AI red teaming tools: which one fits your team, what it checks and what it costs (October 2026)

How I read the six

Every claim below comes from a vendor or project page. I took no number from comparison blogs or review sites, and I dropped every statement that one tool finds more weaknesses than another, because I found no vendor benchmark or study that I could verify.

Some pages gave me nothing. Mindgard's documentation addresses redirected to its homepage, Giskard's trust center showed only a title, and Lakera's pricing page was empty. EUR-Lex returned no readable text for the EU AI Act or the GDPR, so I cite no article numbers. I left out Microsoft's PyRIT: it is not in our directory, its original repository was archived on March 27, 2026 with a pointer to microsoft/PyRIT, and I did not read its documentation.

Sources: [1][2][3]

Who runs the attacks decides most of the shortlist

For the 25-person company the first decision is who runs the attacks: an engineer with a package, or a vendor with a dashboard. The helper below asks four short questions and ends on the tools whose pages I read. It narrows a list from published terms and does not rank quality. What this means for you: the first answer alone removes about half of the list.

Sources: [4][5][6]

Five tools name prompt injection, jailbreaks and leakage; four name hallucination

garak, promptfoo, Giskard, DeepTeam and Lakera name prompt injection, jailbreaks and leakage of data or system prompts on a primary page. Mindgard's homepage and pricing page name none of these. They describe stages (Recon, Attack, Remediate, Assure) and what gets probed, such as guardrails, agents and tools, and I read no category list. Lakera Red has 23 default objectives, and jailbreaks are not one of them: they are an attack strategy next to prompt injection, multi-language and multi-turn.

Hallucination is named less often. garak lists it, with a probe called packagehallucination. promptfoo lists it as a model-layer risk, Giskard's Hub names hallucinations, and Lakera Red has it among its 11 Responsible objectives. DeepTeam's vulnerability list names Misinformation, not hallucination, and Mindgard names neither. If your support bot quotes a wrong refund rule, read this row first.

OWASP's Top 10 for LLM Applications 2025 is the common yardstick: prompt injection is LLM01, sensitive information disclosure LLM02, system prompt leakage LLM07 and misinformation LLM09. Giskard, promptfoo and DeepTeam all point to the OWASP lists. What this means for you: pick the tool whose list contains the failure you fear, then run it against your own app, because naming a category says nothing about how deep the coverage goes.

Sources: [7][8][9][10][11][12]

Four tools cost $0 for 5 or 25 people, and nothing scales with seats

The table is my own measurement: license, list price for 5 and for 25 people over one year, where the tool runs and what the report looks like, read from vendor and project pages on October 30, 2026. Click a column to sort.

The money goes elsewhere. An LLM generates and grades the attacks, and promptfoo's docs put a single run anywhere between a few cents and hundreds of dollars, depending on the strategies. DeepTeam's docs say the same about their design: LLMs both generate the attacks and evaluate the outputs, and the default setup asks for an OpenAI key.

promptfoo's Community plan caps red teaming at 10,000 probes a month, one probe being a single request to your target. If a run sends 500 requests (my assumption, the docs give no count), the cap covers 20 runs.

The one per-organization price I found among the free tools is Confident AI, the platform behind DeepEval and DeepTeam. Starter is $200 a month and Team $2,000, both with unlimited seats, so 5 or 25 people cost the same: $2,400 a year for Starter at the monthly price. Its pricing page lists the AI red teaming module under Enterprise++, not under Starter or Team.

On ownership, promptfoo's README states "Promptfoo is now part of OpenAI" and that the project stays MIT licensed. OpenAI's own announcement returned a 403 and I did not get around it, so I rely on that README wording. What this means for you: the license bill for self-run tools is zero at any team size, so budget the attacker model's API usage and an engineer's time, and treat Mindgard and Lakera as quote-only.

Sources: [7][6][8][13][14][5][15][16][17][18]

Where your test prompts and answers go

garak runs as Python on your machine and sends prompts to the model you point it at. Its README names no other data flow. Giskard's open-source scan needs an LLM provider for generating and judging, and its docs do not say where data goes. The homepage says the Hub can be hosted in the EU or US or installed on-premises and states a 0-training policy.

promptfoo is the one with a documented split. The evaluation of your target runs locally. Telemetry is on by default and excludes prompts, outputs and test cases, and PROMPTFOO_DISABLE_TELEMETRY=1 turns it off. Attack generation is different: the red team configuration page says a remote service generates attacks by default, that without an OpenAI key requests are proxied to Promptfoo's API for generation and grading, and that PROMPTFOO_DISABLE_REDTEAM_REMOTE_GENERATION=true switches it off, at the price of weaker attacks from a local model.

The same page also says generation and grading use your own OpenAI key by default. I read it as: key set, your key; no key, Promptfoo's API. No page states it in one place.

DeepTeam's docs say the framework runs locally, but they also say LLMs generate the attacks and judge the answers, with OPENAI_API_KEY required in the default setup, so prompts and answers reach that provider. After deepteam login, results go to Confident AI automatically, and the page does not describe retention. Lakera Red is a SaaS. Its networking page says the backend runs on Convex in AWS us-east-1, calls your target by outbound HTTPS, needs the target reachable from the public internet and supports no PrivateLink, VPC peering or run inside your own VPC. A full scan sends thousands of prompts, often in parallel, so check rate limits first. My article on LLM gateways covers what gateways cap. Lakera's EU, US and Singapore regions cover AI Guardrails only, not Red.

Mindgard's pages say nothing about data handling or deployment. What this means for you: if prompts can contain customer data, use synthetic test data with every tool, and ask the two quote-only vendors in writing where scans run and what they store. I left out EU AI Act and GDPR article numbers on purpose, because I could not check them against the law text.

Sources: [7][19][20][21][22][13][15][4][23]

Effort to a first run: one command or one sales call

I counted what each tool asks for before a first scan, not how long it takes, because no page gives a time. What this means for you: the four open-source tools need a package install, the two hosted services need a conversation with sales or a Check Point account first.

Sources: [24][13][15][9][25][17]

Where the sources disagreed

Our directory entry for Lakera describes a free entry through the platform. The homepage has a "Start for free" button that leads to the platform, but the pricing link goes nowhere, the red teaming docs require a Check Point account with Red access, and no page names a free tier for Red. I corrected the entry to say no price is published. I also added the hosting detail: Red runs on AWS us-east-1, the EU region applies to Guardrails.

Two more entries needed a line: DeepEval's does not say that red teaming lives in the separate DeepTeam package, and promptfoo's lacks the 10,000 probe cap. DeepTeam's own sources disagree with each other: GitHub says 50+ vulnerabilities and 20+ attack methods, the docs say 40+ and 10+. I quote both and use neither as a quality signal.

Sources: [26][25][16][10][15]

Who each tool is not for

For the 25-person company in my example, and as a list of limits rather than a ranking, my rule is short: if the chatbot is reachable from the internet and you can spare an engineer, run garak or promptfoo first, with synthetic data, and read the hit log before you ask any vendor for a quote.

Sources: [22][7][9][4]