Red-team the AI your hospital or agency runs. Hand your auditor the evidence.
RedLens runs the real adversarial attacks used against production AI, then documents every finding as evidence mapped to the controls your auditors actually ask about: HIPAA, NIST AI RMF, OWASP GenAI Top 10, MITRE ATLAS, ISO/IEC 42001, FBI CJIS Security Policy and AIUC-1. Find the gaps, watch them live, hand over the evidence. One taxonomy, end to end.
Of organizations breached via their AI models or apps
Healthcare is the costliest sector for data breaches. The AI-enabled share (up 56% year over year, $6M average cost) and the AI-targeted share are cross-industry figures, so the three measure different things. Source: IBM 2026 Cost of a Data Breach Report.
Tell RedLens about the AI your organization uses: patient chatbots, diagnostic tools, dispatch AI, internal copilots. We build a threat model specific to your deployment.
02
RedLens attacks your AI
Our engine fires real adversarial attacks from the Master Attack Schema v2.0: 6 categories and 22 methodologies, each scored by CVSS. Prompt injection, containment escapes, data exfiltration, and more.
03
A report your board can read
A PDF with your risk score, every vulnerability found, remediation steps, and every finding mapped to HIPAA §164.x, NIST AI RMF, OWASP LLM Top 10 (2026) and MITRE ATLAS. The evidence package adds ISO/IEC 42001, FBI CJIS Security Policy and AIUC-1. Auditor-ready in minutes.
Evidence, not assurance
Mapped to the controls your auditors actually ask about
Every finding lands on the frameworks below, read from the same tables the product uses in the dashboard, the evidence package and the copilot. A mapping means recorded evidence is relevant to a control. It never means the control is satisfied, and RedLens never certifies compliance.
Per finding · Evidence package
HIPAA Security Rule (45 CFR Part 164)
Citation-level, not "supports HIPAA": §164.308(a)(1) risk analysis, §164.312(b) audit controls, §164.312(d) authentication, on the findings they bear on.
Per finding · Evidence package
NIST AI Risk Management Framework 1.0 (NIST AI 100-1)
GOVERN, MAP, MEASURE and MANAGE subcategories by id (GV-1.1, MS-2.5, MG-1.3), so a finding traces to the function it informs.
Per finding
OWASP GenAI LLM Top 10 (2026)
LLM01 through LLM10 with the edition named every time, because LLM03 has meant three different things across the 2023, 2025 and 2026 lists.
Per finding
MITRE ATLAS™ (2026.07)
Real technique ids on the findings they fit: AML.T0051 prompt injection, AML.T0054 jailbreak, AML.T0056 system-prompt extraction, AML.T0057 data leakage. Small and defensible, not a forced matrix.
Evidence package
ISO/IEC 42001:2023 AI Management System (Annex A controls)
Annex A controls your recorded testing is relevant to, as evidence toward your AIMS audit. Certification is of your organization, never of a tool.
Evidence package
FBI CJIS Security Policy (CJISSECPOL v6.1, cross-referenced to v5.9.5)
Control ids read from the policy PDFs themselves, with priority and sanction dates. The FBI certifies no vendor as CJIS compliant and RedLens holds no CJIS authorization: this is audit evidence for your CSO.
Evidence package
AIUC-1 AI Agent Standard (Q2 2026 revision)
Requirement ids and titles with linkouts to the standard. No vendor is AIUC-1 certified by running a scan, and this mapping does not confer one.
Every control reads evidence recorded, partial evidence, or no evidence recorded on this platform. Never a checkmark.See the mappings on the sample report →
These are real screens from a live RedLens deployment, not mockups.
Live risk dashboard
Scan volume, confirmed vulnerabilities, and a composite risk score, updated as attacks run.
Every finding, scored
Confirmed vulnerabilities land with a severity rating and CVSS score, ready to route to your team.
Auditor-ready evidence
One-click compliance packages mapped to HIPAA, NIST AI RMF, and ISO/IEC 42001. Every control reads evidence-recorded, partial, or gap, never just a checkmark.
Continuous Monitoring & Alerts
A one-time scan tells you today's answer. RedLens keeps asking.
Prompts change, models get swapped, new attack classes get published. Scheduled re-testing catches drift automatically, critical findings alert your team the moment they're confirmed, and a daily-refreshed threat feed keeps you current. No one has to remember to log back in.
Scheduled Drift Detection
Put a system prompt on a daily or weekly retest cycle. Every run replays the identical adversarial suite against the identical prompt and models. The moment a dimension regresses, you're emailed exactly what changed.
Daily or weekly cadence, frozen prompt and models per schedule
Every regression, improvement, or lost signal named explicitly
A failed run retries within hours, so monitoring never goes silently quiet
Real-Time Critical Alerts
The moment a scan, vendor assessment, blast-radius map, PHI egress check, or prompt-hardening run turns up a critical-severity finding, RedLens emails your team automatically. No one has to remember to check the dashboard.
Per-user preferences, on by default for critical severity
Every send is logged and auditable, whether it was delivered, suppressed, or failed
Live Threat Intelligence
A feed of real-world AI security incidents, refreshed daily from CISA, NIST, and other security research sources, keeps your team current on the attack classes making news right now. It is the same feed driving the banner at the top of this page.
Refreshed daily, no manual curation required
Every record mapped to a Master Attack Schema category
Powers the live banner here and the full Threat Intel feed
Every one of these can also stream straight into your SOC. See SIEM export and CI/CD below.
Master Attack Schema v2.0
Every known AI attack vector. Tested.
Built from documented real-world incidents. Updated continuously. Category 6 added July 2026 in response to the Anthropic breach.
APE · Instruction Layer
Adversarial Prompt Engineering
Can an attacker override your AI's instructions and make it behave as an unrestricted system? Instruction override, privilege escalation via roleplay, payload splitting.
CWE · Memory / RAG Layer
Context Window Exploitation
Can an attacker poison your AI's memory or inject malicious instructions into your knowledge base? Conversation poisoning, RAG pipeline attacks, context overflow.
OOB · Safety / Filter Layer
Safety Filter Evasion
Can an attacker bypass your AI's safety guardrails using obfuscation, encoding, or gradual boundary erosion? Semantic obfuscation, encoding substitution, low-and-slow attacks.
ATA · Agentic / API Layer
Agent and Tool Abuse
If your AI can take actions like sending email, querying databases, or calling APIs, can an attacker hijack those actions? Indirect prompt injection, tool chain hijacking.
DEI · Data / Training Layer
Data Exfiltration & Inversion
Can an attacker extract your system prompt, reconstruct training data, or surface PII? System prompt extraction, training data reconstruction, embedding space probing.
ACE · Agent Runtime NEW
AI Containment Escape
Can your AI agent break out of its sandbox? Root cause of the July 2026 breach. Network escape, behavioral deviation, micro-step attack chains: attack patterns your current tools cannot see.
The Platform
One console, from first attack to live traffic
The scanner finds the vulnerabilities. The rest of the platform turns them into hardened prompts, least-privilege agents, auditor evidence, and a briefing your directors can read. Now it also turns them into runtime rules that watch for the same attack coming back.
Core · Red Team Scanner
Adversarial Attack Engine
Real attacks from the Master Attack Schema v2.0: 6 categories and 22 methodologies, every finding scored by CVSS and mapped to HIPAA, NIST AI RMF, OWASP LLM Top 10 (2026) and MITRE ATLAS.
Third-Party Risk · TPRM
Vendor AI Assessment
Black-box security testing of the AI vendors in your stack. Every target requires recorded vendor-side authorization before any attack traffic is sent. The output is a Vendor AI Safety Scorecard.
Runtime · Preview
Runtime Guard
The last stage of the same loop, not a second product: the findings the scanner already confirmed become per-tenant runtime rules, and every verdict names the finding whose rule fired and reports it in the evidence pack's own evidence / partial / gap wording. Observes and flags today; blocking is gated. Follow one finding through all five stages →
Healthcare · HIPAA
PHI Egress Scan
First-pass triage of the data flowing to your AI vendors: pattern-based detection of PHI-shaped content, flagged when it heads to a vendor with no BAA on file. It is a signal for compliance review, not a determination.
Pre-Deployment
Prompt & Guardrail Hardener
Score a system prompt's robustness before it ships: a free static analysis for instant gap-spotting, or a full adversarial red-team that attacks the prompt empirically and reports what broke.
Agentic AI
Blast Radius Mapper
Ingest your agent's tool schema in OpenAPI, Anthropic, or OpenAI format, and see what a hijacked agent could actually reach: attack chains, excessive permissions, and an auditable blast-radius score.
Agentic AI · OWASP
Excessive Agency Test
The OWASP LLM Top 10 (2026) least-privilege check: declare an agent's task and every tool it can reach, inject an adversarial instruction, and measure how much out-of-scope capability it holds.
Compliance
Evidence Packages
Point-in-time, auditor-ready records of what your testing actually captured, mapped to HIPAA, NIST AI RMF, ISO/IEC 42001, the FBI CJIS Security Policy and AIUC-1. Every control reads evidence-recorded, partial, or gap. RedLens documents evidence; it never certifies compliance.
Executive Reporting
Boardroom Risk Translator
Turns confirmed findings into a plain-language briefing for directors. Every risk statement cites, and is grounded in, real findings from your own scans, never generic boilerplate.
Visibility
Shadow AI Discovery
Passive detection of unmapped AI models and agentic calls in your outbound traffic. The LLM your security team doesn't know about is the one that never got tested.
Integrations · SIEM & CI/CD
SIEM Export & Build Gate
Findings stream to Splunk (HTTP Event Collector), SentinelOne, Devo or a signed webhook, field-parsed next to the rest of your telemetry. Scans run from your pipeline through the CLI and gating API, failing the build at your threshold. All integrations →
Fits the pipeline and the SOC you already run
Findings where your team already works
A finding nobody sees is a finding nobody fixes. RedLens gates the build in CI, streams to the SIEM your SOC already watches, and emails the people on call.
CI/CD · Build gate
Fail the build on what the attack found
A dependency-free Python CLI and a per-tenant API key run a scan from any pipeline. Set the severity threshold and the step exits 0, 1 or 2 the way Trivy and Snyk do, so a real finding and a broken scan are never confused. SARIF output lands straight in GitHub code scanning. A GitHub Action wraps the CLI; it ships from RedLens today ahead of a Marketplace listing.
redlens scan --config scan.toml --fail-on high --format sarif
SIEM · SOC export
Splunk, SentinelOne, Devo, or your webhook
Findings stream field-parsed to Splunk over HTTP Event Collector, to SentinelOne Singularity Data Lake, to Devo as CEF over syslog, or to any HMAC-signed webhook, so AI risk is searchable next to the rest of your telemetry instead of in one more dashboard.
Alerts · Evidence · Reports
Email on critical, PDF for the auditor
Critical findings from scans, vendor assessments, PHI egress checks, blast-radius maps and prompt-hardening runs email your team automatically, with every send logged. Evidence packages and scan reports export as point-in-time PDFs.
Deployment · Partners
SaaS with a BAA, on-premise Docker, or through your MSSP
Hosted on Railway with a HIPAA BAA available on request; self-hosted on-premise Docker for agencies that need data residency (your data stays on your hardware; attack generation and judging still call Anthropic's API with your own key); and an MSSP console with per-client isolation and partner-branded client reports.
Not on the platform today, so you are not left guessing: Slack or Teams alert channels, a Splunkbase app, a PyPI package for the CLI, data-loss-prevention breadth, employee shadow-AI governance, model-file scanning, and content moderation.
Industries
Protecting the organizations that cannot afford to fail
Healthcare and law enforcement AI deployments handle life-critical decisions. A vulnerability is not an inconvenience. It is a patient safety event or a civil rights violation.
Healthcare
Hospitals, health systems, and healthcare AI vendors deploying AI for patient care, clinical decision support, and administrative automation.
EHR automation agents with high-privilege database access
The AI security market has consolidated fast: four of RedLens's closest peers were acquired by Palo Alto Networks, Cisco, Check Point, and F5 in the last two years. All of them run some form of AI red teaming or model scanning. None of them were built around healthcare compliance. RedLens was, and it maps to MITRE ATLAS, NIST AI RMF, OWASP and AIUC-1 alongside HIPAA and CJIS, so choosing the healthcare-native tool does not cost you the general frameworks.
Healthcare-first is not healthcare-only. RedLens goes deepest in healthcare, with HIPAA mapped control by control, and that depth is the standard for every segment it covers. The same attack engine, evidence packages and compliance mapping also cover law enforcement (FBI CJIS Security Policy) and legal, financial services and other regulated enterprise deployments. The table above scores depth in regulated-sector compliance, not breadth of industries served.
Cisco AI Defense — red teaming: its "algorithmic red teaming" leans toward automated scanning rather than adaptive, human-style red-teaming.
Microsoft Defender — HIPAA: the Regulatory Compliance Dashboard maps general Azure infrastructure controls to HIPAA, not AI/LLM-specific controls.
CrowdStrike — HIPAA: the core Falcon platform is Coalfire-validated against eight key HIPAA technical requirements — the EDR platform, not a per-control public evidence grid for the AI product.
HiddenLayer — HIPAA: generic marketing — "controls that support HIPAA compliance" and "HIPAA, HITRUST, and emerging AI governance requirements" — with no §164.x citations.
Palo Alto Prisma AIRS — HIPAA: healthcare is named as a served industry in acquisition materials only; no HIPAA control mapping appears on product pages.
Cisco AI Defense — HIPAA: says it can "help address the new HIPAA Security Rule standards" and is positioned for regulated sectors including healthcare — but with no §164.x detail.
Lakera — HIPAA: no HIPAA-specific language found on lakera.ai or checkpoint.com/ai-security.
CalypsoAI / F5 — HIPAA: the most explicit of the generic group — "automated auditing templates for GDPR, HIPAA, EUAIA, and more"; "security rules align with HIPAA, GDPR, FDA" — but still no citation-level mapping.
Mindgard — HIPAA: no HIPAA mention; maps to MITRE ATLAS, NIST, OWASP, and AIUC-1. RedLens maps to those four as well, alongside HIPAA, ISO/IEC 42001 and the FBI CJIS Security Policy.
Dedicated healthcare page: CrowdStrike, HiddenLayer, and CalypsoAI/F5 each publish a healthcare page, but none was built healthcare-first the way RedLens was, with HIPAA mapped control by control. RedLens applies that same depth to law enforcement (FBI CJIS) and to legal and other regulated enterprise deployments; see the note above the footnotes.
Cisco AI Defense — self-serve: offers an "Explorer Edition" self-serve trial, which likely requires signup.
HiddenLayer, Palo Alto Prisma AIRS (formerly Protect AI; reportedly ~$500–700M, an unofficial press estimate — the figure was never officially disclosed, closed July 2025), Cisco AI Defense (formerly Robust Intelligence, ~$400M, closed September 2024), Lakera Guard (acquired by Check Point for a reported ~$300M, an unconfirmed press estimate, announced September 2025), and CalypsoAI (acquired by F5 for $180M, closed September 2025) are all genuine, capable AI red-teaming or runtime-protection platforms. None map findings to HIPAA, NIST AI RMF, or OWASP the way RedLens does. Credo AI is worth a separate mention too. It is the closest adjacent player on compliance, but built for governance and oversight rather than running attacks against your AI.
Pricing
Simple, transparent pricing
Every plan includes a free assessment so you see exactly what we find before you commit to anything.
Every plan includes the full Master Attack Schema, every finding mapped to all seven frameworks, the evidence package, PDF reports, email alerts, SIEM export and the CI/CD build gate. Plans differ only in the limits below, and each one is enforced in the platform, not just written here.
Team
$199/mo
For small teams that want hosted red-team scans on a real budget, without a procurement cycle.
25 hosted scans a month, 5 a day, 1 AI asset under test, judged by Claude Haiku 4.5. Verify your work email to run your first scan. When the free tier's monthly budget is spent, new scans queue and run when it resets.
Every plan starts with a free AI security assessment. No credit card required to try it · Enterprise starting at $150k/yr, custom pricing for complex deployments
Common Questions
What your security team and legal counsel will ask
Do you have a SOC 2 certification?
We are in the process of SOC 2 Type II certification: the audit begins Q2 2027 and certification is targeted for Q4 2027. Our infrastructure runs on Railway (SOC 2 Type II certified) and Anthropic (SOC 2 Type II certified).
How is RedLens different from CrowdStrike or Microsoft Defender?
Microsoft Defender only covers Azure-hosted AI. CrowdStrike finds misconfigurations. RedLens runs actual adversarial attacks against your AI and shows you exactly how it responds. Neither competitor does this.
Are findings mapped to MITRE ATLAS or the CJIS Security Policy?
Yes, as evidence. Findings carry MITRE ATLAS technique ids (v2026.07) alongside HIPAA, NIST AI RMF and OWASP GenAI Top 10 (2026). The evidence package adds ISO/IEC 42001 Annex A, FBI CJIS Security Policy v6.1 controls and AIUC-1 requirements, each marked evidence recorded, partial, or gap. The FBI certifies no vendor as CJIS compliant and RedLens holds no CJIS authorization; the mapping is audit evidence for your CJIS Systems Officer, not a certification.
Does RedLens run in our CI/CD pipeline?
Yes. A dependency-free Python CLI and a per-tenant API key run a scan from any pipeline and fail the build at your severity threshold, with SARIF output for GitHub code scanning. A GitHub Action wraps the CLI; it is available from RedLens today and is not yet listed on the GitHub Marketplace.
Can RedLens run on-premise in our own environment?
Yes, as an on-premise deployment, not an air-gapped one. The self-hosted Docker package on the Enterprise tier keeps your prompts, scan results, findings, users and reports in your own Postgres on your hardware; RedLens has no access to it. One thing still leaves your network: attack generation and judging call Anthropic's API using your own Anthropic key, under your account's terms. Every other outbound destination can be firewalled off. If your requirement is that no packet leaves the building, this package does not meet it today.
Get Started
Your AI is live. Is it secure?
Run a free assessment in 10 minutes. See exactly what an attacker would find in your AI deployment today, right now, with no account required.
Original writing on AI security from the people building the platform: agentic risk, red-team findings, and the advisories worth reading in full. A few times a month at most, no sales sequence, and one click to leave.
