--- title: NetScaler AI Gateway description: Learn how Citrix helps organisations deliver secure access, protect applications, and support hybrid work through a unified platform for modern workplaces. image: https://www.cxanz.com/hubfs/AUS-CXA-080-Blog-5-1.jpg --- [![CXANX+Citrix LockUp Black](https://www.cxanz.com/hs-fs/hubfs/CXANX+Citrix%20LockUp%20Black.png?width=300&height=40&name=CXANX+Citrix%20LockUp%20Black.png "CXANX+Citrix LockUp Black")](https://www.cxanz.com/) [![CXANZ+Citrix LockUp Black RGB](https://www.cxanz.com/hubfs/Australia/Projects/CXANZ/AUS-HSM-CXANZ/Brand%20Assets/CXANZ+Citrix%20LockUp%20Black%20RGB.svg "CXANZ+Citrix LockUp Black RGB")](https://www.cxanz.com/) - [Home](https://www.cxanz.com) - [Partners](https://www.cxanz.com/partners) - [Customers](https://www.cxanz.com/customers) - [Blog](https://www.cxanz.com/blog) - Resources - [Find a Partner](https://www.cxanz.com/psp-partners) - [Contact Us](https://www.cxanz.com/meet-the-team) - [Home](https://www.cxanz.com) - [Partners](https://www.cxanz.com/partners) - [Customers](https://www.cxanz.com/customers) - [Blog](https://www.cxanz.com/blog) - Resources - [Find a Partner](https://www.cxanz.com/psp-partners) - [Contact Us](https://www.cxanz.com/meet-the-team) # NetScaler AI Gateway By [**Wayne Baker**](https://www.cxanz.com/blog/author/wayne-baker) on Nov 4, 2026, 10:41:50 AM ![\NetScaler AI Gateway\](https://www.cxanz.com/hs-fs/hubfs/AUS-CXA-080-Blog-5-1.jpg?width=1920&height=1080&name=AUS-CXA-080-Blog-5-1.jpg) # You've governed the browser. Now govern the prompt. *My previous posts focused on governing what happens inside the browser — or, more broadly, within the user workspace. This one looks at what happens beyond that: along the path between the application and the model it is calling. It is a different layer, and a different problem. And, for most organisations I speak to, it remains largely unaddressed.* I've been in a pattern of conversations lately where a CISO tell me they have done the right things: Citrix SecurAccess with Chrome Enterprise deployed, browser governance in place, personal AI tool access controlled at the surface. They've addressed the problem I described in those earlier posts — the ungoverned browser, the invisible paste-to-AI, the shadow identity gap. They've closed that loop. And then we get to my a few more of my new favourite questions: ![](https://www.cxanz.com/hs-fs/hubfs/image-png-Oct-13-2026-08-36-43-7563-PM.png?width=617&height=549&name=image-png-Oct-13-2026-08-36-43-7563-PM.png) **Figure 1: Four questions a CISO should be able to answer** These questions may be provocative, but they are not unreasonable. Any organisation running sanctioned AI services at scale ought to be able to answer them — across its full AI estate, not merely within the surface area of a single vendor. The fact that many cannot is not, strictly speaking, a failure of governance. It is an architectural gap. The silence that follows is not because these teams have failed to think seriously about AI governance. In most cases, they have. They have done the work at the browser layer. The difficulty is that the browser layer and the prompt layer are not the same thing: they sit at different points in the stack, present different control problems, and in most organisations only one of them has been properly addressed. **Why the browser layer doesn't answer these** In a previous post, I pointed to a layer in the architecture stack — the purple block between the sanctioned AI application and the foundation model — and said we would come back to it. This is that discussion. Citrix SecurAccess with Chrome Enterprise governs what the user does in the browser. It can stop someone pasting customer data into a personal ChatGPT session, block access to unsanctioned AI tools altogether, and apply DLP controls at the point where the user interacts with the browser surface. That is real and useful capability, and it addresses the shadow AI problem described earlier. The complication comes one layer further down. When an organisation runs a sanctioned internal AI application — a customer service tool, a document summarisation service, a code assistant, a financial analysis platform — that application is making API calls to a foundation model on the user’s behalf. The prompt is not coming from a user typing into ChatGPT. It is being assembled programmatically by the application and sent directly to the model. Citrix SecurAccess with Chrome Enterprise does not see that call, because it is not a browser action. Prompt-level governance tools do exist. Microsoft Purview can inspect prompts within the Microsoft 365 Copilot surface. AWS Bedrock Guardrails can govern applications built on Bedrock. Both are genuine, shipping capabilities, and both are worth understanding. The practical constraint, however, is that each is confined to its own estate. Purview governs Microsoft’s surface. Bedrock Guardrails governs what runs on AWS. Neither governs an application calling OpenAI directly through the API. Neither governs a tool your team built on Google Vertex. And neither provides a consolidated view across the whole environment. Most organisations running AI at any meaningful scale are not doing so through a single vendor platform. They are running multiple sanctioned applications, calling multiple models, across multiple clouds — each with, at best, its own governance approach. The result is a familiar enterprise problem: fragmented controls, no single view, and gaps between estates. It is, in other words, the sort of problem Citrix has spent the past thirty years dealing with at the application layer. Citrix has always been the vendor-agnostic layer between the user and whatever application they need, regardless of where it lives. NetScaler AI Gateway applies the same principle one layer deeper – between your application and the model it’s calling – with the same intent: consistent governance across your AI estate, not just the part one vendor can see. **What governance at the prompt layer looks like** NetScaler AI Gateway sits on that path — across all of it, regardless of which model or which cloud. It's not a browser control and it's not a network firewall. It's a vendor-agnostic governance layer that intercepts the call between your application and the model and applies consistent policy to it. The four capabilities map directly to the four questions. ![](https://www.cxanz.com/hs-fs/hubfs/image-png-Oct-13-2026-08-37-11-3482-PM.png?width=940&height=644&name=image-png-Oct-13-2026-08-37-11-3482-PM.png) *NetScaler AI Gateway — governs the application-to-model path* *Access Plane (Citrix Workspace and SecurAccess with Chrome Enterprise) — governs the user-to-app / AI surface (Previous blogs)* **Figure 2 — Inside the NetScaler AI Gateway layer** The gateway is the enforcement point rather than the inspection engine itself: through NetScaler's existing policy framework it routes the outbound prompt to a specialised inspection service and acts on the verdict before the call reaches the model. The integrations make that concrete: Protecto for semantic PII detection, masking and tokenisation; Enkrypt AI's LLM firewall for prompt-injection and data-exfiltration checks; and provider-native filtering such as Azure OpenAI's. The provider changes; the architecture does not — the vendor-agnostic principle Citrix has always applied, now one layer deeper. In my experience, cost attribution is usually the capability that lands first with CFOs and finance leadership — not because the others matter less, but because “we have no idea what this is costing us by team” is a problem finance people recognise immediately. They saw a version of it with the cloud playbook, and most would rather not repeat the exercise. DLP and audit capabilities tend to resonate first with the CISO and legal team, usually in that order. The model catalogue question tends to land with the CTO, particularly once the model-substitution risk is understood. So when I describe NetScaler AI Gateway in a customer conversation, I have learnt to ask who is in the room before deciding which capability to lead with. The underlying problem is the same — the gap on the model-call path — but the way it presents itself depends on which role is feeling it most directly. **Where this sits in the Citrix story** NetScaler AI Gateway is a NetScaler capability, and NetScaler is already part of the Citrix platform stack in most organisations running Citrix infrastructure. This is not a separate product category to evaluate or a new vendor relationship to establish. It is the same NetScaler platform already sitting on the network path in Citrix deployments, doing what NetScaler has long done: governing what passes through it, now including the path between the application and the model it is calling. That matters for a practical reason. In most organisations, the conversation about AI governance is taking place in two separate rooms at once: in security, where the CISO is trying to get a handle on the risk, and in the business, where teams are adopting AI tools faster than anyone can sensibly govern them. The distance between those discussions is where many governance frameworks begin to unravel. An architecture built on existing platform components, rather than the introduction of yet another vendor into the stack, stands a much better chance of being implemented before the problem becomes more difficult — which, if left unattended, it usually does. For Citrix customers, the useful conversation to have is with the account team about what NetScaler is already doing in the environment and what prompt-level governance could look like on top of it. That is a configuration conversation rather than a procurement one, which makes it rather different from the AI governance discussions many organisations are currently having with net-new vendors. So — back to those four questions from the opening. With the complete architecture in place — Citrix SecurAccess with Chrome Enterprise governing the browser surface, NetScaler AI Gateway governing the model-call path — here's what changes. ![](https://www.cxanz.com/hs-fs/hubfs/image-png-Oct-13-2026-08-37-22-1790-PM.png?width=774&height=524&name=image-png-Oct-13-2026-08-37-22-1790-PM.png) **Figure 3 — The same four questions, answered** The next post will bring the whole series together — one architecture, every layer, from the user to the model — and I'll try to make it short enough that people actually read it to the end. We'll see how that goes. 1. Using NetScaler WAF to protect LLMs, MCP vulnerabilities - [https://community.citrix.com/techzone-blogs/netscaler/security-challenges-with-llms-and-mcp-servers-implementations-r1240/](https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.citrix.com%2Ftechzone-blogs%2Fnetscaler%2Fsecurity-challenges-with-llms-and-mcp-servers-implementations-r1240%2F&data=05%7C02%7CWayne.Baker%40dickerdata.com.au%7C4fc7560173f24add80e808decc4f3bc4%7C6e417ab358de417d9aaada5837716c4c%7C0%7C0%7C639172837879297165%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=CJo0Dq6P7iMt0kdsnZT81WhQL1MQxmre7lzyqjCwnMQ%3D&reserved=0) 2. Integration with Azure OpenAI Content filtering to prevent prompts and responses against harmful or non-compliant categories, covering violence, hate, sexual content, and self-harm across multiple severity levels - [https://community.citrix.com/techzone-blogs/netscaler/netscaler-ai-gateway-azure-openai-centralized-content-filtering-at-the-gateway-r1277/](https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.citrix.com%2Ftechzone-blogs%2Fnetscaler%2Fnetscaler-ai-gateway-azure-openai-centralized-content-filtering-at-the-gateway-r1277%2F&data=05%7C02%7CWayne.Baker%40dickerdata.com.au%7C4fc7560173f24add80e808decc4f3bc4%7C6e417ab358de417d9aaada5837716c4c%7C0%7C0%7C639172837879338732%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=03N7qYMAN2d8rLEw1J1ZWcoto1RmKiZdc33715IXVGE%3D&reserved=0) 3. Integration with Enkrypt AI to prevent prompt injection, PII leakage - [https://community.citrix.com/techzone-blogs/netscaler/netscaler-integration-with-enkrypt-ai-r1250/](https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.citrix.com%2Ftechzone-blogs%2Fnetscaler%2Fnetscaler-integration-with-enkrypt-ai-r1250%2F&data=05%7C02%7CWayne.Baker%40dickerdata.com.au%7C4fc7560173f24add80e808decc4f3bc4%7C6e417ab358de417d9aaada5837716c4c%7C0%7C0%7C639172837879376356%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=4xeigWgwzqao1da%2Bf7Dna6VlrYRsrovtJm3uKTLDNJg%3D&reserved=0) 4. Integration with Protecto to prevent PII leakage - [https://community.citrix.com/techzone-blogs/netscaler/netscaler-ai-gateway-protecto-semantic-pii-protection-for-enterprise-llm-traffic-r1258/](https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.citrix.com%2Ftechzone-blogs%2Fnetscaler%2Fnetscaler-ai-gateway-protecto-semantic-pii-protection-for-enterprise-llm-traffic-r1258%2F&data=05%7C02%7CWayne.Baker%40dickerdata.com.au%7C4fc7560173f24add80e808decc4f3bc4%7C6e417ab358de417d9aaada5837716c4c%7C0%7C0%7C639172837879413052%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=DRaE0tVXKRxvDIxVI%2BqKF2ExKSzG17prgpfO2Y4IyqU%3D&reserved=0)   Previous Blog [← Finalists Announced: CXANZ | Citrix 2026 Partner Appreciation & Awards](https://www.cxanz.com/blog/finalists-announced-for-the-inaugural-cxanz-citrix-2026-partner-appreciation-awards) ![CXANX+Citrix LockUp White](https://www.cxanz.com/hs-fs/hubfs/CXANX+Citrix%20LockUp%20White.png?width=300&height=40&name=CXANX+Citrix%20LockUp%20White.png) Cloud Software Group and any trademarks, service marks, trade names, and logos of Cloud Software Group (including Citrix and NetScaler) are owned by Cloud Software Group, Inc. and/or its affiliates and are used by Dicker Data under license from Cloud Software Group, Inc. Dicker Data Ltd is a strategic partner of Cloud Software Group, Inc. and is not a corporate subsidiary or agent of Cloud Software Group, Inc. and/or of its affiliates. Copyright © 2026 Dicker Data Ltd. All rights reserved. ABN 95 000 969 362 - [Privacy Policy](https://www.cxanz.com/privacy-policy) - [LinkedIn](https://www.linkedin.com/company/cxanz) - [YouTube](https://www.youtube.com/@CXANZCitrix) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Wayne Baker", "url" : "https://www.cxanz.com/blog/author/wayne-baker" }, "dateModified" : "2026-11-03T23:41:50.695Z", "datePublished" : "2026-11-03T23:41:50.000Z", "headline" : "NetScaler AI Gateway", "image" : [ "https://www.cxanz.com/hubfs/AUS-CXA-080-Blog-5-1.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.cxanz.com/blog/netscaler-ai-gateway", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.cxanz.com/hubfs/assets/logos/CXANZ-DD-AU.svg" } } } ```