EVE vs Lakera
A factual comparison for teams securing LLM and agent applications. This page sources only EVE's capabilities from the EVE claims registry. Vendor rows we cannot source are marked "not independently verified here."
Positioning
Lakera is generally positioned around LLM security — for example prompt-injection and content threat detection at the model input/output boundary. EVE is positioned as a proof-bearing governance and enforcement platform: it makes a deterministic decision (ALLOW / BLOCK / MODIFY) before a governed action executes, with no LLM in the decision path, and produces signed evidence bound to each decision that is verifiable offline without trusting the EVE server.
These are complementary layers. Detection-oriented LLM security screens content; EVE governs whether a tool call or side effect is allowed to proceed and produces verifiable proof of that decision.
Currency note (2026-07-20): Lakera was acquired by Check Point (announced Sept 2025); Lakera Guard is now part of Check Point's AI security portfolio. See the comparison source ledger.
Capability matrix
| Capability | EVE | Lakera |
|---|---|---|
| Deterministic pre-execution decision on a tool call / side effect | Yes — PILOT_READY | not independently verified here |
| No LLM in the governance decision path | Yes — PILOT_READY | not independently verified here |
| Signed decision evidence bound to the decision | Yes — SUPPORTED | not independently verified here |
| Offline independent evidence verification (Python / Node / browser) | Yes — SUPPORTED | not independently verified here |
| MCP approved-vs-executed binding (at-most-once) | Yes — PILOT_READY | not independently verified here |
| Action-sequence governance | Yes — PILOT_READY | not independently verified here |
| Deterministic file-content scanning with signed scan evidence | Yes — PILOT_READY | not independently verified here |
| Prompt-injection / content threat detection at the model boundary | not the focus of EVE's sourced claims | not independently verified here |
| Behavioral anomaly detection (statistical detectors) | Yes — advisory; PILOT_READY | not independently verified here |
Where EVE fits
Choose EVE when the control point is the action (a tool call, an MCP request, a file ingestion) rather than only the prompt or response text — and when you need verifiable evidence of each governed decision. EVE's artifact scanning detects the real media type from content, applies bounded safe-parsing limits, runs deterministic scanners, and can block, quarantine, or require approval before ingestion, emitting signed scan evidence.
Content-level LLM security and EVE's action-level governance can operate together: screen the text, then govern the resulting action with a deterministic decision and signed proof.
Readiness
- EVE SDK core is a RELEASE CANDIDATE WITH EXCLUSIONS.
- Python (
eve-coreguard0.2.2) and TypeScript (@eve/coreguard0.1.0-rc1) are release-candidate core clients, distributed privately for pilots — not on public registries at this stage. - Core governance architecture is pilot-validated; signed evidence and offline verification are SUPPORTED. Artifact and red-team subsystems are customer-pilot ready at supported boundaries.
- Framework adapters other than the generic adapter are experimental.
Limitations
- Only EVE's rows are sourced. Lakera rows are "not independently verified here" and are not accusations of missing features.
- The pip client governs via hosted mode (needs an endpoint); embedded evaluation is the EVE service.
- Independent verification requires the Ed25519 public key; the HMAC fallback is not independently verifiable.
- Deterministic scanners are pattern/structure-based. OCR, vision, and QR/barcode reading are probabilistic and disabled by default; incomplete extraction is reported as partial and cannot masquerade as complete.
- Behavioral anomaly detectors are advisory unless wired to a deterministic enforcement action.
- MCP binding is at-most-once, not remote exactly-once; unknown remote outcomes are recorded
as
OUTCOME_UNKNOWN. - Framework adapters other than the generic adapter are experimental; wrapper-enforced adapters are bypassable by a direct underlying-tool call, and hard enforcement requires a gateway or sidecar.