkey and other AI gateways: gateways for model and MCP traffic. Portkey is part of Prisma AIRS as its AI Gateway.

For a broader shortlist, see AI agent security platforms and AI security posture management versus runtime security.