Agent Runtime Security
in/guard/out vs Virtue AI
Virtue AI, acquired by Fortinet in August 2026 for a sum Fortinet called immaterial and did not disclose, protects the model interaction – and does it at a scale few can match: sub-10ms guardrails across text, image, video, audio and code in 100+ languages, agent red-teaming in 50+ sandboxed environments, discovery of unsanctioned agents across cloud and endpoints, and trajectory capture for the agents it finds. That is the enterprise security team’s lane, and Virtue is built to win it.
in/guard/out works one level up. It doesn’t just watch an agent’s run – it acts on it: it reserves the budget before the next call spends, checks a payment’s IBAN against what the run actually read, stops screened PII from leaving through a tool argument at step seven, and when something is wrong, repairs the output or tells the agent how to fix its call and finish the task.
Side by side
| Capability | Virtue AI | in/guard/out |
|---|---|---|
| What it protects | The model interaction – prompts, responses and agent actions, across five modalities | The run – what an agent spends, calls, reads and does across the whole loop |
| Agent spend | — | Hard per-run caps: each request reserves its worst-case cost against a durable ledger before it is sent, plus windowed caps per key |
| A payment’s payee and amount | Out-of-policy actions flagged in real time | Must appear in something the run read – a figure the model wrote itself in an earlier step never counts as evidence |
| Operator ceilings | Custom natural-language policies | Per-key argument limits the agent can’t widen – a payment over the ceiling is routed to a person instead of refused |
| Private data | PII exposure detected and blocked | Screened to placeholders, restored in the response, and tracked so a screened value can’t leave through a tool argument |
| When a check fails | Block and alert | Repair where safe – fix the JSON, correct the altered figure – or refuse with the problem, the remedy, and whether a retry can succeed |
| Wrong numbers in an answer | Hallucination named as a guardrail risk | Deterministic grounding: arithmetic recomputed and altered figures corrected from the source, with no model call |
| Workflow intent | Custom policies and standard frameworks | Tool-ordering rules compiled from an n8n export and enforced across the run |
| Runaway loops | — | Identical tool calls fingerprinted across the run and stopped past a threshold |
| Steps that never touch an LLM | — | A checkpoint API with a drop-in n8n node, LangChain callback and Python SDK |
| What the guardrails cost you | — | Every guard-model call priced into the run, with per-stage latency on every request |
Based on Virtue AI’s publicly available information. We’ve done our best to keep it accurate, but details may have changed since we last looked. If you’ve noticed an error, please email us.
Seeing the run is not acting on it
Trajectory capture tells you what an agent did. The failures that stop teams turning an agent on need a decision made with that history in hand, before the next step: the loop that has already spent most of its budget, the payee planted in a document three calls earlier, the customer’s account number about to exit through a tool argument. Those checks only work when the layer that holds the run state is also the one allowed to say no – and, just as often, allowed to say “yes, once you fix this”.
That is also why in/guard/out publishes false positives, not just catch rates. An agent guardrail that refuses legitimate payments gets switched off within a week. On our action-grounding benchmark the detector with the highest catch rate refused 14 of 16 legitimate actions; in/guard/out refused one and decided 29 of 32 cases correctly. And the attacks no detector can see – an invoice the attacker wrote, grounded by construction – are exactly what the per-key ceilings and approved-payee lists exist for.
The two compose. Keep a perimeter guardrail for multimodal content, languages and shadow-AI discovery; point your agents through in/guard/out for run governance. It is OpenAI- and Anthropic-SDK-compatible, so that is a base-URL change, not a migration.
Frequently asked questions
Is in/guard/out a Virtue AI alternative?
Where the jobs overlap – prompt injection, PII, unsafe content on text – either will do the basic job. The jobs mostly differ: Virtue protects model interactions across modalities for security teams; in/guard/out governs agent runs for the people who own the workflow – budgets, grounded actions, ordering, repair. Many teams will want both.
Virtue captures agent trajectories – isn’t that the same as a run?
It’s the visibility half. in/guard/out correlates an agent’s requests by session and enforces on the accumulated state: the budget reserved before the call, the IBAN checked against the run’s sources, the screened value blocked from a tool argument. The run graph in the dashboard is a record of decisions that were made, not only of what happened.
What does repair change for an agent?
A bare block is a dead end: the agent retries the identical call or abandons a task it could have finished. in/guard/out repairs what is safely repairable – malformed JSON, a figure that drifted from its source – and when it refuses a tool call, returns which argument failed, how to fix it, and whether a retry can succeed. That makes a guardrail a reliability feature, not just a safety one.
Does in/guard/out cover images, audio, or other languages?
No – it is built for text traffic, and its PII screening targets English. If you need multimodal content safety or broad language coverage, that is a perimeter guardrail’s job; in/guard/out sits behind it and governs what your agents do.
Guardrails protect the model. We govern the run.
Keep your perimeter guardrails and point your agents through in/guard/out - FIX mode observes first, so you can measure what it catches before enforcing anything. We are running a limited demo - sign up and we will get you in as soon as we can.