Appendix B · Coverage & Vendors
Who Are The Competitors and What Are Their Agentic Risk Coverages?
Five vendor profiles and their red-team-only OWASP Agentic Top 10 coverage matrix. All coverage claims are sourced to specific vendor-published capabilities (e.g., Tech Docs, Website).
B1 — Vendor Profiles
The five competitors in scope.
Each vendor's product capabilities are described, followed by an explicit scope note. This analysis covers Automated Agentic Red-Team capabilities only.
Adversa
Pure Play
Continuous red teaming and remediation for the custom AI agents your business runs on. Runs autonomous red teaming campaigns on every model update, prompt change, and new tool connection — red teaming is the entire product.
Active OWASP contributor: co-leads the CoSAI Agentic AI Security workstream and serves as a core member of OWASP AIVSS; but not a direct shaper of the OWASP Agentic Top 10 framework.
Scope: Specialized in AI red-teaming - all capabilities included.
8 / 10 ASI (Red Teaming)
Lasso Security
Pure Play
AI security platform purpose-built for the agentic era, providing continuous discovery, AI risk assessment, red teaming, and runtime protection in one unified loop. Operate with no agents, no code changes, no source code access
Scope: Only the Red Teaming / Offensive Attack Simulation module is counted. AI-SPM, and Runtime Protection are excluded.
5 / 10 ASI (Red Teaming) · 7 / 10 full platform
NOMA Security
Pure Play
Enterprise-grade automated red teaming that continuously tests your AI models, agents, and applications against dynamic, evolving attack techniques. Unlike static attack libraries, Noma AI Red Team is itself an intelligent agent, building and adapting attacks based on the specific behavior of each application under test.
Scope: Only the AI Red Team module capabilities are counted. AI-SPM, and Runtime Protection are excluded.
5 / 10 ASI (Red Teaming) · 9 / 10 full platform
Palo Alto Networks (Prisma AIRS)
Stack
Agent Red Teaming builds on AI Red Teaming with a multiagent architecture that simulates real adversaries, testing how agents behave under conditions, such as tool misuse and manipulated inputs. Prisma AIRs is an extension to their existing services.
Scope: AI Red Teaming module only. This analysis scoped to capabilities-only — brand reputation, WebSocket connectivity, and profiling/recon features are excluded as non-ASI.
4 / 10 ASI (Red Teaming)
Microsoft Security (Azure AI Foundry)
Stack
The AI Red Teaming Agent is a powerful tool designed to help organizations proactively find safety risks associated with generative AI systems during design and development of generative AI models and applications. leverages Microsoft's open-source framework for Python Risk Identification Tool's (PyRIT) AI red teaming capabilities along with Microsoft Foundry's Risk and Safety Evaluations.
Expert Reviewer of the OWASP Agentic Top 10.
Scope: Azure AI Foundry AI Red Teaming module only.
6 / 10 ASI (Red Teaming)
B2 — Coverage Landscape
OWASP Agentic Top 10 Vendor Coverage Heatmap.
How many of the 5 vendors actively cover each ASI category.
Scope note: This view is red-team modality only. P (primary) = capability directly and evidentially maps to this ASI category. S (secondary) = inferred or adjacent link. Both P and S count toward the vendor score.
Saturated (5/5)
Moderate (3–4/5)
Thin (1–2/5)
Industry blind spot (0/5)
ASI01
Goal Hijack
5/5
ASI02
Tool Misuse
5/5
ASI03
Identity & Privilege
3/5
ASI04
Supply Chain
4/5
ASI05
Code Execution
2/5
ASI06
Memory & Context
5/5
ASI07
Inter-Agent Comms
0/5
ASI08
Cascading Failures
1/5
ASI09
Human-Agent Trust
0/5
ASI10
Rogue Agents
3/5
B3 — Findings From the Matrix
Four things the matrix alone doesn't surface.
Finding A · Directional Signal
Adversa is Fortify's most direct competitor; pure-play AI red teaming with the broadest OWASP Agentic Top 10 framework coverage.
Adversa all-in on AI red teaming capabilities. Every other vendor in this analysis builds red teaming as one capability inside a broader platform.
On the OWASP Agentic Top 10, Adversa maps to 8 of 10 ASI categories (7P | 1S) — the broadest coverage of any vendor in scope. They are the only vendor with evidenced red-team tooling for Cascading Agent Failures (ASI08); all four other vendors show zero coverage for this category.
On the OWASP Agentic Top 10, Adversa maps to 8 of 10 ASI categories (7P | 1S) — the broadest coverage of any vendor in scope. They are the only vendor with evidenced red-team tooling for Cascading Agent Failures (ASI08); all four other vendors show zero coverage for this category.
Finding B · Advertising Accuracy
Adversa and Lasso both claim "100% OWASP coverage" but evidentially misleading.
Both Adversa and Lasso Security advertises "100% OWASP Agentic AI + LLM Top 10 coverage." Adversa evidentially covers 8 of 10 ASI categories and Lasso covers 5 of 10.
Two frameworks are bundled into one claim. The OWASP LLM Top 10 (2023, single-model risks: prompt injection, insecure output handling, training data poisoning, etc.) and the OWASP Agentic Top 10 (2026, multi-agent systems: ASI01–ASI10) are distinct frameworks with different category sets. Vendors with strong LLM Top 10 coverage seem to claim "100% OWASP LLM & Agentic" by implying combined coverage — even if Agentic-specific coverage is partial.
"Risk coverage" has no agreed standards. Product page assertion and blog posts addressing concerns satisfy the buyers. Due to the novel nature of agentic AI security, the framework lacks objective standards.
Two frameworks are bundled into one claim. The OWASP LLM Top 10 (2023, single-model risks: prompt injection, insecure output handling, training data poisoning, etc.) and the OWASP Agentic Top 10 (2026, multi-agent systems: ASI01–ASI10) are distinct frameworks with different category sets. Vendors with strong LLM Top 10 coverage seem to claim "100% OWASP LLM & Agentic" by implying combined coverage — even if Agentic-specific coverage is partial.
"Risk coverage" has no agreed standards. Product page assertion and blog posts addressing concerns satisfy the buyers. Due to the novel nature of agentic AI security, the framework lacks objective standards.
Finding C · Market Pattern
The categories every vendor covers are the easiest to explain to buyers, not the most "dangerous" agentic risks.
Goal Hijack (ASI01) through Supply Chain Compromise (ASI04), and Memory & Context Poisoning (ASI06) coverages are saturated because buyers are already aware of these risks. Vendors are prioritizing what buyers are asking for. Additionally, these risks are partially covered through existing AI red teaming capabilities, making it easier to address.
On the other hand, there is a gap between Insecure Inter-Agent Communication (ASI07) and Human-Agent Trust Exploitation (ASI09) because buyers are not familiar with the concept yet. It does not mean these risks are low-impact. These risk categories are novel attack surfaces, and without interest, there's no market incentive to build tooling even if the technical barriers are solvable.
On the other hand, there is a gap between Insecure Inter-Agent Communication (ASI07) and Human-Agent Trust Exploitation (ASI09) because buyers are not familiar with the concept yet. It does not mean these risks are low-impact. These risk categories are novel attack surfaces, and without interest, there's no market incentive to build tooling even if the technical barriers are solvable.
See More
Appendix C, Section C1.
Finding D · Vendor Positioning
Palo Alto Networks explicitly positions ASI01–03 as the highest-priority risks for enterprise AI.
Palo Alto Networks identifies Goal Hijack (ASI01), Tool Misuse (ASI02), and Identity & Privilege Abuse (ASI03) as the highest-priority vulnerability classes for enterprise AI deployments. Their public positioning cites real-world agentic incidents (i.e. breached financial copilots, redirected coding assistants, hijacked enterprise workflows) as evidence that these three categories represent the core blast radius of commercial AI risk.
This is a deliberate depth-over-breadth strategy. Palo Alto Networks carries 4 primary-mapped capabilities across ASI categories. Their buyer hypothesis is that most enterprise AI incidents cluster in the identity, goal, and tool layers, and that validated depth there outperforms broader but shallower coverage. The OWASP Agentic Top 10 does not rank Goal Hijack, Tool Misuse, and Identity & Privilege Abuse (ASI01–03) above other categories in severity; Palo Alto's prioritisation is a market positioning claim, not a framework-endorsed finding — but it is grounded in documented incident patterns and carries real commercial weight for enterprise buyers in the Palo Alto ecosystem.
This is a deliberate depth-over-breadth strategy. Palo Alto Networks carries 4 primary-mapped capabilities across ASI categories. Their buyer hypothesis is that most enterprise AI incidents cluster in the identity, goal, and tool layers, and that validated depth there outperforms broader but shallower coverage. The OWASP Agentic Top 10 does not rank Goal Hijack, Tool Misuse, and Identity & Privilege Abuse (ASI01–03) above other categories in severity; Palo Alto's prioritisation is a market positioning claim, not a framework-endorsed finding — but it is grounded in documented incident patterns and carries real commercial weight for enterprise buyers in the Palo Alto ecosystem.
Evidence
Palo Alto Networks blog (March 2026): "Our coverage maps directly to the OWASP Top 10 for Agentic Applications (2026), which classifies Agent Goal Hijack as ASI01 and Tool Misuse as ASI02, the highest-priority risks for autonomous AI systems." Prisma AIRS release notes (June 2026): Privilege Misuse "aligns with... Identity & Privilege Abuse, a critical vulnerability class defined in the OWASP Top 10 for Agentic Systems."