Both score agents in production and look for failure patterns. Galileo, now Splunk Agent Observability, adds guardrails that act during a run and fits Splunk estates and on-premises buyers; Raindrop is the independent, self-serve option focused on finding recurring failures in live traffic. How you buy software often decides this one.[3][4]
Galileo, now sold as Splunk Agent Observability after Cisco completed its acquisition in May 2026, is an evaluation platform with runtime guardrails that can block harmful tool and model inputs and outputs, while Raindrop is an independent hosted monitor that classifies live agent traffic and groups recurring failures into issues. Galileo is sold annually through Splunk with on-premises options; Raindrop is self-serve with a free tier.
| Decision factor | Galileo | Raindrop |
|---|---|---|
| Ownership | Acquired by Cisco (completed May 2026); sold as Splunk Agent Observability since 7 August 2026 | Independent; Series A led by CRV in September 2026, $50M raised in total |
| Run-time checks | Yes: Agent Control checks model and tool inputs and outputs during a run | None documented |
| Offline evals | Yes: experiments on datasets, including multi-turn | Partial: Workshop runs evals locally; Simulations in early access |
| Production scoring | Metrics on Log Streams with sampling rules; Luna-2 small judge models | Signals on every new event; Issue Detection groups recurring failures |
| Custom judges | Custom LLM judges; code metrics on-premises only in the Splunk edition | Signals drafted from a description; no custom judge prompt or model |
| Deployment | Splunk Observability Cloud, or on-premises including air-gapped | Hosted; Enterprise VPC in beta for select partners |
| Free tier | None listed for Agent Observability | Hobby: 1,000 events a month |
| Paid pricing | From $100 a month per 1.2 million spans a year, billed annually | Pro: $299 a month plus $0.003 per event |
| Capability | Galileo | Raindrop | Prefactor |
|---|---|---|---|
| Observe | |||
| LLM call tracing | ✓ | ✓ | ✓ |
| Multi-step agent tracing (tool calls, nested spans) | ✓ | ✓ | ✓ |
| Cost tracking | ✓ | ✓ | ✓ |
| OpenTelemetry support | ✓ | ✓ | ✓ |
| Evaluate | |||
| Offline evals (datasets, experiments) | ✓ | Partial | ✓ |
| Online evals on production traffic | ✓ | ✓ | ✓ |
| LLM-as-a-judge scoring | ✓ | Partial | ✓ |
| Code-based evaluators | ✓ | Partial | ✓ |
| Human review and annotation | ✓ | Partial | ✓ |
| Prompt versioning and playground | Partial | — | — |
| Act on findings | |||
| Runtime controls on live agent actions | ✓ | — | ✓ |
| Gateway or proxy in the request path | — | — | — |
| Licence and deployment | |||
| Open source | Partial | Partial | Partial |
| Self-hosting | ✓ | Partial | Partial |
Cisco completed its acquisition of Galileo in May 2026, and since 7 August 2026 the product has been sold as Splunk Agent Observability inside Splunk Observability Cloud. Customers onboarded before that date still use Galileo's documentation and app; later customers use Splunk's. Galileo's old pricing page now redirects to Splunk.
Raindrop announced a Series A led by CRV on 17 September 2026, bringing total funding to $50M, and sells directly with a self-serve plan and a 14-day trial. For a Splunk customer, agent evaluation in the same estate is a strong pull towards Galileo. For a team that does not use Splunk, Galileo now means a sales-led, annually billed purchase, while Raindrop can be trialled the same day.
The transition is still visible in the product. There are two documentation sites split by onboarding date, Protect users have had to move to Agent Control, and features keep arriving, such as metric access control in October 2026. Expect packaging to keep settling as the product moves further into Splunk.
This is the clearest product difference. Galileo's Agent Control evaluates model and tool inputs and outputs while an agent runs and can block prompt injection, personal data leaks and harmful content using rules set in one place, without changes to agent code. It replaced the older Protect product in June 2026 and its core is open source under Apache-2.0. Blocking content is documented; approval workflows for actions are not.
Raindrop documents no blocking, guardrails or approvals on live agent actions. It analyses events after they arrive and raises alerts, including in Slack. Its PII Guard add-on redacts data as Raindrop ingests it, which limits what Raindrop stores rather than what the agent does, and Simulations can block a merge in CI before a change ships.
Galileo gives you configurable metrics: preset and custom LLM judges, Autotune to adjust judges from feedback, Luna-2 small models as lower-cost evaluators, and Python code metrics. Metrics set on a Log Stream score incoming production traces with sample rates. It also has its own Signals and Insights engine for failure-mode analysis. One limit to check: the Splunk-hosted edition supports five preset Luna evaluators and no custom code evaluators, which are available on-premises only.
Raindrop builds classifiers for you. You describe a behaviour in plain language and it drafts a Signal that runs on every new event and backfills a sampled 90 days; you cannot bring your own judge prompt or model. Issue Detection groups recurring failures, a Triage Agent investigates them, and Experiments compare signal rates between cohorts of live traffic. Its offline testing is the local, MIT-licensed Workshop tool and Simulations, which is in early access.
Human review is stronger on Galileo, whose Annotation Queues became generally available in August 2026. Raindrop supports labelling samples and dataset members but has no reviewer queue. Neither offers documented prompt version control.
Instrumentation is portable on both. Galileo accepts OTLP traces at its own endpoint, supports OpenInference instrumentors in Python, and has native integrations for the OpenAI Agents SDK, LangGraph, CrewAI, Google ADK, Strands and Microsoft Agent Framework, plus A2A multi-agent tracing. Raindrop accepts OTLP traces over HTTP with gen_ai attributes, without gRPC, metrics or logs, and lists integrations for many of the same frameworks, most of them labelled beta. Neither runs a gateway in the request path.
As of 20 October 2026, Splunk lists Agent Observability from $100 a month per 1.2 million spans a year, billed annually, including 500 million Luna tokens and five Luna fine-tuning runs a year, with no free tier listed for this product. Raindrop's Hobby plan is free for 1,000 events a month, after which ingestion stops until the next month. Pro is $299 a month plus $0.003 per event up to 1M events, then $0.002, with unlimited retention.
Spans and events are different units and the billing periods differ, so compare on your own volumes using Splunk's pricing and Raindrop's plans.
We sell the layer this section describes. Read it with that in mind.
Stated plainly, since Prefactor publishes this page: Prefactor is an agent evaluation platform that scores each step of a run and acts on what it finds through runtime policies on tool calls and data access, approval holds for risky actions, and a kill switch for a run, an agent or a team. Of these two, Galileo's Agent Control is the closest to that, though it blocks content rather than holding actions for approval; Raindrop has no run-time controls. Prefactor is self-serve with a free tier and is not tied to Splunk, but it has no prompt playground or prompt registry and its platform is hosted. See the full comparison of 15 platforms.
Reviewed against public product and documentation pages on October 20, 2026. If a vendor has changed a feature, product name, or positioning since then, send a correction and we will update it. Numbered source links in the page body point to the ordered sources below.
Prefactor scores each step of every agent run and can hold or stop an action when a score says it should not happen. Start on the free tier: 5,000 spans a month, no credit card required.
Prefactor helps teams observe, evaluate, and improve their AI agents in production, across every framework and provider.