Most AI security testing doesn't start with a vendor. It starts with a laptop and an open source tool.
That's not a knock. If you're shipping an LLM feature and want to know whether it'll say something stupid before it goes live, garak, PyRIT, and Promptfoo will tell you a lot, fast, for free.
garak, NVIDIA's open source LLM scanner, runs your model against a library of known attack probes and flags what breaks.
PyRIT, Microsoft's red teaming framework, orchestrates multi-turn attacks. You want it when the risk sits in a five-message conversation that slowly talks the model off its guardrails, where no single prompt looks bad on its own.
Promptfoo, which OpenAI agreed to buy in March 2026 and has promised to keep open source, works more like a test suite. You write expected behaviors, run them against your model on every change, and catch a regression before a prompt tweak quietly reopens a hole you'd already closed.
Used together, they cover a real gap. Plenty of teams ship LLM features with zero adversarial testing, and any one of these tools beats that by a wide margin. If you're an engineer who wants a gut check before Friday's release, running garak against your endpoint this afternoon is a good use of an hour.
Table 1. What each tool is built for, and the work it leaves on your plate.
You can hit an AI system in four places: the model, the data it reads, the tools it's allowed to call, and how much it's allowed to decide on its own. (We break these down in What is AI Red Teaming?)
garak mostly tests the first one. Say you've got a support chatbot wired into your ticketing system. garak can tell you whether the model will leak its system prompt or say something it shouldn't. It won't tell you what happens when a customer buries an instruction inside a ticket, and the model reads it as content but follows it as a command. That's a separate surface, and it's where a lot of real damage starts. Our researchers showed how prompt injection in Amazon's Kiro IDE could be used to pull data out, and nothing about that attack lived in the model alone.
Promptfoo does ship an indirect prompt injection plugin, and PyRIT can be scripted to go after these paths too. Both still need someone who knows the current attack techniques to set them up and point them at the right place. That knowledge goes stale fast. New jailbreak framings show up monthly, so a tool stays only as current as the person running it.
The last two surfaces get more important every quarter. Once your assistant can issue a refund or merge a pull request, a bad answer turns into a bad action. Our guide to AI agent security covers what that looks like in practice.
Every one of these tools gives you a point-in-time result. You run it, you get a report, and that report describes your system as it existed at 2:14pm on a Tuesday. Ship a new system prompt Wednesday, swap the model version next month, add a tool integration in Q2, and the test is stale.
None of them watch your production system by default. Someone has to remember to rerun them, and in most companies nobody does until something breaks in public.
When something does break, a spreadsheet of failed probes won't help the people who have to act on it. A compliance officer getting ready for an audit doesn't want "37 of 200 probes triggered a policy violation." She wants to know which obligation is at risk, what the exposure looks like in plain terms, and what to fix first. A board won't read scan output. Turning raw findings into something a non-technical stakeholder can act on is a job of its own. It's usually a bigger lift than the testing was.
Open source tools are building blocks. To get full coverage out of them, a team has to choose the right tools, configure each one per target, wire them into CI/CD, keep attack libraries fresh, and then translate the output for risk owners. That's a standing engineering project. It tends to land on one or two people who already have day jobs, and when those people move on, the know-how goes with them.
So the gap between ad hoc and complete comes down to who owns the work. Open source tools are what you run to check your own homework, and they're good at catching the obvious stuff cheaply. What they won't give you is coverage of the whole system that keeps up as the system changes, in a form the people signing off on risk can use.
Mindgard is built for the enterprise version of that job. Our offensive security platform is up and running in minutes with one-click deployment, and it plugs into CI/CD and the security workflows you already run. It tests across all four surfaces, the model included.
Our research team keeps the attack library current, so you aren't relying on one engineer to track every new jailbreak. Testing runs continuously, which means a model swap or a new tool integration gets checked without anyone needing to set a reminder. Findings come back ranked by risk with remediation guidance and mapped to OWASP, MITRE, and NIST. Executive reports and audit-ready evidence go to the people who need them, without requiring a week of hand translation first.
If you already run garak or Promptfoo in your pipeline, keep doing it. Use it the way it's meant to be used, as a fast check between deploys. Just don't mistake a clean scan for a clean bill of health.
A clean scan tells you your model didn't fail the tests you thought to run. It doesn't tell you what a determined attacker, with time and four surfaces to work with, would find instead.
That’s the gap Mindgard is built to close: continuous, attacker-minded testing across your whole system, with findings your risk owners can act on. If you want to see what a clean scan might be missing, we’re happy to show you.
Mindgard secures AI models, agents, and applications against exploitable threats. Spun out of more than a decade of pioneering AI security research at Lancaster University, Mindgard combines offensive security expertise, AI red teaming, attacker intelligence, and automated protection to help organizations discover, assess, and mitigate risk across AI models, agents, and applications.
We found vulnerabilities in AI from OpenAI, Meta and AWS. See how Mindgard finds and proves the weakness attackers could exploit in yours.
