From the Palo Alto Networks edition of November 4, 2026
Independent desk review grades the Prisma AIRS AI Runtime Security API a C (61.6/100), citing 10-year retention of malicious payloads and an EULA ban on published benchmarks
AnchorTerminal (independent agent-tool review site) · AI runtime security / guardrail APIs · Global product; US, Germany, India and Singapore regional hosts
- Publisher
- AnchorTerminal
- Original publication
- AnchorTerminal tool review, evidence last checked Nov. 2, 2026 (facts verified Oct. 8, 2026)
- Source retrieved
- 2026-11-05
What happened
AnchorTerminal scores the Prisma AIRS AI Runtime Security scan API 61.6 of 100 (grade C, "mixed, material gaps"), from public evidence re-checked Nov. 2, 2026; performance and task-success testing are still pending. Strengths: public OpenAPI documents, up to ten detection types in one call including MCP tool events, rotating API keys and OAuth roles, regional hosts and FedRAMP Moderate support since October 2026. Weaknesses: no public price or trial (capacity bought as Software NGFW credits in billion-token steps), payloads judged malicious retained up to 10 years even after the subscription ends, an EULA that forbids publishing benchmark or comparison tests, a 99.9% availability objective without an SLA, and a Python SDK credential-logging fix still unreleased. It also notes a detector failure can arrive inside an HTTP 200 response, as URL filtering did in the US on Oct. 15.
Why it matters
State agencies, universities and health departments evaluating Prisma AIRS as a guardrail for chatbots and agents get a rare non-vendor read on contract and data-handling terms. Interpretation: the 10-year retention of flagged payloads matters for public-records, CJIS, FERPA and HIPAA data that may be inside prompts; the benchmark-publication ban limits how universities and auditors can share evaluation results. FedRAMP Moderate support helps, but SLED buyers should confirm state-level authorizations separately.
Evidence and measured results
Opened and read the full review page, including the facts table, strengths/weaknesses and category scoring notes. Desk review of public documentation, status history and package registries; no live performance testing yet.
Limitations and uncertainty
Desk review of public evidence only; performance and task success not yet scored; scoring weights are the reviewer's own; vendor has not claimed the listing; some facts dated Oct. 8 and not re-read Nov. 2.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-05; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Public entities need guardrails for AI chatbots and agents but must understand retention, pricing and evaluation restrictions before buying.
- Stakeholders
- CISO
- Records management officer
- Privacy and legal counsel
- Procurement office
- Application owners deploying AI assistants
- Discovery questions
- Will prompts containing CJIS, FERPA or HIPAA data be sent to the scan API?
- Can the 10-year retention of flagged payloads be negotiated or mitigated?
- Does the EULA benchmark ban conflict with university research or audit publication needs?
- Which state authorizations, beyond FedRAMP Moderate, are required?
- Value hypothesis
- Interpretation: a scoped, contract-reviewed guardrail pilot could give documented prompt-injection and DLP coverage for one AI application.
- Potential engagement
- A pre-contract terms review plus a time-boxed scan-API pilot on one internal AI application.
- Unsupported claims
- Detection accuracy or false-positive rates
- Guaranteed uptime with remedies
- Cost predictability for small entities
- Suitability for every regulated data type
Pre-sales engineering
Role takeaway
- Fit
- Fits entities already on Strata Cloud Manager that want prompt, response and MCP tool scanning from the same vendor.
- Architecture and integration
- Applications call the regional scan API or remote MCP server before and after model generation; management via Strata Cloud Manager.
- Prerequisites
- Strata Cloud Manager tenant
- Software NGFW credits
- Security profile definitions
- Regional API keys
- Constraints
- Region-locked keys
- 10 requests per minute on results lookups
- Python-only SDK
- No published SLA
- Security
- Flagged payloads retained long term; SDK debug logs can leak most of an API key.
- Proof of value
- Measure detection and false positives on the entity's own red-team prompts
- Force a detector timeout and confirm the application handles errors in HTTP 200 responses
- Confirm retention terms in writing
Delivery
Role takeaway
- Work
- Contract review, pilot integration on one application, monitoring setup and staged production rollout.
- Dependencies
- Legal and records review
- Strata Cloud Manager access
- Application team capacity
- Ownership
- The security operations team owns the guardrail service; the application owner owns integration and error handling.
- Skills and adoption
- Developers need training on scan-before-and-after patterns and response-field checks.
- Governance checkpoints
- Retention terms approved before production
- Pilot results reviewed against the EULA publication limits
- Quarterly key rotation verified
- Acceptance criteria
- Proposed: 100% of scan errors returned with HTTP 200 raise an alert
- Proposed: measured false-positive rate below an agreed threshold on pilot traffic
- Proposed: written retention mitigation for regulated data
- Risks
- Silent detector failure treated as allow
- Regulated data retained beyond records schedules
- Credit-based pricing exceeding pilot budget
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Scan API and remote MCP server sit beside applications and agents; integrators must call the scan before and after generation themselves and must check error/timeout fields even on HTTP 200 responses.
Governance
Who approves, reviews and stays accountable for outcomes?
Retention of flagged payloads and the benchmark ban should be reviewed by counsel and records officers before contracting.
Security and privacy
What data, permissions and controls need testing?
Malicious-flagged prompts, which may include regulated data, are retained up to 10 years; SDK debug logging can expose most of an API key in released versions.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Python is the only official SDK, so teams using other languages must build their own clients.
Procurement
What should contracts, pricing and exit terms secure?
No public pricing; capacity sold in minimum 1-billion-token monthly credit blocks through sales. Budget forecasting for pilots is harder for small entities.
Operating model
Which teams own the service once it runs?
Teams need monitoring for silent detector failures and a key-rotation routine; status-page incidents should feed operations.
Publication history
- 2026-11-04Palo Alto Networks · Issue 063 resources
Stable resource ID: anchorterminal-prisma-airs-runtime-api-independent-grade-c-20261102