Mindgard vs Noma Security (2026)

The red teamer attacks the customer's AI endpoints, chatbots and agents, with presets for OpenAI, Anthropic, Azure and Hugging Face targets and listed support for Docker and AWS, and it runs from CI/CD workflow integrations, the CLI and the Burp Suite extension. Targets are reached with the customer's own API keys, request templates and response selectors. Tests cover the prompts, memory, data sources, guardrails, MCP or A2A servers and permissions around an agent, not only the model.

SourceMindgard, mindgard.ai, /automated-ai-red-teaming and docs.mindgard.ai/user-guide/testing-via-cli; docs.mindgard.airead 2026-10-06

Discovery and governance cover homegrown, SaaS and endpoint agents and MCP servers, and policy is enforced through agent hooks, AI and MCP gateways, SDKs, direct APIs and the EDR or MDM a company already runs, at the moment a connection or action is attempted. Requests are masked or blocked at runtime.

On employee laptops Noma finds Claude Code, Claude Cowork, Cursor, Codex, Windsurf, Kiro, Antigravity and OpenClaw, with their MCP servers, skills, connectors and linked personal and enterprise accounts. Noma also connects to Claude's Compliance API and is offered inside the AWS Security Hub Extended console.

SourceNoma Security, noma.security/platform/agentic-access-control and the endpoint agent security post on noma.security/blogread 2026-10-06

The red teamer follows a fixed adversary workflow of reconnaissance, exploitation planning and execution, chaining one shot and multi step attacks, and its adaptive attack agents learn from each response and change tactics. The platform runs its four stages, Discover, Recon, Attack and Defend, again as systems change. Customers choose the targets, the attacks and the goal of a multi turn test, but they cannot build a flow of their own.

SourceMindgard, mindgard.ai, /automated-ai-red-teaming and docs.mindgard.ai/user-guide/testing-via-cliread 2026-10-06

The red teaming is done by Noma's own agents, which probe the customer's AI apps and agents and compound several techniques into one multi turn attack sequence, with escalating pressure at each step. The wider platform runs as a fixed pipeline of posture management, access control and runtime protection, with red team findings fed into the AI-DR runtime policies. The Agentic Risk Map brings discovery, posture and runtime together to show each agent's blast radius before deployment.

SourceNoma Security, noma.security/products/ai-red-teaming and /solutions/ai-agent-securityread 2026-10-06

Red teaming runs continuously as AI systems change and on pipeline runs through CI/CD workflow integrations, and runtime protection responds to attacks in production as they happen. Tests can also start from the web app, the CLI, the Python SDK, the Burp Suite extension or a single click.

SourceMindgard, mindgard.ai/automated-ai-red-teaming and docs.mindgard.ai/llms.txtread 2026-10-06

Runtime detection fires on every prompt, response, tool call, MCP interaction and agent to agent message, and access policies are checked the moment a connection or action is attempted, with no one starting the work. Newly discovered agents, MCP servers and skills enter the registry on their own, and red teaming runs continuously.

SourceNoma Security, noma.security/platform/runtime-protection and /products/ai-red-teamingread 2026-10-06

Reconnaissance profiles the customer's AI systems, covering models, agents, tools, guardrails and system prompts, into a map of the estate, with recon types for guardrails, system prompt extraction, tool discovery, input and output encoding, output formatting and output rendering. Attacks draw on Mindgard's attack library and its own research, which has publicly identified more than 150 AI vulnerabilities, building on a decade of AI security research that began at Lancaster University. Recon results are kept per project, but there is no store the customer fills with its own documents.

SourceMindgard, mindgard.ai and docs.mindgard.ai/llms.txtread 2026-10-06

Discovery fills an MCP and agent registry automatically and gives each agent, MCP server and skill a status, with a profile of its toolsets, functions, data access permissions and MCP server connections, which together map the customer's AI estate. Noma says discovery finds 10 to 100 times more agents than teams expect. Noma names no knowledge store of its own for the customer's agents to draw on.

SourceNoma Security, noma.security/platform/agentic-access-control, /solutions/ai-agent-security and noma.securityread 2026-10-06

Within a run, the adaptive attack agents learn from the target's responses and change tactics, and each project keeps its tests, findings and recon results. The agents keep no memory from one run to the next.

SourceMindgard, mindgard.ai/automated-ai-red-teaming and docs.mindgard.ai/llms.txt; mindgard.airead 2026-10-06

The customer's agents get no memory from Noma. Its registry and audit trail record the AI estate and its traffic for the security team, not for an agent to read back.

SourceNoma Security, noma.security/platform/runtime-protectionread 2026-10-06

Findings go to the customer's team with remediation guidance, and the team decides what to fix. Runtime protection identifies and responds to attacks in real time, and no step has a person approve a response before it happens. Testers choose which attacks run, can run a subset of the library, and set the technique and goal of each multi turn test.

SourceMindgard, mindgard.ai, docs.mindgard.ai/llms.txt and /user-guide/testing-via-cliread 2026-10-06

Each agent, MCP server and skill in the registry is approved, needs review or blocked, and newly found assets land there for the security team to decide what belongs. Policies are enforced when a connection or action is attempted, read access can be open to many while create, update and delete stay with a smaller group, and runtime responses run from alert and audit to masking and blocking, set by application, agent profile, risk level or policy type. Noma names no step where a person approves a single agent action before it goes through.

SourceNoma Security, noma.security/platform/agentic-access-control, /platform/runtime-protection and the endpoint agent security post on noma.security/blogread 2026-10-06

Mindgard holds AICPA SOC 2 Type 2 certification. SAML single sign on can be enabled on request, so a team signs in through its own identity provider, such as Microsoft Entra, Okta or Google Workspace. Projects are shared by role, with an owner who created the project, admins who add, change or remove members, and members who view results and run tests. There is no audit log of activity on the platform. The framework mapping Mindgard offers applies to the customer's findings, not to Mindgard itself.

SourceMindgard, docs.mindgard.ai/user-guide/enterprise-setup, /user-guide/sharing-projects and mindgard.airead 2026-10-06

Attestations cover SOC 2 Type II audited by EY, ISO 27001, ISO/IEC 42001 and HIPAA, along with ISO 9001:2015. Controls for Noma's own operations include multi factor authentication, access reviews, audit logging, disk encryption, network segregation and endpoint detection and response. Noma names no SSO, role model or audit log for the customer's own users of the Noma console.

SourceNoma Security, trust.noma.security and noma.securityread 2026-10-06

Each finding comes with clear evidence, attacker context and remediation guidance mapped to OWASP, MITRE ATLAS, the NIST AI RMF and the EU AI Act. Test results group flagged events by threat category and show every interaction in a test with its input, its output and Mindgard's observations, each event flagged or cleared, and the attack list downloads as CSV. The MITRE ATLAS Adviser rolls up risk across every test in the organization. There is no trace of the steps or tool calls inside the customer's agents.

SourceMindgard, mindgard.ai/automated-ai-red-teaming, docs.mindgard.ai/user-guide/test-results and /user-guide/reportingread 2026-10-06

Runtime protection monitors prompts, responses, agent tool calls, MCP server interactions and agent to agent communications, and every interaction, policy decision and response action is logged and searchable. Automated reporting gives auditors and regulators full traceability. The Agentic Risk Map shows each agent's connections, tools, identities and knowledge sources, so the security team can see what an agent could reach.

SourceNoma Security, noma.security/platform/runtime-protection and /solutions/ai-agent-securityread 2026-10-06

Every customer is assigned to a Mindgard instance, and instances run in several parts of the world to meet data residency requirements, though the regions are not named. The CLI and the Burp Suite extension run in the customer's environment and proxy every model interaction, while Mindgard's SaaS application plans the attacks, judges them and stores the results. Testing runs from CI/CD, the CLI, Burp Suite or a single click against the customer's endpoints. HTTPS proxies are supported and SOCKS proxies are not. There is no self hosted or customer cloud option.

SourceMindgard, docs.mindgard.ai/user-guide/enterprise-setup and /user-guide/system-architectureread 2026-10-06

Where the platform itself is hosted is not published, and Noma names no region choice, data residency option or way to run it in the customer's own environment. AWS, Azure and Databricks are platforms whose agents Noma covers, not places it runs. Noma's subprocessors include Frontegg in the US for authentication, Datadog for logging and Snowflake for analytics.

SourceNoma Security, noma.security and trust.noma.securityread 2026-10-06

A prebuilt attack library ships with the platform, "an ever growing list of LLM/ML attack techniques", with named jailbreaks such as Crescendo, ActorAttack, AsciiArtAttack and DevModeV2, prompt injection encodings such as Ascii85 and ANSI escapes, and violation tests such as PromptAlignment and MaliciousGeneration.

AI safety datasets come ready to use, customers can generate or bring their own datasets and run a subset of attacks, and a remediation library covers sixteen defenses, from guardrails and output filtering to differential privacy. Mindgard sells no prebuilt agents for a customer to adopt.

SourceMindgard, docs.mindgard.ai/llms.txt; docs.mindgard.airead 2026-10-06

Red teaming findings map to prebuilt compliance presets for the OWASP LLM Top 10, MITRE ATLAS, the NIST AI RMF, the EU AI Act and ISO 42001, and runtime protection ships prebuilt masking for PII, credentials, API keys and sensitive business data. Beyond these presets, no named catalog or prebuilt agents are offered. Solution pages package the platform for AI asset discovery, agentic identity, MCP security, AI supply chain security and coding assistant security.

SourceNoma Security, noma.security/products/ai-red-teaming, /platform/runtime-protection and noma.securityread 2026-10-06

Any target model can be tested, with ready presets for OpenAI, Anthropic, Azure and Hugging Face, but Mindgard offers no model choice or routing for its own operation. It does not name the models behind its own attack planning.

SourceMindgard, mindgard.ai and docs.mindgard.ai/user-guide/testing-via-cliread 2026-10-06

Noma secures traffic to the customer's models and offers no model choice or routing of its own. Its detection of prompt injection and policy violations runs on proprietary AI models trained for security analysis.

SourceNoma Security, noma.security/platform/runtime-protectionread 2026-10-06

Developers get a Python SDK, a CLI reference and an API reference covering projects, tests, findings, datasets, multi turn tests and reconnaissance, and Mindgard publishes an OpenAPI specification. The CLI installs from PyPI and runs reconnaissance, single turn and multi turn tests against a target set inline or in a config file, and a Burp Suite extension brings the same tests into a penetration tester's tools. The API can create findings as well as list them.

SourceMindgard, docs.mindgard.ai/llms.txt and /user-guide/testing-via-cli; docs.mindgard.airead 2026-10-06

Noma publishes no API reference, SDK or MCP server for building on its platform, and no docs site. It says policies can be enforced through SDKs and direct APIs as well as hooks and gateways, but publishes a reference for neither, and its MCP features govern the customer's own MCP servers.

SourceNoma Security, noma.security and the endpoint agent security post on noma.security/blogread 2026-10-06

Mindgard runs continuous automated red teaming of the customer's AI agents and systems, before deployment and in production, including multi step attacks across agents, tools, APIs and data sources. Each run returns findings, evidence and remediation, and multi turn tests run from the CLI and the API with a technique and goal the tester sets.

Policies let the customer write the guidelines its application must follow, checked by regex refusal and policy violation observations that add flags or filter out irrelevant ones. The weaknesses it looks for include prompt injection, jailbreaks, system prompt leakage, model extraction, unsafe tool use, excessive agency and data or memory poisoning.

SourceMindgard, mindgard.ai/automated-ai-red-teaming, docs.mindgard.ai/user-guide/policies/overview and /user-guide/testing-via-cliread 2026-10-06

AI Red Teaming continuously tests the customer's AI agents and applications, whether on endpoints, in SaaS or built in house, with adaptive multi turn attack sequences covering prompt injection, jailbreaks, data leakage, denial of wallet and harmful content generation. Findings map to compliance presets with audit ready reporting and feed into the AI-DR runtime policies, so each weakness found hardens production protection.

SourceNoma Security, noma.security/products/ai-red-teamingread 2026-10-06

Testing runs against inference and API endpoints, and a guide covers testing chatbot applications. Its agents do not control a browser or computer.

SourceMindgard, mindgard.ai and docs.mindgard.ai/llms.txtread 2026-10-06

Noma names no browser or computer control by its own agents. The platform governs other agents, including coding and productivity agents on employee laptops found through the EDR or MDM a company already runs.

SourceNoma Security, noma.security and the endpoint agent security post on noma.security/blogread 2026-10-06