GOVERNATLAS / PRODUCT DOSSIER

TrojAI

TrojAI describes pre-deployment AI risk testing, runtime protection, MCP/tool risk workflows and agent telemetry. Its current site announces acquisition by A10 Networks and presents Detect, Defend and specialized MCP/employee offerings separately.

Explore the product ↗Add to comparison ↗

01 / CONTEXT & SCOPE

Understand the proposition.
Define the boundary.

The decision to make

Distinguish finding a vulnerability before release from blocking an action during operation. The team should know which component owns each task and whether the intended agent or MCP path actually crosses its enforcement point. Preserve the acquisition context when checking support and commercial scope.

What this record does not establish

The source does not independently demonstrate prevention effectiveness, broad agent coverage or parity across Detect and Defend modules. Verify current supplier terms, selected component, supported integration and operator responsibilities. Do not treat an observed alert as proof of a blocked action.

1 current source · 1 published assertion
Source coverage is a research boundary, not a quality score.

02 / YOUR EVALUATION

Turn interest into a useful trial.

Open the evaluation playbook ↗

A test worth running

In a proposed authorized test environment, run an indirect injection through retrieved content and a tool call outside the intended permission boundary. Compare the pre-deployment finding with runtime behavior and the agent trace. Disable the control path in a controlled test to reveal dependencies, then verify that a benign tool call remains usable.

GovernAtlas editorial proposal. We have not performed this test.

Evidence to bring back

A finding-to-runtime-action comparison with tool outcome and control version.
A component and contracting matrix reflecting the A10 acquisition notice.

03 / DOCUMENTED EVIDENCE

Read the claim. Inspect the basis.

Each statement retains its classification and preserved source. A vendor assertion is not an independent test result.

vendor asserted

Source, dates & preserved provenance

TrojAI — current official product scope ↗

Authority: vendor owned
Observed 2026-10-15 · Reviewed 2026-10-15 · current until 2026-11-14

Artifact SHA-256: 5f2f9409b5b8914fc5a4c22f8d39f1f6abaa278fb279221734e5951813d63a4f

The hash identifies the preserved capture. The live source may have changed.

Source register

TrojAI — current official product scope ↗vendor owned · captured 2026-10-15

Brand asset provenance

Organization identity asset from its official website; inclusion does not imply endorsement.

Official website ↗ · Original asset ↗

04 / BEFORE YOU COMMIT

Better questions.
A clearer decision.

Resolve these with the provider and your own evaluation team.

A finding-to-runtime-action comparison with tool outcome and control version. Can this be demonstrated in the selected environment?

A component and contracting matrix reflecting the A10 acquisition notice. Who owns and signs off this evidence?

Which version, deployment and commercial entitlement are included in the proposed configuration?

Regulatory applicability requires a separate, current determination. Inclusion is not certification.

KEEP THE RECORD USEFUL

A dossier should stand up to scrutiny.

Have a source that changes this picture? Submit it for editorial review.

Raise an evidence issue ↗