Vendor shortlist
AI red teaming providers in 2026
Red teaming a generative model takes two things: software that runs attack libraries continuously, and people who think of the attack the library does not have yet. The vendors split along that line.
Automated platforms cover prompt injection, jailbreaks, PII leakage and harmful content at scale and belong in CI. Human red teams find the domain-specific failures: a wrong dosage that reads plausibly, a contract clause that is legally void, a chemistry answer that is dangerous only to someone who knows chemistry. Regulated deployments need both.
Below are the vendors that appear in 2026 shortlists, grouped by what they actually deliver.
kinds of vendor: human and automated
automated platforms compared
human expert red teams compared
based in the EU
Vendor facts come from the vendors' own material and widely cited public sources as of October 2026; pricing is per quote unless the vendor publishes it. Pathwize is EU-native: all data stays within the EU.
How we compared
01
Human or automated
Automated platforms test continuously and cheaply; human teams find what no library contains. Most buyers need one of each.
02
Who the humans are
Security generalists, crowd workers, or domain experts with credentials. For medical, legal or financial models only the last group finds the failures that matter.
03
Evidence
Reproducible attack transcripts, severity ratings, and who produced them. Auditors ask for this.
04
EU data residency
Red teaming means sending the model's worst outputs somewhere. Where that somewhere is matters under GDPR and the AI Act.
The shortlist
| Vendor | Model | Best for | Pricing | EU residency |
|---|---|---|---|---|
Giskard Paris, FR | Automated: open-source core plus commercial hub for continuous testing Covers hallucination, harmful content, PII disclosure and prompt injection in the hub. | Continuous LLM and agent testing with EU AI Act alignment | Open source free; enterprise per quote | Yes |
Lakera Zurich, CH / US | Automated: Lakera Red paired with the Lakera Guard runtime Public reporting says Check Point acquired Lakera in 2026; check the roadmap. | Runtime protection of live applications | Free community tier; enterprise per quote | Partial |
HiddenLayer Austin, US | Automated: AISec platform with AutoRT red teaming, model-agnostic Broad security suite; reviewers note red-teaming depth is thinner than specialists. | Enterprise and US federal security programs | Per quote | No |
Promptfoo, Garak, PyRIT Open source | Automated: attack libraries you run yourself Cheapest option; someone has to maintain the library and read the output. | Teams that maintain their own attack sets | Free | n/a |
Scale AI San Francisco, US | Human: managed red teams plus expert programs Also runs automated evaluation tooling. | Large lab safety programs | Per quote | Partial |
Surge AI San Francisco, US | Human: curated contractors for adversarial and safety data Known for task design quality. | Premium adversarial datasets for frontier labs | Per quote | Partial |
Mercor San Francisco, US | Human: expert marketplace Experts recruited per field. | Domain-expert adversarial evaluation at scale | Per quote | Partial |
Pathwize Cologne, Germany | Credentialed experts and students from a 200k+ network, qualification test on your own data, paid per hour Experts are tested on your task first; attack transcripts come with author, time and severity. | Domain-expert red teaming in medicine, engineering, law and finance, EU residency | Per hour, quoted per task; free pilot on 50 items | Yes |
Giskard
Paris, FR
Automated: open-source core plus commercial hub for continuous testing
Best for: Continuous LLM and agent testing with EU AI Act alignment
Pricing: Open source free; enterprise per quote
Covers hallucination, harmful content, PII disclosure and prompt injection in the hub.
Lakera
Zurich, CH / US
Automated: Lakera Red paired with the Lakera Guard runtime
Best for: Runtime protection of live applications
Pricing: Free community tier; enterprise per quote
Public reporting says Check Point acquired Lakera in 2026; check the roadmap.
HiddenLayer
Austin, US
Automated: AISec platform with AutoRT red teaming, model-agnostic
Best for: Enterprise and US federal security programs
Pricing: Per quote
Broad security suite; reviewers note red-teaming depth is thinner than specialists.
Promptfoo, Garak, PyRIT
Open source
Automated: attack libraries you run yourself
Best for: Teams that maintain their own attack sets
Pricing: Free
Cheapest option; someone has to maintain the library and read the output.
Scale AI
San Francisco, US
Human: managed red teams plus expert programs
Best for: Large lab safety programs
Pricing: Per quote
Also runs automated evaluation tooling.
Surge AI
San Francisco, US
Human: curated contractors for adversarial and safety data
Best for: Premium adversarial datasets for frontier labs
Pricing: Per quote
Known for task design quality.
Mercor
San Francisco, US
Human: expert marketplace
Best for: Domain-expert adversarial evaluation at scale
Pricing: Per quote
Experts recruited per field.
Pathwize
Cologne, Germany
Credentialed experts and students from a 200k+ network, qualification test on your own data, paid per hour
Best for: Domain-expert red teaming in medicine, engineering, law and finance, EU residency
Pricing: Per hour, quoted per task; free pilot on 50 items
Experts are tested on your task first; attack transcripts come with author, time and severity.
Where Pathwize fits
Pathwize supplies the human half: credentialed experts who attack a model inside their own field, from the EU. A physician probes a medical assistant, a structural engineer a building-code model, a lawyer a contract reviewer.
Each red teamer passes a qualification round on your scenario before the real work. Every attack transcript carries who wrote it, when, how long it took and a severity rating, which is what an audit asks for.
Pair it with an automated platform for coverage. Pathwize does not replace continuous testing in CI; it finds the failures that continuous testing cannot see.
FAQs
For automated, continuous testing: Giskard (EU), Lakera, HiddenLayer, or open-source Promptfoo, Garak and PyRIT. For human expert red teaming: Scale, Surge, Mercor in the US, Pathwize in the EU.
For general-purpose assistants an automated platform covers most of the risk. For models in medicine, law, finance or engineering, the dangerous failures are domain-specific and only experts in that domain find them.
Automated platforms range from free open source to enterprise subscriptions per quote. Human expert red teaming is priced per expert hour; Pathwize quotes per task and shows the time per attack.
Usually within a few days. You send the task, the classes or rubric and a few examples; qualified experts take the test on your data; you approve who continues. A 50-item pilot is free.
Per hour of expert work, quoted per task depending on the domain and the complexity. Time is tracked automatically per item, so you see cost per item and per class in the dashboard and in the export.
In the EU. Pathwize is based in Cologne, Germany; storage and processing run on EU infrastructure, and experts work from Europe. Sensitive data can be worked in a no-download environment.
Related