How are customers using the F5 AI Security Platform?

Mark TolerProduct Marketing Manager | F5

“One-size fits all” can’t be the goal when it comes to AI security. What organizations should be seeking in their AI security platform is one solution that can be tailored to meet all their security needs.If my “out-of-the-box” controls sufficiently address my needs, fantastic! But the reality is that AI shows up very differently at a global bank versus a healthcare provider versus a retail operation, which means security needs typically vary.

Introduced earlier this year, the F5 AI Security Platform deliversthe most adaptable platform for securing AI apps, services, models, and agents. So how are customers using it? And what concerns is it addressing?

The foundation is still about stopping prompt injection

The top concern almost all of our customers start with is prompt injection, which your vendor should absolutely be able to address with high efficacy.In OWASP’s Top 10 for LLM 2026, prompt injection once again holds the top spot, because it is one of the easiest to execute, and the blast radius includes the entirety of data, action, and tool permissions a given AI model or agent has. For the majority of our customers our 99.3% validated efficacy against direct prompt injection provided by the F5 AI Security Platform, is enough for most production use cases. But that protection also has to hold up as usage grows.

One global investment bank came to that challenge with live applications already processing roughly 100,000 AI prompts a day and an ambition to extend security coverage to hundreds of applications. Its cyber controls team needed to maintain peak threat detection accuracy, measured by F1 score, even as workloads escalated. The bank selected F5 AI Guardrails, part of the F5 AI Security Platform, to inspect AI interactions inline, applying prompt injection protection to every application and layering PII protection on top for highly sensitive use cases. Initial deployment in audit mode demonstrated improved threat detection accuracy, while meeting the bank’s requirement to maintain peak F1 accuracy as workloads expanded.

Scale isn’t the only reason customers build on that foundation. We have also seen customers with exceptionally low risk tolerances layer in their own threat protection guardrails based on specific attack patterns they anticipate or have already seen at runtime. Thanks to our native integration with NVIDIA’s Nemo Guardrails as well as F5 AI Guardrails’ natural language guardrail creation, customers with similar risk appetites are leveraging the full host of options available to them in bringing a defense in depth strategy to prompt injection.

Content moderation and compliance is the next layer

Once customers have “locked the front door” with their threat protection controls, we see the conversation shift to content moderation and compliance. In the past year of talking to customers, I have heard of more compliance standards and risk management frameworks (RMFs) than I can count, including AI-specific compliance standards, organization-specific RMFs, team-specific and region-specific responsible AI policies. If your AI security platform doesn’t allow you to create your own custom policies and then benchmark how well those controls perform, AI governance stops being actionable and starts becoming lip service.

For another customer, one of the world’s largest global systemically important banks (G-SIBs), that need for evidence was holding up adoption. The bank had more than 50 AI use cases ready to launch across departments including human resources, procurement, and cybersecurity, but its internal auditors had no way to validate that the systems were safe to deploy.

The bank selected the F5 AI Security Platform, combining out-of-the-box and custom guardrails driven by its centralized AI and security teams with testing of how its AI systems actually behaved. Testing demonstrated protection rates above 90% across PII exposure, prompt injection, jailbreaks, and malicious content. Reporting aligned to EU AI Act and ISO/IEC 42001 requirements gave auditors the security evidence they had been missing. With the security architecture validated, the bank was positioned to move ahead with use cases that had previously been blocked.

That is just one concrete example of making governance actionable. Through the custom policy authoring in the F5 AI Security Platform, we have seen customers create controls for use cases even the excitable marketer in me would’ve never dared to claim as supported. Approximately 38% of all guardrails and policies our customers have in production are 100% customer-created. That is resounding evidence that customization is not a “nice to have” but a “need to have” at this stage of global AI adoption.

It’s not on-prem vs SaaS. It’s about flexibility.

F5 is known for delivering and securing every app and API in any environment. The same philosophy extends to securing AI workloads. The way we see it, the goal of an AI security platform should be to fit into existing architectures and sovereignty needs without caveats.

Even these two banking customers took different approaches. The investment bank selected F5 AI Guardrails self-hosted within its enterprise cloud environment rather than as a SaaS service, giving its cyber controls team full command over where AI traffic is processed and how data is handled. The G-SIB customer chose to self-host the F5 AI Security Platform using dedicated, on-premises infrastructure that the bank fully owns and controls.

Many of our customers deploy our platform on-premises, sometimes fully air-gapped if their use case demands it. For our customers deploying the platform via SaaS, the option to bring inspection and enforcement fully on-prem if they later have a use case that requires it has been a major point of differentiation. Data sovereignty has become a requirement for many of our customers, and others elect to adhere to a similar self-imposed standard. With the capital, IP, and knowledge worker investment our customers are putting into AI, it’s no surprise to see privacy as non-negotiable.

The fit is the point

What we keep hearing from customers is that they want strong protection out of the box, but they don’t want those existing controls to dictate the limits of what they can govern. They have their own risks to account for, policies to enforce, and environments that aren’t going to change just to accommodate a vendor’s limitations. That’s why an adaptable platform is critical, and our customers are already reaping the benefits.

To learn more, visit our F5 AI Security Platform webpage. Also, check out our on-demand F5 Post-Mythos Security Summit.

About the Author

Mark TolerProduct Marketing Manager | F5

More blogs by Mark Toler