Skip to main content

Decision brief

Portkey Review: A Governed AI Gateway, Now Palo Alto Networks' Prisma AIRS AI Gateway

Buy Portkey for request logs, guardrails, and audit logs on your own model keys. Price Enterprise for budgets and SSO, and do not self-host the open-source gateway while its SSRF bypass stays open.

Reading time
3 min read
Sources
12 cited
In this piece
Portkey0 Mixed

GILD verdict

Adopt Portkey when security wants every model call on your own keys logged, filtered, and audited without the team running a logging stack.

Buy the hosted or hybrid service with Enterprise for budgets, SSO, and audit logs, and do not self-host the open-source gateway while it merges no fixes and its July 2026 SSRF bypass stays open.

Portkey

AI Gateway by Palo Alto Networks

0 Mixed
Product page

Fit and limits

Who it fits

  • Model access runs on your own keys with each model maker, and you want one gateway in front of them with fallbacks and load balancing.
  • Security asks for a log of every request with its cost and user, guardrails on prompts, and an audit log of admin actions.
  • LLM traffic must stay in your VPC, which the hybrid setup allows while Portkey runs the control plane.
  • You want request logs, traces, and alerts hosted for you, priced by recorded logs so seat count doesn't set the bill.

Where it falls short

  • The open-source gateway has had no push since May 25, 2026 and no release since v1.15.2 on January 12, 2026. A researcher disclosed on July 3, 2026 that the deprecated /v1/proxy/* route bypasses the SSRF allowlist, after an email report on June 1 got no answer, and the issue was still open on October 28, 2026.
  • Provider translation is where practitioners report most failures: dropped Gemini system messages and tool calls, Bedrock cache checkpoints that fail requests, Azure Responses calls silently rewritten, and HTTP 500 on the Messages route for OpenAI and Google models.
  • Streams that a provider drops mid-answer end with HTTP 200 and no error, and the configured fallback is never tried, so a client can show a short answer as complete.
  • Budget and rate limits on API keys, SSO, custom retention, and audit logs need Enterprise or select Pro terms, and Palo Alto Networks publishes no Prisma AIRS AI Gateway price.

Implementation reality

  1. Choose the hosting before the plan

    Use Portkey cloud when logs may leave your network, and the hybrid setup when LLM traffic must stay in your VPC, with Portkey's control plane handling configs and analytics. Self-host the open-source gateway only behind a network policy that blocks the /v1/proxy/* route until the SSRF bypass is fixed.

  2. Test every provider route you depend on

    Run your real requests through each provider and endpoint you use, including streaming, tool calls, prompt caching, and the Messages and Responses formats, and compare usage with the provider's own figures. Open issues show these paths losing fields or failing without an error.

  3. Put keys, budgets, and logs in place

    Add each model maker's key to the Model Catalog once and give each team a workspace and API key. Key budgets and rate limits need Enterprise or select Pro terms, so confirm them in the contract before relying on them, and set retention to match what security allows Portkey to keep.

  4. Settle terms with Palo Alto Networks

    Ask in writing how long the portkey.ai plans keep their current prices and terms, whether your contract moves to Prisma AIRS AI Gateway, and where Portkey's SOC 2 and ISO 27001 reports and DPA now sit.

What to measure in your pilot

  • Track the open-source gateway's commits, releases, and issue #1718 monthly; self-host it only after a release fixes the SSRF bypass and merges land again.
  • Log every provider route failure you hit in the first quarter; if one breaks production traffic, pin that route to direct calls until a fix ships.
  • Ask Palo Alto Networks for the Prisma AIRS AI Gateway price and migration date at renewal, and reprice against LiteLLM and OpenRouter when it arrives.

Sources

Official documentation
9
Public source
3
  1. Portkey pricingOfficial documentationportkey.ai
  2. Portkey home page (Prisma AIRS AI Gateway notice)Official documentationportkey.ai
  3. Portkey docs: Enterprise offeringOfficial documentationportkey.ai
  4. Portkey docs: Audit logsOfficial documentationportkey.ai
  5. Portkey docs: Model CatalogOfficial documentationportkey.ai
  6. Portkey docs: Enforce budget and rate limits for API keysOfficial documentationportkey.ai
  7. Portkey docs: Hybrid deployment architectureOfficial documentationportkey.ai
  8. Portkey-AI/gateway on GitHub (MIT license, last push May 25, 2026, last release v1.15.2)Official documentationgithub.com
  9. Palo Alto Networks: General availability of Prisma AIRS AI Gateway (Jul 16, 2026)Official documentationpaloaltonetworks.com
  10. Palo Alto Networks Form 10-K for the fiscal year ended Jul 31, 2026: Portkey acquisition completed May 29, 2026Public sourcesec.gov
  11. Portkey-AI/gateway issue #1718: SSRF allowlist bypass via the /v1/proxy/* route, gateway 1.15.2 and earlier (Jul 3, 2026)Public sourcegithub.com
  12. Portkey-AI/gateway issue #1797: a stream dropped mid-answer ends with HTTP 200 and no fallback (Sep 9, 2026)Public sourcegithub.com

Keep reading

  1. Buyer guidePortkey Deployment & Ownership ChecklistChoose between Portkey cloud, a hybrid data plane in your VPC, and the open-source gateway. Then settle plan terms, budgets, retention, and audit logs with Palo Alto Networks before rollout.
  2. ResearchAI Gateways in Practice: What Teams Report About LiteLLMWhat 127 public accounts, Okta's and Zalando's company gateways among them, report about running LiteLLM: budgets, failures, coding-tool setups, and moves to OpenRouter, Portkey, Bifrost, or custom code.
  3. ComparisonLiteLLM vs Portkey: Open-Source Gateway or Governed Platform?LiteLLM gives free key budgets in a proxy you run; Portkey, now part of Palo Alto Networks, hosts observability for you. Team accounts, a monthly bill at one workload, licensing, budgets, and hosting compared.
Read the research