CyCraft named Gartner’s only Pace Setter in AI application security — the sole Asian vendor in the quadrant

Taiwan’s CyCraft Technology (TWSE: 7823) announced on Wednesday that it has been positioned as the only vendor in the Pace Setters quadrant of the Gartner Emerging Market Quadrant for AI Application Security, Startup Vendors — published September 16, 2026 — and the only Asia-based vendor in the report. It is the company’s third major international recognition of 2026.

Why the recognition lands now

AI applications are in production everywhere, and the failure modes are getting uglier. Enterprises are handing agents real authority — reading email, querying databases, approving transactions, changing configurations — while attackers probe those same applications with thousands of prompt variations, adapting to every refusal. Prompt injection, sensitive data exposure, and agents exceeding their permissions are, in CyCraft’s words, “no longer edge cases. They are becoming everyday incidents.”

The Gartner report itself is part of the story: an Emerging Market Quadrant for AI application security startups means the analyst community now treats “AI firewalls” and AI red teaming as a real product category. Being the sole Pace Setter — a quadrant with exactly one occupant — is a deliberately different position from the rest of the field.

Test before launch, protect in production

CyCraft’s pitch covers both pillars of AI defense. XecART is the company’s AI red teaming security assessment: it attacks AI applications and agents the way a real adversary would, running multi-round adaptive tests that shift tactics based on each response, and delivers resilience reports aligned with international standards.

XecGuard is the real-time guardrail for LLMs and AI agents. Instead of static keyword filters that attackers learn to evade, it reads the intent behind every prompt and response and blocks malicious or abnormal activity as it happens. Its modules — General Prompt Attack Protection, System Prompt Enforcement, and Harmful Content Protection — can be tailored to enterprise needs. CyCraft says both products were built on its own models “from day one,” and that native expertise in Chinese and Japanese plus regional threat intelligence catches attack patterns general-purpose models routinely miss.

Three for three in 2026

The company is stacking up outside validation. In April, XecART and XecGuard were included in the OWASP AI Security Solutions Landscape. In July, CyCraft was named a Sample Provider in the Gartner report “Emerging Tech: AI Vendor Race: Reasoning Models Reshape Providers’ Approaches to AI Pricing” — the only Taiwan-based cybersecurity company in that list. Today’s Pace Setter announcement, which the company also published in its own newsroom, completes the hat trick.

“AI behaving outside its intended boundaries is fast becoming the norm, not the exception,” said Dr. Benson Wu, CEO and Co-Founder of CyCraft. “When agents act on their own and adversaries use AI to attack them, defense has to run at the same speed.”

What we don’t know yet

The announcement carries Gartner’s standard disclaimer: inclusion in a report is not an endorsement, and the report’s full vendor list sits behind Gartner’s paywall. The press release discloses no deal sizes, customer counts, or pricing for XecART or XecGuard — so the commercial weight behind the quadrant position is still opaque. The practical takeaway for anyone deploying AI agents: analyst validation that AI-application security is a standalone category is itself a signal. Whether CyCraft wins that category is the open question.