What category do Patronus AI and Vijil occupy in the 2026 stack

**Patronus AI** and **Vijil** are safety-evaluation platforms, not inline guardrails. The distinction matters because the 2026 safety stack has two different jobs that look superficially similar: - **Runtime classifiers** (Llama Guard 4, Llama Prompt Guard, Lakera Guard, Protect AI Rebuff, OpenAI Moderation, Bedrock Guardrails) fire on every request. They take an input or output, score it, and return a block/allow decision in milliseconds. They are part of the request path. - **Evaluation platforms** (Patronus AI, Vijil, plus open-source garak and Microsoft PyRIT) run separately. You point them at your deployed system on a schedule, nightly, after each release, on demand, and they run thousands of adversarial prompts across known hazard categories. The output is a report: attack success rate by category, refusal calibration on benign queries, hazard coverage, regression versus the previous release. Patronus AI is the more product-polished commercial offering with a UI and managed datasets. Vijil offers similar continuous red-teaming with a focus on hazard coverage. Both produce the artifacts a governance review actually reads, which inline classifiers cannot produce on their own.

**Patronus AI and Vijil are evaluation-layer products** that sit one tier above the runtime classifiers. They run continuous red-teaming and safety-evaluation campaigns against your deployed model plus rails, producing the longitudinal metrics that inline tools cannot. The split looks like this: - **Runtime layer**, Llama Guard 4, Lakera Guard, Bedrock Guardrails, Azure AI Content Safety, OpenAI Moderation. Per-request decisions, low latency, block/allow output. This is what protects a single conversation. - **Evaluation layer**, Patronus AI and Vijil (commercial), garak and Microsoft PyRIT (open source), HELM safety and TrustLLM (academic benchmarks). Scheduled campaigns, latency in minutes to hours, output is a report of metrics. This is what tells you whether the system is getting better or worse over time. Why you need both: - **Different cadences.** The runtime layer fires per request; the eval layer fires per release. A regression a runtime classifier cannot see, say, a model upgrade that lifts attack success rate from 3 percent to 12 percent on jailbreak categories, is exactly what the eval layer surfaces. - **Different artifacts.** Auditors and governance reviewers want a trend over time per hazard category, not a per-request log. Patronus AI and Vijil produce reports that map to NIST AI RMF measurement categories and EU AI Act conformity assessment evidence. - **Different test populations.** Inline classifiers see real traffic. Eval platforms run curated adversarial sets, known jailbreaks, OWASP LLM Top 10 probes, AILuminate hazard categories, that real traffic rarely covers densely enough for confident statistics. The pattern is: runtime rails defend, eval platforms measure.