UPDATE · 2026-05-29Prisma AIRS is what Portkey became after the Palo Alto Networks acquisition. If you were on Portkey directly, PANW is routing you into their enterprise procurement track.See the alternative →
Tokenality vs Prisma AIRS
Prisma AIRS is enterprise-only. Not everyone is.
Palo Alto Networks bought Portkey (May 29, 2026) and folded it into Prisma AIRS — the AI Runtime Security bundle sold alongside Prisma Cloud and Prisma Access. If your PANW rep is scheduling enterprise-procurement calls and you don't have a PANW security org, you need somewhere else to run. Tokenality is the purpose-built alternative — in stealth today; hosted design-partner access from $99/mo, same wire-level surface, Finance-audit-ready by default.
Migrating from Portkey directly? See the Portkey-branded migration page →
What Prisma AIRS is
PANW's AI Runtime Security suite, with Portkey inside.
Prisma AIRS existed as a PANW product line before the Portkey acquisition — an enterprise DLP + posture-management play for AI. The Portkey acquisition added multi-provider routing, cost observability, and semantic caching. Verify with your PANW rep for account-specific impact.
Owner
Palo Alto Networks (PANW)
Origin
Portkey acquisition, May 29, 2026
Deal size
~$700M-class (undisclosed exact)
Product line
Prisma AIRS = AI Runtime Security suite
Bundled with
Prisma Cloud + Prisma Access (SASE)
Pricing shape
Enterprise-only, undisclosed publicly
Buyer
CISO org, PANW procurement track
Deployment
PANW cloud / hybrid on-prem appliances
Migration path
Moving from Prisma AIRS to Tokenality
Roughly a half-day of guided engineering time. Config maps over from your existing Portkey (or Prisma AIRS-encoded) setup with a short mapping guide; SDK code stays the same. The differences show up as features you didn't have before.
Point your SDK at Tokenality
Same wire-level surface Portkey had — swap the base URL. Anthropic runs native; OpenAI, Google, Azure OpenAI, and Bedrock run through the governed proxy; 1,900+ more via OpenRouter and LiteLLM pass-through. Your existing SDK code works unchanged.
Import your Portkey config
Metadata mapping and route configs port with a short mapping guide; global rate limits carry over as gateway config. If your PANW rep is offering to migrate you to Prisma AIRS instead, take the exported config and bring it to us — the wire-level position is the same, and we'll walk the mapping with you.
Turn on the differences
Spend Tokens, binding-key envelope, PII pre-flight, SOC 2 evidence pack, per-project chargeback CSV — all one env flag away. None of these existed in Portkey; and while Prisma AIRS has security posture, it doesn't have Finance-audit-grade attribution or per-task chargeback.
Skip enterprise procurement
Design-partner access is available during stealth. Hosted from $99/mo at public launch when you want us to run it. Team at $499/mo when you need SSO. Enterprise at $999+/mo when you need BYOC + SOC 2 pack + dedicated CSM — but real Enterprise deals land $5k-$50k/mo, still well under whatever PANW's Prisma AIRS SKU comes with.
curl | bash installer will ship with it.What to say in the room
The question comes from a specific seat. The answer should too.
Prisma AIRS is genuinely stronger on classic DLP security posture — that's where PANW has 20+ years of muscle. Tokenality is genuinely stronger on Finance-audit-grade cost governance and per-task attribution.
CFO
"Show me what we spent on AI last month, by project, by team — joinable to our GL."
CHRO
"Who has access to AI, and what happens when someone leaves?"
PMO
"How much did the redesign sprint actually cost us in AI tokens?"
CISO
"How do we prevent prompt injection, PII leaks, and jailbreaks at the gateway level?"
The details
Capability-by-capability, where the postures diverge.
Use this when engineering + security + finance all need to see what actually differs.
Ownership + roadmap
| Capability | Prisma AIRS (PANW) | Tokenality |
|---|---|---|
| Current owner | Palo Alto Networks (Prisma product line) | Tokenality (ServiceVision) — independent, in stealth · Lite edition planned |
| Buying track | PANW enterprise procurement, CISO-led | Design-partner access during stealth · $99 Hosted / $499 Team / $999+ Enterprise at public launch |
| Product roadmap direction | Absorbed into Prisma AIRS security suite, PANW-directed | Mid-market-first, weekly design-partner reviews, roadmap shared with partners |
| Data residency | PANW infrastructure (cloud / on-prem PANW appliances) | Hosted on our infra; BYOC available at Enterprise; self-host option coming with the Lite edition |
Posture
| Capability | Prisma AIRS (PANW) | Tokenality |
|---|---|---|
| Primary buyer | CISO org with existing PANW footprint | CFO — pulls in CIO / CHRO / PMO |
| Frame | AI Runtime Security — DLP + guardrails + posture | Token Ledger — every token reconciled to person × project × task |
| What changes Monday morning | Security team gets AI in the same panel as SASE / CASB | Four awkward stakeholder questions stop being awkward |
Cost governance
| Capability | Prisma AIRS (PANW) | Tokenality |
|---|---|---|
| Hard budget cap | Rate limits at the gateway (soft) | Budget binding signed into the token; gateway fast-fails 402 before any LLM call |
| Per-project chargeback CSV | Not first-class; bundle-level cost only | First-class — GL codes + cost centers, joinable to Workday |
| Semantic caching | Yes (from Portkey) | Yes — CACHE-01 with envelope-aware credit accounting |
| Real-time burn-down per project | Dashboards | Hard counter — UI + ledger row + 402 response in one trip |
Security posture
| Capability | Prisma AIRS (PANW) | Tokenality |
|---|---|---|
| PII pre-flight | Yes — DLP is a PANW core competency | Yes — 12 detectors, fail-closed |
| Prompt injection scanning | Yes | On the near-term roadmap — MCP Axis-2 hardening track (policy tables shipped; enforcement wiring in flight) |
| SASE integration | Native — same panel as Prisma Access | External via OTel + your existing SIEM |
| SOC 2 / ISO 27001 / ISO 42001 / NIST AI RMF evidence | Custom queries + PANW compliance module | Two-click evidence pack across all four frameworks |
OSS + deployment
| Capability | Prisma AIRS (PANW) | Tokenality |
|---|---|---|
| License | Proprietary (PANW commercial) | In stealth · design-partner deploys today; Lite edition self-host planned post-stealth |
| Self-host | Enterprise appliance option, not community | Lite edition planned for post-stealth public launch |
| Governance transparency | Whatever PANW's security team ships in their release cycle | Weekly design-partner reviews · 1,299+ tests · roadmap shared with partners |
Honest take
When Prisma AIRS is genuinely the right answer.
If your team is already a PANW Prisma Cloud or Prisma Access customer, the AIRS bundle likely comes with your existing contract at minimal marginal cost — that's a real economic advantage. If your primary AI risk story is DLP, prompt injection, and jailbreak prevention as a security posture extension, Prisma AIRS shares operational context with your SASE and CASB in one PANW panel. That's a meaningful UX and IR advantage for a mature CISO org.
Tokenality is a different bet: AI cost and audit governance as a Finance-owned discipline, priced for teams that don't have PANW procurement, in stealth today with an open-source Lite edition planned. If you need both — enterprise security posture AND per-task Finance-audit-grade attribution — the honest answer is you run both. Neither one covers the other's core competency.
Skip the enterprise procurement cycle.
Same wire-level surface as what Portkey was — your existing SDK code works unchanged. Bring your own LLM keys. In stealth today with hosted design-partner access; an open-source Lite edition is planned for the post-stealth public launch.