Arbitex Gateway vs. CalypsoAI (now F5)
CalypsoAI was acquired by F5 Networks in September 2025 and is now part of the F5 product portfolio. The platform's capabilities — prompt injection detection, jailbreak defense, GenAI application security scanning, and AI red-teaming — continue under F5 ownership, with the backing of a major enterprise networking and security vendor. The gap that Arbitex addresses is different from what CalypsoAI/F5 covers: once users are sending prompts containing regulated data — PHI, MNPI, PII, CUI — who governs what data flows through the model boundary, what compliance rule applied, and what the audit record proves? CalypsoAI/F5 defends AI from attacks. Arbitex protects data flowing through AI. Many security teams deploy both.
Feature Comparison
| Capability | CalypsoAI (F5) | Arbitex Gateway |
|---|---|---|
| Primary focus | ✓ AI security threats (prompt injection, jailbreak, GenAI app scanning, red-teaming capabilities; strong AI-specific security tooling) | ✓ Runtime data governance (DLP for AI prompts, compliance bundles, policy enforcement, audit logging for regulated data flowing through AI) |
| Prompt injection detection | ✓ Core capability — real-time prompt injection and jailbreak detection; GenAI application security scanning for adversarial inputs | ✕ Not a prompt injection defense platform — Arbitex governs data content, not adversarial attack patterns |
| DLP pipeline — data entity detection | ✕ Not a DLP platform — AI security tooling, not regulated data entity detection in prompts (no PHI/MNPI/PII scanning) | ✓ Multi-layer content inspection pipeline: 80+ pattern rules → 40 ML recognizers → AI-powered contextual validator — detects regulated data in natural-language AI prompts |
| Policy engine — compliance framework mapping | ~ AI security policy controls for GenAI applications — focused on attack defense, not data handling policy with combining algorithms and compliance framework mapping | ✓ Policy chain engine with flexible combining logic for multi-condition policies, condition types, per-org enforcement, and compliance framework mapping |
| Air-gap / offline deployment | ✕ Cloud-native AI security platform — no air-gap or offline deployment mode for regulated/classified environments | ✓ Hybrid Outpost — full governance data plane inside customer VPC; policy enforcement and audit logging within authorized boundary |
| Compliance audit trail — HIPAA, SOC 2, GDPR evidence | ~ AI security event logging and reporting — focused on security threat detection, not per-request compliance evidence for data handling regulations | ✓ tamper-proof audit record for every AI interaction — model provider, DLP tier result, compliance rule matched, enforcement action — structured for compliance examination |
| DLP accuracy transparency — per-entity metrics | ✕ Not applicable — AI security detection metrics focus on attack detection rates, not data entity detection accuracy | ✓ Three-tier detection — pattern rules, ML entity recognition, and contextual validation — with per-entity evaluation against a labeled corpus |
| On-premises data sovereignty | ~ Cloud-based AI security with API integration — query vendor regarding on-prem deployment options for sensitive environments | ✓ Hybrid Outpost runs DLP inspection, policy enforcement, and audit inside your infrastructure — regulated data never traverses vendor systems |
| Data entity detection surface vs attack surface | ✓ Attack surface — adversarial prompts, jailbreak attempts, prompt injections, GenAI application vulnerabilities; security-focused detection | ✓ Data surface — PHI, MNPI, PII, CUI, trade secrets embedded in legitimate AI prompts; data governance-focused detection |
| Complementary deployment | ✓ Defends AI from attacks — prompt injection defense, jailbreak detection, security scanning; pairs with data governance for full-stack AI protection | ✓ Protects data flowing through AI — DLP, compliance enforcement, audit logging; pairs with AI security for complete coverage |
| Encryption enforcement at startup | ✕ No published documentation on startup-level encryption enforcement — CalypsoAI focuses on AI model security (red-teaming, security scanning, CASI scores); transport encryption posture not publicly documented | ✓ Startup validators reject plaintext connections in production — Redis, telemetry, model provider URLs validated at process start; mTLS with CA pinning for Outpost traffic; gateway refuses to start if encryption is misconfigured |
Where Arbitex Gateway Wins
DLP at the model boundary — different detection surface
Calypso AI's detection surface is adversarial attack patterns — prompt injections, jailbreaks, and GenAI application vulnerabilities. Arbitex's detection surface is regulated data embedded in legitimate AI prompts — the PHI a clinician types, the MNPI a trader pastes, the CUI an engineer queries. These are fundamentally different detection problems requiring different techniques. ML-based entity recognition, contextual validators, and compliance framework mapping are data governance controls, not AI security controls. Organizations need both, but they serve different threat models.
Policy engine for compliance — not attack defense
Calypso AI's policy controls focus on defending AI applications from adversarial inputs — blocking prompt injections and jailbreak attempts. Arbitex's policy engine enforces data governance policies with combining algorithms, condition types, and compliance framework mapping. The distinction matters: blocking an attack and enforcing a data handling policy are different enforcement models with different policy languages. Arbitex's policy chain executes against data content, not attack signatures.
Measured DLP accuracy with published metrics
Arbitex evaluates detection quality per entity type — SSN, credit card, PHI, MNPI — against a labeled corpus rather than as a single blended score. Those figures are not currently published: the evaluation corpus is not yet large enough for them to carry a meaningful confidence interval. What compliance teams can evaluate today is the pipeline running against their own traffic. AI security detection rates and data governance detection quality remain different measurement domains.
Air-gap Outpost for regulated environments
Calypso AI operates as a cloud-native AI security platform. For organizations in regulated, classified, or air-gapped environments — defense contractors, government agencies, rural agricultural operations — cloud-only AI security creates a deployment gap. Arbitex's Hybrid Outpost deploys the complete governance data plane inside your infrastructure. DLP inspection, policy enforcement, and audit logging happen within your authorized boundary.
tamper-proof audit trail for compliance evidence
AI security event logs document threats detected and blocked. Compliance audit trails document data governance decisions for regulatory examination. These serve different audit requirements. Arbitex's tamper-proof audit log is a tamper-evident, cryptographic record of every data governance decision — every DLP detection, every policy enforcement action, every routing decision — structured for HIPAA, SOC 2, GDPR, and regulatory compliance examination.
Complementary threat models — deploy both
CalypsoAI/F5 defends AI applications from attacks. Arbitex protects data flowing through AI applications. The threat models are complementary — one secures the application, the other secures the data. Security teams that deploy only AI attack defense leave data governance unaddressed. Teams that deploy only data governance leave AI applications vulnerable to adversarial attacks. The complete AI security posture includes both.
What the F5 acquisition means for customers
F5 acquired CalypsoAI in September 2025. Customers evaluating CalypsoAI should understand what this means for their deployment: product roadmap and investment decisions now reflect F5's enterprise networking priorities; sales, support, and contract structures shift to F5's enterprise procurement motion; integration direction will likely favor F5's existing portfolio (NGINX, BIG-IP, Distributed Cloud). Organizations already standardized on F5 infrastructure may find the acquisition creates procurement synergies. Organizations evaluating best-of-breed AI governance tooling independent of their network stack should evaluate CalypsoAI/F5's roadmap alignment directly with F5 enterprise sales.
Related Resources
See Arbitex Gateway in action
Runtime data governance for regulated industries — DLP tuned for AI prompts, compliance bundles with inline enforcement, published accuracy metrics, and a governance data plane that stays inside your perimeter. CalypsoAI/F5 defends AI from attacks; Arbitex protects the data.