{"resourceId":"anchorterminal-prisma-airs-runtime-api-independent-grade-c-20261102","versions":[{"version":"external-542585a9d9ac74d0db95ac2e8fe8b88f0a584fe23642b5900e216cbc4378aa1c","resource":{"id":"anchorterminal-prisma-airs-runtime-api-independent-grade-c-20261102","title":"Independent desk review grades the Prisma AIRS AI Runtime Security API a C (61.6/100), citing 10-year retention of malicious payloads and an EULA ban on published benchmarks","organization":"AnchorTerminal (independent agent-tool review site)","sector":"AI runtime security / guardrail APIs","geography":"Global product; US, Germany, India and Singapore regional hosts","publishedAt":"AnchorTerminal tool review, evidence last checked Nov. 2, 2026 (facts verified Oct. 8, 2026)","publicationDate":"2026-11-02","eventDate":null,"sourceName":"AnchorTerminal","sourceLabel":"Prisma AIRS AI Runtime Security review: pricing, alternatives, grade C","sourceUrl":"https://www.anchorterminal.com/tools/prisma-airs","evidenceClass":"independent-research","outcomeClass":"mixed","topics":["data-security","developers-agents","governance-procurement"],"finding":"AnchorTerminal scores the Prisma AIRS AI Runtime Security scan API 61.6 of 100 (grade C, \"mixed, material gaps\"), from public evidence re-checked Nov. 2, 2026; performance and task-success testing are still pending. Strengths: public OpenAPI documents, up to ten detection types in one call including MCP tool events, rotating API keys and OAuth roles, regional hosts and FedRAMP Moderate support since October 2026. Weaknesses: no public price or trial (capacity bought as Software NGFW credits in billion-token steps), payloads judged malicious retained up to 10 years even after the subscription ends, an EULA that forbids publishing benchmark or comparison tests, a 99.9% availability objective without an SLA, and a Python SDK credential-logging fix still unreleased. It also notes a detector failure can arrive inside an HTTP 200 response, as URL filtering did in the US on Oct. 15.","sledRelevance":"State agencies, universities and health departments evaluating Prisma AIRS as a guardrail for chatbots and agents get a rare non-vendor read on contract and data-handling terms. Interpretation: the 10-year retention of flagged payloads matters for public-records, CJIS, FERPA and HIPAA data that may be inside prompts; the benchmark-publication ban limits how universities and auditors can share evaluation results. FedRAMP Moderate support helps, but SLED buyers should confirm state-level authorizations separately.","evidence":"Opened and read the full review page, including the facts table, strengths/weaknesses and category scoring notes. Desk review of public documentation, status history and package registries; no live performance testing yet.","architectureImplications":"Scan API and remote MCP server sit beside applications and agents; integrators must call the scan before and after generation themselves and must check error/timeout fields even on HTTP 200 responses.","governanceImplications":"Interpretation: retention of flagged payloads and the benchmark ban should be reviewed by counsel and records officers before contracting.","securityPrivacyImplications":"Malicious-flagged prompts, which may include regulated data, are retained up to 10 years; SDK debug logging can expose most of an API key in released versions.","caveats":"Desk review of public evidence only; performance and task success not yet scored; scoring weights are the reviewer's own; vendor has not claimed the listing; some facts dated Oct. 8 and not re-read Nov. 2.","streamIds":["palo-alto-networks"],"roles":{"sales":"Sales framing: this independent review gives buyers concrete questions rather than a verdict on whether Prisma AIRS works. It praises documentation, detector breadth and FedRAMP Moderate support but flags no public pricing, ten-year retention of flagged payloads and an EULA banning published benchmarks. A bounded engagement could be a contract and data-handling review before a guardrail pilot. Do not present the C grade as a measure of detection accuracy, because performance testing is still pending.","engineering":"Engineering framing: the scan API scans only the last element of contents, can return detector failures inside a successful HTTP response, and limits result lookups to five IDs at ten requests a minute. Engineers should build explicit handling for error and timeout fields, keep SDK debug logging off, and plan regional key placement. A proof of value should measure detection and false-positive rates on the customer's own prompts, since the review has not tested performance.","delivery":"Delivery framing: a Prisma AIRS rollout in a public entity needs records, privacy and legal sign-off on retention terms before production traffic flows. Delivery should add monitoring for silent detector failures, a key-rotation schedule and a documented SDK version policy. Proposed acceptance criteria include alerting on any scan error returned with HTTP 200 and an approved retention exception or mitigation for regulated data. Risks include contract terms blocking publication of pilot results."},"roleDetails":{"sales":{"customerProblem":"Public entities need guardrails for AI chatbots and agents but must understand retention, pricing and evaluation restrictions before buying.","stakeholders":["CISO","Records management officer","Privacy and legal counsel","Procurement office","Application owners deploying AI assistants"],"discoveryQuestions":["Will prompts containing CJIS, FERPA or HIPAA data be sent to the scan API?","Can the 10-year retention of flagged payloads be negotiated or mitigated?","Does the EULA benchmark ban conflict with university research or audit publication needs?","Which state authorizations, beyond FedRAMP Moderate, are required?"],"valueHypothesis":"Interpretation: a scoped, contract-reviewed guardrail pilot could give documented prompt-injection and DLP coverage for one AI application.","potentialEngagement":"A pre-contract terms review plus a time-boxed scan-API pilot on one internal AI application.","unsupportedClaims":["Detection accuracy or false-positive rates","Guaranteed uptime with remedies","Cost predictability for small entities","Suitability for every regulated data type"]},"engineering":{"fit":"Fits entities already on Strata Cloud Manager that want prompt, response and MCP tool scanning from the same vendor.","architectureIntegration":"Applications call the regional scan API or remote MCP server before and after model generation; management via Strata Cloud Manager.","prerequisites":["Strata Cloud Manager tenant","Software NGFW credits","Security profile definitions","Regional API keys"],"constraints":["Region-locked keys","10 requests per minute on results lookups","Python-only SDK","No published SLA"],"security":"Flagged payloads retained long term; SDK debug logs can leak most of an API key.","proofOfValue":["Measure detection and false positives on the entity's own red-team prompts","Force a detector timeout and confirm the application handles errors in HTTP 200 responses","Confirm retention terms in writing"]},"delivery":{"work":"Contract review, pilot integration on one application, monitoring setup and staged production rollout.","dependencies":["Legal and records review","Strata Cloud Manager access","Application team capacity"],"ownership":"The security operations team owns the guardrail service; the application owner owns integration and error handling.","skillsAdoption":"Developers need training on scan-before-and-after patterns and response-field checks.","governanceCheckpoints":["Retention terms approved before production","Pilot results reviewed against the EULA publication limits","Quarterly key rotation verified"],"acceptanceCriteria":["Proposed: 100% of scan errors returned with HTTP 200 raise an alert","Proposed: measured false-positive rate below an agreed threshold on pilot traffic","Proposed: written retention mitigation for regulated data"],"risks":["Silent detector failure treated as allow","Regulated data retained beyond records schedules","Credit-based pricing exceeding pilot budget"]}},"retrievedAt":"2026-11-05T04:08:51Z","enrichedAt":"2026-11-05T04:11:19Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Python is the only official SDK, so teams using other languages must build their own clients.","procurementImplications":"No public pricing; capacity sold in minimum 1-billion-token monthly credit blocks through sales. Budget forecasting for pilots is harder for small entities.","operatingModelImplications":"Teams need monitoring for silent detector failures and a key-rotation routine; status-page incidents should feed operations.","sourceVerification":{"openedUrl":"https://www.anchorterminal.com/tools/prisma-airs","referenceExcerpt":"Payloads judged malicious are kept for up to 10 years, including after the subscription ends, per the privacy datasheet of 13 July 2026","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}