DeepInspect vs CalypsoAI: Inference-Layer Scanning and Identity-Bound Enforcement

CalypsoAI runs its checks at the inference layer. A prompt heads for a model, the platform scans it against a corpus of more than 20,000 attack prompts, and a response gets scanned on the way back for data leakage and policy violations. The company started in 2018 on national security work, moved into commercial generative AI, and in September 2025 became part of F5, folding inference-layer AI security into F5's application and API security portfolio.

That heritage shows in the product. CalypsoAI is built by people who think in terms of adversaries and attack surfaces, and its strongest surface is threat detection on live AI traffic.

Teams comparing it to DeepInspect are usually weighing a threat-scanning platform against an identity-bound policy layer. Both sit on live AI traffic, which makes this a closer comparison than most on our blog. I want to lay out what each one does to a request, then be specific about where the overlap ends.

TL;DR

CalypsoAI (now part of F5) scans prompts and responses at the inference layer for prompt injection, data leakage, and content-policy violations, red-teams models against a large attack corpus, and monitors AI activity centrally. DeepInspect sits inline between authenticated callers and model providers, decides whether each request proceeds based on who is asking and what data is involved, and commits an audit record before the response returns.

CalypsoAI: red-teaming and inference-layer defense

CalypsoAI's platform has three parts. Red-Team probes a model or agent for weaknesses, generating adversarial prompts to find where a deployment gives up sensitive output or follows instructions it should refuse. Defend applies scanners in real time while users and agents interact with a model, checking for prompt injection, sensitive-data exposure, and content that breaks configured rules. Observe collects the activity centrally so a security team has one view of what the organization's AI traffic is doing.

The attack corpus is the differentiator worth naming. More than 20,000 attack prompts, updated as new techniques appear, feed both the red-teaming and the live scanners. A security engineer watching the Defend view during a launch week sees injection attempts flagged and blocked as they arrive, which is genuine prevention value on the content dimension.

The scanners work on content. They read the prompt and the response and decide whether either carries something dangerous. That is the right design for catching an attack, and it is a different question from whether this particular caller was permitted to make this particular call.

The identity of the caller, not just the content of the prompt

DeepInspect is a stateless proxy sitting between authenticated users or agents and any LLM endpoint. Every call traverses it, and the policy decision happens before the provider sees the request.

The distinction is the primary key of the decision. CalypsoAI asks whether the content of this prompt or response is dangerous. DeepInspect asks whether this authenticated identity, holding this role, sending this class of data, to this model, is allowed to proceed. A prompt can be entirely benign in content and still violate policy because the person sending it has no entitlement to the data it carries. That case is invisible to a content scanner and central to an authorization layer. The mechanics of identity-first decisions are covered in identity-aware AI gateway architecture.

The second distinction is the audit record. CalypsoAI's Observe view is monitoring, built for a security team to watch and investigate. DeepInspect writes a structured decision record for every request, on storage the application cannot modify, designed to stand up in front of an auditor rather than an analyst. The reasoning behind that design is in signed audit logs for AI requests.

Feature comparison

| Capability | CalypsoAI (F5) | DeepInspect | |---|---|---| | Real-time prompt and response scanning | Yes, a core strength | Content checks available; not the focus | | Adversarial red-teaming of models | Yes, core | No | | Large curated attack-prompt corpus | Yes, 20,000+ | No | | Identity-bound per-request policy | Partial, rule-based | Core | | Decision keyed to user role and data class | Limited | Core | | Application-independent audit record | Monitoring-oriented | Core, tamper-evident | | Fail-closed enforcement on policy error | Configurable | Configurable | | Model-agnostic across any HTTP LLM | Yes | Yes | | Coverage without application code changes | Yes | Yes | | Primary buyer | Security operations, AI red teams | Security and compliance |

Reading that table, the honest finding is that the two share the inference layer and split on what they evaluate there. CalypsoAI reads content for threats. DeepInspect reads identity for authorization and writes the evidence.

Where CalypsoAI is the better answer

If the requirement is finding out how an AI deployment breaks under adversarial pressure, and then catching those same attacks in production at scale, CalypsoAI has depth I would not try to match with a policy proxy. Red-teaming against a 20,000-prompt corpus is a specialist capability, and folding it into F5's application-security stack gives it reach across an organization's broader traffic.

I will say the part a committee would cut: if your only stated problem is malicious prompts, look hard at CalypsoAI before you look at us, because content threat detection is what it was built to do and it does it well.

Where the gap opens

Two requirements move a team past what a content scanner provides.

The first is authorization on non-malicious traffic. A fully authenticated analyst pasting pre-earnings figures into a model is not sending an attack, and a threat scanner has no reason to stop it. An identity-bound policy layer stops it because the analyst's role has no entitlement to move that data to that destination. The post-authentication gap is exactly this class of problem.

The second is evidence independence. Monitoring records what a system observed. A regulator under the EU AI Act asks for a per-decision record of what was authorized, under which policy, at which moment, on storage the deploying application never had write access to. The distinction between monitoring and an audit system of record is developed in EU AI Act Article 19 logging.

Pick CalypsoAI if

• Adversarial red-teaming of your models and agents is a stated requirement.
• Your priority is catching prompt injection and data-leakage attempts in live traffic.
• You want a large, continuously updated attack corpus behind your scanners.
• You already run F5 for application and API security and want AI security in that stack.
• Your compliance team is not yet asking for per-decision authorization evidence.

Pick DeepInspect if

• You need decisions keyed to identity and role, not only to prompt content.
• An auditor or enterprise customer wants per-decision records tied to a named identity.
• Policy must differ by role and be enforced independently of application releases.
• You need an audit record on storage the application cannot alter.
• You operate under the EU AI Act, DORA, HIPAA, or a comparable mandate.

DeepInspect

This is exactly what DeepInspect does. DeepInspect sits inline between your users or agents and the LLM APIs they call. For every request and response, it evaluates identity, data classification, model authorization, and organizational policy, then makes a pass or block decision before the traffic reaches the model.

The record is the second half of the product. Every decision writes a structured entry containing the authenticated identity, the resolved role, the data classes found in the prompt, the policy version in force, and the outcome. That entry commits before the response returns, on storage the application cannot write to, which is what lets it serve as evidence rather than as a monitoring feed. Enforcement adds under 50 ms in internal testing against inference times of 500 ms to several seconds, so the decision is invisible next to the model's own latency.

If you are facing the August deadline, let's talk.