Skip to content
redactsure
Book a demo

Explore.

Comparison · By Chris Sowa · Published
Last updated

What Is the Difference Between RedactSure and TrojAI (A10 Networks) for AI Agent Security?

TrojAI, now part of A10 Networks, lowers the odds that an attack on AI traffic succeeds, while RedactSure decides what a successful attack can take by tokenizing the screen an agent reads and holding each action for a named person. Ask each vendor what the model was holding when an injection got through, and who approved the next step.

Different data shapes converge through a traffic boundary and then separate into controlled record fields and task destinations.

TrojAI, now part of A10 Networks, lowers the odds that an attack on AI traffic succeeds, while RedactSure decides what a successful attack can take by tokenizing the screen an agent reads and holding each action for a named person. Ask each vendor what the model was holding when an injection got through, and who approved the next step. TrojAI red-teams AI applications and runs a firewall that inspects prompts, responses and MCP traffic, redacting PII in that text. RedactSure governs agents that work through the browser, tokenizing the rendered screen before a model reads it. Both matter, and they answer different questions. Red teaming and runtime inspection ask whether a prompt, a response or a tool description looks hostile. An agent reading a claims screen or a vendor master record faces a second question that inspection does not settle: if an injection gets through, as OWASP's guidance says some may, what values was the model holding? That is the question render-layer tokenization answers, and the comparison below runs on what each design inspects, where it sits, what it does with a sensitive value, and how actions are governed. The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Key findings

  • A10 Networks acquired TrojAI on June 15, 2026, describing the combination as "pairing our hardware-based AI firewall with TrojAI's software-based red teaming and runtime protection" (A10 Networks, 2026).
  • Defend, "a purpose-built AI application and agent firewall," "identifies and masks sensitive data in both inputs and outputs," with policy actions to block, allow, alert, redact and report; consistent or reversible tokenization is not described in the pages reviewed (A10 Networks, 2026).
  • Administrators approve MCP servers and tools in a registry; per-action human approval of agent actions is not described in the pages reviewed (A10 Networks, 2026).
  • OWASP ranks prompt injection first in its Top 10 for LLM Applications 2025 and says it is unclear whether fool-proof prevention methods exist (OWASP, 2025).
  • Researchers showed that instructions planted in content an LLM application reads can redirect it, which makes anything the model can see a possible target (Greshake et al., 2023).
  • A 2026 study found that a firewall which strips unneeded data before tool calls, paired with one that cleans tool outputs, brought attack success near zero on four agent benchmarks, and warned that those benchmarks have flawed metrics and weak attacks (Bhagwatkar et al., 2026).

What does TrojAI's documentation say the platform covers?

TrojAI describes itself as "The Security Platform for Agentic AI," with the headline "Control the Chaos of Agentic AI," acting on traffic routed through its firewall (TrojAI, 2026; vendor documentation, accessed October 16, 2026). A10 Networks acquired the company on June 15, 2026 (A10 Networks, 2026), and markets the product as TrojAI by A10 Networks (A10 Networks, 2026).

The platform has two main modules. Detect provides "agent-led red teaming that uncovers AI risks," with "150+ attacks and manipulations out of the box," run against the application under test (A10 Networks, 2026). Defend is "a purpose-built AI application and agent firewall" for traffic routed through it (A10 Networks, 2026). Extensions cover MCP servers and "employee usage of popular third-party GenAI apps in browsers," the person's use rather than what an agent reads on a page, and findings map to OWASP, MITRE ATLAS and NIST (A10 Networks, 2026).

For agents, TrojAI lists coverage of "direct and indirect prompt injection, jailbreaking, and more," and of tool abuse such as rogue MCP servers and tool tampering, in the traffic it inspects (TrojAI, 2026). Defend for MCP "discovers and registers all MCP servers" to "eliminate shadow MCP" and detects malicious tool descriptions and definition drift, on the MCP path only (A10 Networks, 2026). Agent Runtime Intelligence, which captures "full AI agent execution traces," is in private preview, and Defend extends to coding assistants such as Claude Code and Codex (Help Net Security, 2026).

The pages reviewed do not state several things a buyer evaluating browser-based agents will ask about. TrojAI's site lists "Desktop Agents" among agent types without further description. The pages describe no control over what a computer-use or browser agent reads on a rendered page, no consistent or reversible tokenization, and no person approving an individual agent action. They publish no detection or accuracy rates. Other TrojAI or A10 documentation may cover these points; this comparison is limited to the pages listed in its sources.

What the pages do state places TrojAI at the model-traffic layer: test the AI application before it ships, then inspect what crosses it at runtime.

What happens to a sensitive value in each design?

Take a single record: a vendor master screen showing the vendor's name, tax ID, bank account number, remittance address and open invoices. An agent has been asked to update the remittance address from a letter the vendor emailed, and the letter carries a hidden instruction to change the bank account as well.

In the design TrojAI's pages describe, Defend sits in the path of the agent's traffic. It "identifies and masks sensitive data in both inputs and outputs" passing through the firewall, with policy actions of block or allow, alert, redact and report (A10 Networks, 2026). The platform brief describes the ability to "block and redact prompts with PII or sensitive data in real time" in traffic it inspects (A10 Networks, 2026), and coding-agent protection "detects exposed secrets" (Help Net Security, 2026). Defend may also detect the hidden instruction, if the letter's text passes through it. The format of redacted values, the supported data types, and whether replacements are consistent or reversible are not described in the pages reviewed. Each control acts on text passing through the firewall: a prompt, a response, a tool call. That is the right place to catch hostile instructions and to stop a value leaving in an outbound message.

In RedactSure's design, the agent works the vendor application inside a governed environment. Before any model reads the screen, the vendor's tax ID, bank account number and remittance address become consistent tokens such as ACCT_001. The invoice amounts stay in clear. The model receives the task's fields with identifiers as tokens. If the hidden instruction gets through, it finds ACCT_001, not an account number, and the record change it wants still stops for a named person. Real values resolve only at the approved destination, at the moment that person approves the change.

The reason this matters is what a model does with what it reads. Instructions planted in content an application reads, such as a document or an email, can redirect it (Greshake et al., 2023). OWASP names sensitive information disclosure as a top LLM risk, covering personal data and confidential business data that reach or leave a model (OWASP, 2025). A firewall that masks a value in a prompt protects that prompt. Tokenizing the render decides what the model holds before any prompt is formed.

How do the two compare side by side?

The table records what each side's documentation states. For TrojAI, that is the TrojAI website, A10 Networks' product page and solution briefs dated July 2026, and third-party coverage, accessed October 16, 2026 (A10 Networks, 2026). For RedactSure, it is the current published design.

Dimension TrojAI (A10 Networks), per its documentation RedactSure, per its published design
Question it answers Is this prompt, response or tool hostile? What may the model see, and who approves what it does?
What it inspects or controls Prompts, responses, tool calls and MCP traffic; employee GenAI use in browsers The screen an agent reads in a governed environment, and its actions there
Where it runs Reverse proxy or guardrail service on AI application and MCP traffic Between the rendered screen and the model, before any model reads it
Treatment of a sensitive value Detect and mask or redact in inputs and outputs Consistent token per entity, chosen by the Planner's policy
Route back to the real value Not described in the pages reviewed Real values resolve only at approved destinations at the moment of an approved action
When an injection gets through The model holds whatever the agent read The model holds tokens; the action still waits for a person
Pre-deployment testing Agent-led red teaming, "150+ attacks and manipulations out of the box" Not claimed; RedactSure is not a red-teaming product
Agent actions and approval Administrators approve MCP servers and tools in a registry; runtime block, alert or redact by policy A named person confirms policy and approves every payment, submission and record change
Record Audit trails; insights streamed to SIEM, SOAR and ticketing Every action logged, human and computer; all PII as tokens; the AI Control Record exports to the customer's SIEM

Several TrojAI cells say "not described" because the pages reviewed are product pages and solution briefs, not a full technical specification. Those cells describe the pages, not the product's full capability, and a buyer should confirm each one with A10 Networks. The RedactSure column describes a design in pilot.

What does a successful injection reach in each design?

Prompt injection is the threat both designs address, from opposite ends. The question that separates them is what an injection collects when it succeeds, because every detector has a miss rate and every benchmark has limits.

TrojAI's approach is to find weaknesses before deployment and catch attacks at runtime in the traffic routed through it. Detect runs agent-led red teaming before an application ships (A10 Networks, 2026), and Defend inspects traffic once it does. Both lower the odds that an attack lands; neither decides what a landed attack can read. TrojAI publishes no detection or accuracy rates, so none are compared here. The research record suggests caution with any rate: Bhagwatkar and colleagues found that public agent security benchmarks contain flawed success metrics, implementation bugs and weak attacks, and reported attack success falling from 70 percent to 9.25 percent in one setting once forced injection was removed (Bhagwatkar et al., 2026). A benchmark's construction shapes its numbers.

MIT Technology Review describes vendors' stacked defenses as a "Swiss cheese" arrangement in which each layer has holes and the stack is expected to cover them (MIT Technology Review, 2026). OWASP says it is unclear whether fool-proof prevention methods for prompt injection exist (OWASP, 2025). Some attacks will get through any detector.

Under render-layer tokenization, the defense is reduction. The model holds tokens in place of identifiers, so an injection that succeeds collects tokens and the task context the policy left in clear. The research page on prompt injection when the agent sees only tokens works through that sequence step by step. The same study supports reduction as a principle: its strongest results came from a firewall that strips data a tool call does not need (Bhagwatkar et al., 2026).

The two defenses stack. Inspection lowers how often an injection lands; tokenization and named approval lower what a landed injection can take or do. Microsoft's AI Red Team taxonomy lists agent failures that arise from what an agent is permitted to do, not only from what it is told (Microsoft, 2025), which is why the action needs a control of its own.

How do approval and the record differ?

Defend sits in the traffic path as a reverse proxy, self-hosted or as a cloud service, or behind an AI gateway as a guardrail service for API-based traffic (TrojAI, 2026). Traffic has to be routed through it for it to act. TrojAI's human checkpoint is the registry, not the individual action: administrators approve MCP servers and their tools before agents use them (A10 Networks, 2026). At runtime, Defend blocks, alerts or redacts by policy on the traffic it sees. A person approving an individual agent action is not described in the pages reviewed.

RedactSure's integration point is the environment the agent works in. The agent operates applications through their web interfaces, with no per-application integration and no change to user permissions, and the screen is tokenized as it renders. RedactSure puts the person on the action. Under Supervised Delegation, a named person grants the access, chooses the applications, confirms what is tokenized, can watch and pause the run, and approves every consequential action on the record. The Planner sets which values are tokenized and what the agent may do on each screen, and the named person confirms that policy before the run. An agent that an injection has steered still waits.

The NIST AI Risk Management Framework places that kind of decision in its Manage function (NIST, 2023): a response to risk made while the work is in progress, by someone accountable for it. Red teaming and threat logs support mapping and measuring AI systems as an attack surface.

The record follows the same split. TrojAI's pages describe audit trails and insights of inspected traffic streamed to SIEM, SOAR and ticketing systems. In RedactSure's design, the AI Control Record captures every screen the agent saw as tokens, every action and every approval with a name, and exports to the customer's own SIEM. The two gaps this closes are described in The Two Gaps AI Agents Opened in Your Security Stack.

Where does RedactSure sit?

For agents that work operational applications through the browser, RedactSure sits at the screen, between the rendered application and the model. Inside a governed environment deployed into the customer's cloud, on hardware-encrypted enclaves with keys the customer holds, identifiers chosen by policy are replaced with consistent tokens before any model reads the screen. Real values resolve only at approved destinations at the moment of an approved action, and a named person approves every payment, submission and record change. The environment is model agnostic, needs no per-application integration and leaves user permissions as they are. Deployments are in pilot. TrojAI complements it at the model-traffic layer, testing AI applications before they ship and inspecting prompts, responses and MCP traffic at runtime. A program running both gets a lower attack success rate and a smaller blast radius when an attack succeeds.

Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page rests on TrojAI's website and blog, A10 Networks' acquisition release, product page and four solution briefs, and Help Net Security's coverage, all accessed October 16, 2026 (vendor documentation and press); OWASP's Top 10 for LLM Applications 2025 and the NIST AI Risk Management Framework (standards); preprint research on prompt injection and agent firewalls; analysis from Microsoft's AI Red Team and MIT Technology Review; and RedactSure's published design.

No hands-on testing of TrojAI or any other named product was performed. A10's materials give two different counts of out-of-the-box red-team attacks; this page cites the Detect solution brief. TrojAI publishes no detection or accuracy rates, so none are compared. Where the pages reviewed do not describe a capability, the table says so; other documentation may describe it. A10's hardware firewall line was outside scope. Vendor features change, and the page carries its date. RedactSure statements describe the current design, with deployments in pilot. No specific organization is described.

Whether either product, or both together, meets an organization's obligations is a determination for its counsel, its assessors, and its own security and compliance officers. A buyer should confirm each "not described" cell with A10 Networks and request a demonstration of RedactSure's tokenized screen on the buyer's own task before relying on any row of the comparison.

What the record shows

TrojAI tests and inspects AI traffic, and under A10 it pairs that with network-scale firewalling; neither layer changes what an agent reads on a screen. Inspection lowers the success rate; it does not change what an agent was holding when an attack got through. For agents that read screens full of identifiers, the decisive control keeps the identifiers off the model and holds the action for a person. That is the reason to choose RedactSure for browser-based agent work, with a firewall such as TrojAI kept on the model traffic. The test is to name one agent and one task and ask each vendor to show what the model held when a planted instruction got through.

Frequently asked questions

Is TrojAI part of A10 Networks now?

Yes. A10 Networks acquired TrojAI on June 15, 2026, and the product is marketed as TrojAI by A10 Networks. A10 describes the combination as pairing its hardware-based AI firewall with TrojAI's software-based red teaming and runtime protection, both acting on traffic routed through them. This page covers the TrojAI platform as described in A10's product page and solution briefs.

Does TrojAI tokenize data before an agent reads it?

TrojAI's Defend identifies and masks or redacts sensitive data in inputs and outputs passing through its firewall. Consistent or reversible tokenization is not described in the pages reviewed. RedactSure tokenizes the rendered screen before any model reads it, with consistent tokens that resolve to real values only at approved destinations when a named person approves.

Does TrojAI stop prompt injection?

TrojAI detects direct and indirect prompt injection in the traffic it inspects and red-teams applications before they ship, with no published detection rate. No detection rates are published. RedactSure does not depend on detection: a successful injection against a tokenized screen collects tokens, and the consequential action it wanted still stops for a named person before anything changes.

Does TrojAI protect browser or computer-use agents?

TrojAI's site lists "Desktop Agents" among agent types without further description, and an extension covers employee use of GenAI apps in browsers, the person's use rather than an agent's reading. The pages reviewed describe no control over what a browser or computer-use agent reads on a rendered page. A buyer with browser-based agents should ask A10 Networks directly.

Does TrojAI require human approval of agent actions?

Administrators approve MCP servers and tools in a registry before agents use them, and Defend blocks, alerts or redacts by policy at runtime. Per-action approval is not described in the pages reviewed. RedactSure requires a named person to approve every payment, submission and record change, recorded in the AI Control Record.

Can an organization use TrojAI and RedactSure together?

Yes. TrojAI red-teams AI applications before they ship and inspects model and MCP traffic routed through it at runtime. RedactSure governs what browser-based agents see on each screen and who approves what they do. Inspection lowers how often an attack lands; tokenization and named approval limit what a landed attack can take.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.