F5 Workforce AI Security for managing and monitoring AI use

AI use is increasing both productivity and security risks

Somewhere in your organization, a deadline is about to pass, and an employee is about to paste confidential data into an AI tool to finish a presentation. In seconds, sensitive information may leave approved controls, with no policy evaluating what was submitted, and no audit trail capturing the exchange. In many cases, the event will not register in any security or governance system at all. This does not happen because employees ignore controls. It happens because most controls were never designed for how AI is actually used.

So, the question is not whether AI will be used. It is whether you can see how it’s used, govern it, and keep it compliant without pushing teams toward riskier workarounds.

As AI adoption accelerates, so do security blind spots, especially from shadow AI, the unsanctioned use of AI tools outside IT's visibility or control. This whitepaper examines where traditional controls fall short, why shadow AI is more pervasive than many leaders realize, and how solutions like F5 Workforce AI Security provide a scalable path to responsible, secure AI adoption.

Most popular AI apps

Figure 1: The most popular AI apps based on percentage of organizations using those applications.

Why legacy security architectures fall short for AI

Most enterprise security architectures were built to protect two things: human users and sensitive data. But AI introduces a third actor: autonomous AI agents that operate at machine speed, often using human credentials, and interacting with systems across distributed tools and environments. This shift breaks many of the foundational assumptions behind traditional security controls, which were not designed to govern what these agents can access, decide, or expose. As a result, even well-secured organizations face a new class of risk that their existing DLP, CASB, and IAM tools were not built to address.

Figure 2: State of securing AI according to IBM

Source: Securing AI: What Matters Now,” IBM/AWS

Specific shortcomings of traditional enterprise security systems relating to AI usage include:

• Data Loss Prevention (DLP) solutions were never designed to understand prompt intent, model context, or AI-generated responses. They can tell you that data left the system, but not why, how, or what the model did with it. As a result, interactions that embed sensitive content inside free-text prompts, conversational flows, tool chains, or outputs often bypass detection entirely. Even with DLP policies in place, violations persist: source code accounts for 46% of flagged incidents, regulated data 35%, and intellectual property 15%.
• Cloud Access Security Brokers (CASBs) were not designed to analyze prompts, interpret sensitive data embedded in free text, or track chained AI actions across tools and models. While CASBs, and their modern counterparts like ASE platforms, can block or allow access to AI apps at a high level, they offer no visibility into what happens once access is granted. Blocking AI tools outright often leads to shadow AI; allowing access without contextual controls leaves enterprises blind. F5 Workforce AI Security complements CASBs by operating at the AI interaction layer, delivering real-time visibility into prompts, model behavior, and agent activity, across both sanctioned and unsanctioned AI tools.
• Identity and Access Management (IAM) was designed to authenticate human users, not to govern AI agents acting on a user's behalf. While IAM can confirm who initiated a session, it cannot control what is submitted to an AI model, how an agent chains together tools, or what actions are taken in response. Once an AI agent begins operating under valid credentials, IAM loses visibility into downstream behavior, leaving organizations exposed to unintended or unauthorized actions initiated by the model.

DLP, CASB, and IAM each operate within well-defined perimeters: networks, applications, and user identities. But AI usage cuts across all of them at once, often outside sanctioned workflows. Prompts originate in browsers, sensitive data flows to external models, and AI agents act under borrowed credentials. The result is partial visibility at best, and complete blind spots at worst. Traditional architectures simply were not built to govern this type of interaction, which is why enterprises need a new layer of control that understands how AI actually works.

Even mature organizations with layered security stacks often lack the controls and visibility to understand how employees are using AI. Relying on legacy security tools is not sufficient as the risk landscape expands with accelerated AI usage.

Relying on DLP solutions to secure AI interactions is especially troubling for organizations. Despite double-digit growth from 24% to 42% in 2024, they continue to present significant threats to data leakage.

Figure 3: Data Loss Prevention (DLP) continues to grow but still causing issues

Source: “AI Apps in the Enterprise,” Netskope, 2024

The shadow AI problem: Real-world workforce risks

Perhaps the most widespread and under-acknowledged AI risk is the rise of shadow AI, the unapproved or unmanaged AI usage by employees. These behaviors often emerge not from malicious intent, but from a desire to be more productive, solve problems faster, or experiment with new tools.

Unfortunately, these good intentions create significant risks when security teams lack visibility, context, and control.

According to Menlo Security’s 2025 Report:

• 69% of employees use free-tier AI tools via personal accounts
• 57% of employees input sensitive data

Without governance, this means shadow AI usage can:

• Expose PHI, PII, or confidential IP to external models
• Violate internal data classification and compliance policies
• Feed sensitive content into AI tools that retain input for model training

These types of incidents are not rare. Shadow AI usage is growing across all departments:

• Marketing: using ChatGPT or Copilot for campaign ideation, ad copy, and content drafts
• Legal and compliance: running contract redactions or billing reviews via Copilot or private LLMs
• Engineering: leveraging internal LLMs or open-source models for code generation, RAG pipelines, and automation

F5 Workforce AI Security maps usage to roles and enforces relevant security policies to enable safe, compliant, and responsible AI usage at scale.

Source: Menlo Security's 2025 Report

How F5 Workforce AI Security enables secure workforce AI adoption

F5 Workforce AI Security is purpose-built for the governance challenges AI adoption creates. Traditional tools focus on static data and access rights. Workforce AI Security governs the dynamic interactions that make AI risky: the prompts employees send, the context that travels with them, the tools AI agents call, and the actions those agents take.

The solution sits in the path of AI traffic and inspects it as it happens. Security teams can remove sensitive information before it reaches a model, apply policy based on who is asking and what they are trying to do, and keep traceable records of what happened and why. It governs what models see and do, not just where data lives. Key benefits include:

Discover: Gain complete visibility

• Surface AI activity across public, embedded, and internal tools
• Map usage by user, department, device, and service or model
• Generate detailed audit logs for compliance and incident response

Protect: Mitigate risk in real time

• Intercept unsafe prompts and redact sensitive data before it reaches models
• Enforce dynamic policies based on user role, service or model, and prompt context
• Redirect shadow AI to approved private instances (for example, Amazon Bedrock) through a secure portal

Enable: Scale securely and responsibly

• Provide guardrails without limiting productivity
• Integrate seamlessly with SIEM, IAM/SSO, and MDM/SASE tools
• Allow users to work inside branded, secure portals that connect to trusted models while preserving enterprise controls

Adapt: Evolve governance over time

• Analyze usage data to refine AI policies and training
• Identify emerging patterns, shadow usage, or policy gaps
• Support continuous improvement of governance practices

F5 Workforce AI Security helps organizations gain enterprise-wide visibility of AI usage in minutes without reconfiguring existing tools. By mitigating sensitive data exposure, it enables responsible AI usage and ensures compliance with evolving regulatory mandates.

From chaos to control

Enterprises no longer need to choose between innovation and risk. AI can be adopted securely at scale, but only with governance models that match the realities of how it is used.

F5 Workforce AI Security empowers organizations with real-time visibility, dynamic policy enforcement, and integration across existing stacks. It gives CISOs the tools they need to make AI policies actually work in practice, with auditability, scalability, and flexibility built in.

Learn more about F5 Workforce AI Security.

PUBLISHED SEPTEMBER 4, 2026