Lasso’s Guardrail Runs on CPUs in Under 5ms—Its Benchmark Is In-House

Lasso Security introduced LEAP on September 2, 2026, as a transformer-free guardrail for inspecting AI requests and agent actions on ordinary CPUs. The company’s LEAP launch release claims decisions in under five milliseconds, no GPU footprint for LEAP and thousands of times the throughput of existing guardrails.

The launch coincided with $30 million in new funding, but not with independent performance validation. SiliconANGLE’s September 2 coverage records both announcements and explicitly identifies the latency and throughput benchmarks as Lasso’s own, leaving the speed, detection quality and cost advantage unverified by third-party testing.

LEAP is the CPU fast path, not the whole architecture

LEAP is one of two engines in Lasso’s design. A tiered routing layer directs most traffic to LEAP for an inline decision, while cases requiring interpretation of policies written in plain language move to RAPID, a self-hosted large-language-model judge.

This distinction narrows the claim that the system works without GPUs. LEAP is designed to run on standard processors, but GPUs do not disappear from every possible decision because difficult cases can move to RAPID. A customer’s total hardware requirement would therefore depend on the proportion of traffic resolved by LEAP, the escalation rate and the infrastructure used to host RAPID.

The architecture could avoid invoking a reasoning model for every routine request. That may matter in private-cloud, regulated and air-gapped environments where inspection must remain close to applications and data, but the public materials do not quantify the routing split in a representative deployment.

The possible saving depends on routing and detection quality

The cost case is plausible because CPU-only inspection could change the unit economics of high-volume traffic. If LEAP resolves most requests while maintaining acceptable detection quality, an operator could use CPU capacity for the fast path and reserve model inference for a smaller escalation workload instead of applying a model-based judge to every event.

That is a conditional advantage, not a demonstrated saving. A meaningful comparison must include request volume, CPU utilization, replica count, peak-capacity headroom, RAPID infrastructure or model costs, network transfer, observability and operational labor. Processor prices alone do not establish total deployment cost.

Security outcomes can outweigh compute savings. False positives create costs when legitimate agent actions are delayed or blocked, while false negatives can expose data or permit unsafe actions. The relevant economic measure is therefore cost at a matched level of detection quality and service reliability, not latency or throughput in isolation.

The financing expands the resources available to Lasso without validating those economics. Dealroom’s account of the round identifies ClearSky Advisors as its leader and also describes the performance claims as internally benchmarked and externally unverified.

The headline speed lacks reproducible test conditions

The public benchmark presents LEAP as combining competitive detection accuracy with much higher throughput than guardrails using dedicated hardware. Those results come from Lasso’s head-to-head testing, not a neutral laboratory, peer-reviewed evaluation or customer-published production study.

The disclosed material does not identify the CPU model, core allocation, comparison products, test dataset, concurrency level or timing boundaries. It is therefore unclear whether the latency figure is a median, an upper bound under defined conditions or another summary measure. The available information also does not establish whether serialization, network transit and routing time were included.

Workload composition could materially affect the result. Payload length, language, policy complexity, simultaneous request count and agent actions spanning multiple tool calls may influence both speed and classification quality. A throughput multiple is difficult to interpret unless every system receives the same traffic on disclosed hardware and is tuned to a comparable accuracy target.

Detection quality must be measured beside latency. Precision, recall, false-positive rates and false-negative rates on the same held-out traffic would show whether faster decisions preserve the security behavior an enterprise needs. No reproducible dataset or sufficiently detailed protocol has been made public for that comparison.

An independent test needs matched traffic and hardware

A reproducible evaluation would run LEAP and alternative guardrails against the same held-out requests, policies and attack labels. It would also separate LEAP-only measurements from the performance and cost of the complete LEAP–RAPID routing configuration.

• Hardware: disclose the CPU model, core count, memory, instruction set, virtualization limits and every accelerator used by comparison systems.
• Traffic: preserve the intended production mix of languages, prompt lengths, agent actions, tool calls and benign-to-malicious ratios, using a sequestered set not used for tuning.
• Performance: measure median, p95 and p99 latency at multiple concurrency levels, sustained throughput, warm-up behavior, errors and precise timing boundaries.
• Detection: publish precision, recall, false-positive and false-negative rates by attack category, including benign edge cases and previously unseen attacks.
• Routing: measure the proportion resolved by LEAP, the proportion escalated to RAPID, end-to-end latency for escalations and behavior when either engine fails.
• Total cost: compare infrastructure, model inference, networking, observability and review costs over the same traffic volume and service-level objective.

LEAP’s CPU-based fast path and accompanying financing are established, but its reported performance edge remains a vendor claim. The evidence needed to change that assessment is a reproducible benchmark with named hardware and datasets, or independently published production measurements collected under comparable conditions.

Also read:

• Uzum Moved Beyond $1.5B: Its Latest Valuation Benchmark Is $2.3B
• Ai2’s SERA Is Still Open—but Its $400 Cost Claim Has Limits
• Small Business Holds 67% Public Confidence—Its Local Value Runs Deeper