Short answer
LayerX, now Akamai Workforce Protector, is a strong choice for controlling AI and SaaS use inside the browser, particularly for existing Akamai customers. Choose Maskflare when you need values restored in the answer, a gateway for your own AI apps, or masking in coding agents and MCP tool calls. Akamai completed the acquisition in 2026.
Acquisitions tend to send buyers looking around, even when the product is good. Roadmaps merge, pricing gets rebuilt into a bigger suite, and the people you dealt with move on. None of that means you should leave LayerX. It does mean it's a sensible time to check that what you need still lines up.
Maskflare wrote this page. LayerX is a respected product with a focused idea, and for browser-centred teams it may well stay the better fit.
What happened to LayerX?
Akamai announced its intent to acquire LayerX on 14 May 2026, and a release dated 2 July 2026 says the acquisition is complete. Akamai's site now calls the product Akamai Workforce Protector (formerly LayerX).
What does it do?
It adds security to the browsers people already use, without asking them to switch. It finds unapproved AI tools, can steer people to an approved one, and watches what's shared with them. Akamai's demo page shows a Social Security number pasted into ChatGPT being stripped out, with the user carrying on and an alert raised. So this isn't a block-only product: it does remove sensitive values from prompts.
It also controls risky browser and IDE extensions, and detects actions initiated by AI agents in the browser. What we couldn't find is whether removed values can be restored in the answer, where detection runs, or how prompts are stored.
Who should choose LayerX?
- The browser is where your risk is. Its control sits there, and it covers SaaS use and extensions as well as AI.
- You're already an Akamai customer. Workforce Protector now sits alongside Akamai's zero trust products, under one vendor.
- You can't install anything outside the browser. For contractors and lightly managed devices, a browser-based control can be easier to roll out than a desktop agent.
- Browser extensions are part of your concern. Controlling risky extensions and agent actions in the browser isn't something Maskflare does.
- You simply need to strip values. If a prompt with the value removed is good enough, you don't need restoring.
Who should choose Maskflare?
- The answer needs the real values. Maskflare masks with reversible tokens and restores them in the reply, so a draft letter comes back addressed to the right person. We couldn't find this documented for Workforce Protector.
- You also build AI apps. Change one base URL and your own apps go through the same rules, for OpenAI, Anthropic, Google Gemini, Mistral, xAI, DeepSeek, Groq, Together AI and Ollama. We couldn't find an API gateway in LayerX's or Akamai's public material on this product.
- AI use isn't only in browser tabs. The desktop agent covers native AI desktop apps and apps that use the system proxy, on Windows, macOS and Linux.
- You use coding agents and MCP. Hooks for Claude Code, OpenAI Codex, Cursor, GitHub Copilot CLI and VS Code agent mode mask tool input and output, and the MCP route masks arguments and results.
- You want EU hosting or on-premises. Maskflare is EU-hosted by default, with on-premises for enterprise. We didn't find hosting details for Workforce Protector.
- You'd rather buy from a focused vendor. Masking AI traffic is all Maskflare does. Whether that's a plus depends on how you buy; a large parent has real advantages too.
LayerX (Akamai) vs Maskflare, feature by feature
| LayerX (Akamai Workforce Protector) | Maskflare | |
|---|---|---|
| Action on sensitive data | Strips values from prompts, per Akamai's demo; vendor summaries also list monitor, warn and block | Mask (reversible), redact, partial, hash, FPE, alert, warn or block |
| Reversible tokens, values restored in the answer | Not publicly documented | Yes, in the browser and in API responses, including streams |
| Where detection runs | Not publicly documented | Inside Maskflare, with no third-party AI service |
| Prompt storage | Not publicly documented | Prompts and responses never stored; encrypted originals kept 30 days, only to restore answers |
| Detector depth and EU national IDs | Not publicly documented | 574 detectors, 47 country packs, 108 checksum validators |
| API gateway for your own apps | Not publicly documented | Yes: change one base URL (9 providers), plus SDKs and REST API |
| Browser apps and desktop agent | Works in existing browsers; desktop agent not publicly documented | 7 AI web apps; desktop agent for Windows, macOS and Linux |
| Coding agents and MCP | Controls risky IDE and browser extensions and detects agent actions; MCP not publicly documented | Hooks for Claude Code, OpenAI Codex, Cursor, GitHub Copilot CLI and VS Code agent mode; MCP route masks arguments and results |
| AI discovery and coaching | Finds unapproved AI tools; warnings with custom messages, per vendor summaries | AI app discovery and coaching dialogs, both on managed devices with the desktop agent |
| EU hosting and on-premises | Not publicly documented | EU by default; on-premises for enterprise |
| Certifications | Not found on the pages we read; ask the vendor | SOC 2 Type II: In progress; ISO 27001: In progress |
What should current LayerX customers ask Akamai?
- Will the product and contract stay as they are, or move into a wider Akamai bundle? When?
- Where do prompts and detection results go, and how long are they kept?
- Can removed values come back in the answer, or does the user fill them in?
- Which EU national ID formats are detected, and are they validated by checksum?
- Is there a plan for API traffic from your own applications?
These apply whichever way you decide. The answers will tell you more about fit than any comparison table, including this one.
None of these questions is a criticism. A large acquirer can bring real benefits: a global network, a bigger security team and long-term support. A smaller independent vendor can move faster on a narrow problem but carries its own risks, and Maskflare is one of those vendors. Ask us the same questions about storage, detection and roadmap, and hold us to the answers in a pilot.
How do you move from LayerX to Maskflare?
- List your policies by outcome. For each rule, note whether it should mask, warn with justification, or block.
- Check app coverage. Maskflare masks in ChatGPT, Claude, Gemini, DeepSeek, Perplexity, Mistral Le Chat and Microsoft 365 Copilot. For other AI tools, you'll need a separate control, or you can block them from the desktop agent's discovery view.
- Decide what to do about extensions. Maskflare doesn't manage browser extensions, so you may want to keep that control elsewhere.
- Deploy the desktop agent. Enforcement is on the network path, so it works across Chrome, Edge, Firefox, Safari and Arc. Roll out with Intune, Jamf or Group Policy.
- Run both briefly. Alert mode for a week on a small group, then switch to mask and remove the old control from that group.
What Maskflare doesn't do
- It doesn't manage browser extensions or act as a general browser security tool.
- It needs the desktop agent or forward proxy for web apps, which is harder on devices you don't manage.
- AI app discovery and coaching dialogs need the desktop agent on managed devices; personal phones and unmanaged laptops are out of reach.
- Prompt-injection detection runs on MCP tool results and tool listings, not on chat prompts, and there's no topic filtering.
- SOC 2 Type II and ISO 27001 audits are in progress. If you need a finished report today, factor that in.
Sources and how we checked
Based on public information as of November 3, 2026. Maskflare wrote this page, and vendors change their products, so check anything that matters with the vendor. “Not publicly documented” means we couldn't find it, not that the product lacks it. If something here is wrong, tell us and we'll correct it.
- akamai.com/newsroom/press-release/2026/akamai-technologies-announces-intent-to-acquire-layerx-advancing-its-workforce-security-strategy-with-ai-usage-control
- akamai.com/newsroom/press-release/akamai-completes-acquisition-of-secure-enterprise-browser-provider-layerx
- akamai.com/resources/video/akamai-workforce-protector-demo-video
Frequently asked questions
Did Akamai buy LayerX?
Yes. Akamai announced the deal on 14 May 2026, and a release dated 2 July 2026 says it's complete. The product now appears as Akamai Workforce Protector (formerly LayerX).
Does LayerX mask or just block?
It removes sensitive values too: Akamai's demo shows a Social Security number stripped from a ChatGPT prompt while the user keeps working. We couldn't find whether the value can be restored in the answer.
Is LayerX a browser extension?
Vendor and reseller material describes it that way. Akamai's own pages say it adds security to existing browsers, without using that word on the pages we read.
Do I need to leave LayerX because of the acquisition?
No. An acquisition isn't a reason on its own. Ask about contract and roadmap, then decide on fit.
Does Maskflare work without a desktop agent?
For your own apps, yes: the gateway and SDKs don't need one. For people in web apps, traffic is routed by the desktop agent or the forward proxy.
Is Maskflare owned by a larger company?
No. Maskflare is independent. That means a narrower product and a smaller company, which is worth weighing against the backing of a large parent.
About the author
Guides from the engineers who build Maskflare's gateway, detection engine, desktop agent and SDKs. Every code sample is run against the product before it's published, and every limit we mention is one we hit ourselves.