Aim vs Protect AI is no longer a startup-versus-startup choice: both companies were acquired in 2025. Aim Security now ships as Cato AI Security inside Cato Networks’ SASE platform, and Protect AI’s technology now ships inside Palo Alto Networks’ Prisma AIRS. Pick Aim for workforce AI governance; pick Protect AI for model scanning and red teaming.
Palo Alto Networks closed its Protect AI acquisition on July 22, 2025. When it signed the agreement, it valued the deal at $700.0 million in cash and replacement awards, subject to adjustment, according to its quarterly SEC filing. Cato Networks announced its purchase of Aim on September 3, 2025, calling it Cato’s first acquisition. Cato did not disclose the price; Calcalist estimated it at $300 million to $350 million in cash and shares and reported that Akamai and Check Point had also bid. Protect AI’s website now redirects to the Prisma AIRS product page, and Cato markets Aim’s capabilities as Cato AI Security. The practical comparison is between two platform modules with different starting points. Aim began at the employee and agent edge. Protect AI began at the model supply chain.
What happened to Aim Security and Protect AI?
Both were absorbed into larger network-security vendors in the second half of 2025. Protect AI became part of Palo Alto Networks’ Prisma AIRS platform in July 2025. Aim Security became part of Cato Networks in September 2025 and returned to market as Cato AI Security in March 2026. The key dates:
- October 22, 2024: Hugging Face integrated Protect AI’s Guardian as a third-party scanner on public Hub repositories (Hugging Face).
- April 28, 2025: Palo Alto Networks announced a definitive agreement to acquire Protect AI, signed the previous day, alongside the launch of Prisma AIRS (Palo Alto Networks).
- July 22, 2025: Palo Alto closed the deal. Protect AI CEO Ian Swanson became VP, Product, Prisma AIRS (Palo Alto Networks).
- September 3, 2025: Cato Networks announced it had acquired Aim Security. Cato said customers could deploy Aim immediately and that its capabilities would join the Cato SASE Cloud Platform in early 2026 (SecurityWeek).
- October 2025: Prisma AIRS 2.0 shipped. Palo Alto said the release completed the native integration of Protect AI (Help Net Security).
- March 17, 2026: Cato made Cato AI Security generally available, as a standalone product or alongside its SD-WAN, SSE and universal ZTNA services (Network World).
- July 9, 2026: Protect AI’s open-source LLM Guard repository was archived and marked as no longer maintained (GitHub).
How do Aim and Protect AI compare side by side?
Aim’s lineage is strongest at governing how employees and agents use AI. Protect AI’s lineage is strongest at securing the models and applications an organization builds. Both now claim runtime protection for homegrown apps and agent security, so the overlap is real. The table reflects vendor documentation and independent reporting, not hands-on testing.
| Aim Security (now Cato AI Security) | Protect AI (now in Prisma AIRS) | |
|---|---|---|
| Acquirer | Cato Networks | Palo Alto Networks |
| Deal date | Announced September 3, 2025 | Closed July 22, 2025 |
| Price | Undisclosed; $300M to $350M per Calcalist | $700.0M agreed, per SEC filing |
| Original focus | Employee AI use, private AI apps, AI-SPM | Model scanning, red teaming, runtime |
| Shadow AI discovery | Core use case at acquisition | Agent discovery added in Prisma AIRS 2.0 |
| Model file scanning | Internal model scans for misconfigurations and vulnerabilities | Core: deserialization, backdoors, malicious code |
| Automated red teaming | Not described in cited sources | Named module; 500+ attacks per Palo Alto |
| Runtime protection | Aim AI Firewall | AI Runtime Security |
| Delivery | Cato SASE, or standalone | Prisma AIRS; network and API intercept modes |
| Open source | None cited | ModelScan (Apache-2.0); LLM Guard (archived) |
| Public research | EchoLeak, CVE-2025-32711 | huntr bounty program; Hugging Face Hub scanning |
Where Aim leads: the AI your workforce uses
Aim built its product around three use cases, which Help Net Security described at the time of the acquisition. The first was discovering shadow AI and protecting employee interactions with public AI apps, including Microsoft Copilot, Cursor and local agents connected to Model Context Protocol (MCP) servers. The second was the Aim AI Firewall, which enforces security and governance policy on interactions between users, agents and models in internal applications, on premises or in the cloud. The third was AI security posture management across the development lifecycle.
Under Cato, that stack runs where the traffic already passes. Cato said at the March 2026 launch that Cato AI Security shares a policy engine with the rest of its SASE platform, and that a companion product, Cato Neural Edge, places Nvidia GPUs across more than 85 points of presence to run inspection models inline, Network World reported. For an organization already routing users through Cato, that means AI governance without a new enforcement point. A standalone option exists for everyone else, but the platform argument weakens outside the Cato estate.
Aim’s research arm also carries weight in procurement. Aim’s research team uncovered EchoLeak, CVE-2025-32711, a zero-click prompt injection in Microsoft 365 Copilot. A case study on arXiv by Pavan Reddy and Aditya Sanjay Gujral documented the chain: a single crafted email that evaded Microsoft’s XPIA classifier, bypassed link redaction, and exfiltrated data through auto-fetched images and a Microsoft Teams proxy allowed by the content security policy. Indirect prompt injection of that kind sits under LLM01 in the OWASP Top 10 for LLM Applications, and it is the attack class any runtime product in this comparison should be tested against.
Where Protect AI leads: the AI you build
Protect AI started at the model supply chain. Its Guardian scanner checks files in public Hugging Face Hub repositories for pickle, Keras and other serialization exploits, according to Hugging Face’s documentation. Hugging Face reported in April 2025 that Guardian had scanned 4.47 million unique model versions across 1.41 million repositories and found 352,000 unsafe or suspicious issues across 51,700 models. The same post said Guardian flagged CVE-2025-1550, a Keras custom-layer flaw, before public disclosure, and drew on reports from a huntr bounty community of more than 17,000 researchers.
Palo Alto said Protect AI’s technology and team would be a cornerstone of Prisma AIRS, and that the combination brought together model scanning, posture management, AI red teaming, runtime protection and AI agent security. The Prisma AIRS product page now describes AI Model Security as scanning third-party models for tampering, malicious scripts and deserialization attacks, alongside AI Red Teaming, AI Runtime Security, Agent Security, AI Posture Management and an AI Gateway. At the 2.0 launch, Palo Alto said red teaming ran more than 500 specialized attacks and that model analysis produces an ingredients list covering architecture, training datasets, open-source licenses and dependencies, Help Net Security reported.
The trade-off is open source. ModelScan, the Apache-2.0 serialization scanner covering pickle, H5 and SavedModel formats, remains public. LLM Guard, the MIT-licensed prompt and output toolkit with 15 input scanners and 21 output scanners, was archived on July 9, 2026, and its README states that it is no longer under active development.
Which should you pick: Aim or Protect AI?
The installed network-security platform usually decides it, then the dominant risk. Prisma AIRS fits Palo Alto customers securing models and AI applications they build. Cato AI Security fits Cato customers governing employee and agent AI use. Where neither platform is in place, start from the risk:
- Data leaving through ChatGPT, Copilot, coding assistants or MCP-connected agents. Cato AI Security. Aim built for this use case first.
- Open-weight model downloads or in-house fine-tuning. Prisma AIRS. Protect AI’s model-file scanning has a public track record at Hugging Face scale.
- Continuous pre-release red teaming. Prisma AIRS. Automated red teaming is a named module; the Cato sources cited here do not describe an equivalent.
- Existing Palo Alto firewalls or Prisma Access. Prisma AIRS, deployable in network intercept or API intercept mode.
- Existing Cato SASE. Cato AI Security, which shares context with the SASE policy engine already inspecting user traffic.
Mapping each vendor’s claims onto a framework before signing is cheaper than finding gaps afterward. The comparison of NIST, OWASP and MITRE ATLAS shows how those documents divide the work.
What defenders should do
- Within 30 days, if you hold a standalone Aim or Protect AI contract, get the migration path and end-of-support date for the original product in writing from Cato or Palo Alto before the next renewal.
- Within 90 days, replace or fork any production dependency on LLM Guard. The repository is read-only and will receive no further security fixes from the maintainer.
- Before any third-party model enters a pipeline, gate it on a serialization scan. Hugging Face shows Guardian results on public repository files, and ModelScan can run in CI. Load untrusted pickle files only in isolated environments.
- In every proof of concept, include an indirect prompt injection test modeled on EchoLeak: a crafted email or document pulled into an assistant’s context. Score each vendor on detection and on blocking exfiltration through rendered links and images.
- Before signing, map each vendor’s claimed coverage to the OWASP LLM Top 10 and record which categories have no control at all.
FAQ
is aim vs protect ai still a real comparison in 2026?
Yes, but only as a comparison of platform modules. Aim Security is sold as Cato AI Security, generally available since March 17, 2026, and Protect AI’s technology lives inside Palo Alto Networks’ Prisma AIRS. Buyers evaluating either one are choosing a network-security vendor’s roadmap, not an independent startup’s product.
who bought protect ai and for how much?
Palo Alto Networks bought Protect AI. It signed a definitive agreement on April 27, 2025, for total consideration of $700.0 million in cash and replacement awards, subject to adjustment, according to its SEC filing. The acquisition closed on July 22, 2025, and the Protect AI team joined the Prisma AIRS group.
who acquired aim security?
Cato Networks acquired Aim Security and announced the deal on September 3, 2025, as the SASE vendor’s first acquisition. Cato did not disclose the price; Calcalist estimated it at $300 million to $350 million in cash and shares. Aim co-founder Matan Getz was Cato’s VP of AI security at the March 2026 product launch.
is protect ai guardian still scanning hugging face models?
Yes. Hugging Face’s current Hub documentation lists Protect AI’s Guardian as a third-party scanner that checks files in public repositories for pickle, Keras and other exploits. Scan reports appear on individual file pages. Hugging Face runs its own internal scanning, including picklescan, alongside Guardian, so a clean Guardian result is one signal, not a guarantee.
does cato ai security work without cato sase?
Yes. Network World reported at the March 2026 launch that Cato AI Security can operate as a standalone product or alongside Cato’s SD-WAN, SSE and universal ZTNA services. The integration benefits Cato cites, including a shared policy engine and inline GPU inspection at its points of presence, apply most fully to platform customers.
