From Chaos to Cohesion: Managing Digital Sprawl and AI Risk

F5 Newsroom Staff

Digital sprawl is not a new phenomenon. Many, probably most, organizations have experienced it as they grow. Groups and departments add purpose-built applications, tools, and solutions without informing IT, and those tools don’t integrate into existing systems effectively. Sometimes IT teams deploy applications that are redundant in some aspects while other features go unused. Sometimes applications fall out of use and become zombies on the system—not quite dead, but never updated, never removed, and rife with vulnerabilities. And sometimes, it’s not the organization or its groups: the larger landscape is involved. The advent of the cloud for computing, storage, collaboration, and so much more, followed by the Covid pandemic, the seismic shift to working from home, and the scattershot system governance that took place during those chaotic times certainly contributed to every organization’s explosive digital sprawl—especially when it came to security.

At first glance, deploying multiple tools across an organization’s cybersecurity infrastructure might seem like a rational, risk-averse, comprehensive approach. However, when discrete security tools and solutions proliferate across an infrastructure, they can introduce significant challenges and risks, such as:

• Solutions that operate in isolation, unable to communicate or share information with each other, and, therefore, unable to contribute to a holistic view of the organization’s security posture. This fragmentation hinders the ability to correlate and analyze security events and alerts, leading to delays in incident response, increased complexity in managing security incidents, and potentially missed threats.
• Lack of integration and visibility, which makes it difficult to monitor and control data flows, resulting in blind spots where sensitive data may leak or be accessed without proper authorization.
• Redundancy, which leads to conflicting or inconsistent security measures, wasted resources, increased complexity, and challenges to maintaining and updating security systems.
• Inconsistent authorization tools and/or protocols, which can inadvertently provide access to critical data to the wrong people.

Careful review followed by ruthless consolidation to streamline the security infrastructure is clearly one path to follow. But even that path has its pitfalls: when a new technology, such as generative artificial intelligence (GenAI), is introduced into an organization’s digital ecosystem, nothing in the existing security apparatus can help. The risks of deploying a GenAI model or large language model (LLM) across an organization with no security measures in place are well documented: unintentional loss of intellectual property or proprietary, confidential, or sensitive data via poorly written queries; the introduction of bad or even malicious code via LLM responses that employees aren’t equipped to assess; the inadvertent dissemination of false or inaccurate information gleaned from an LLM’s response, but not verified; and so, so many others.

It’s no surprise that new risks require new remedies. Those nascent remedies should include, at a minimum, some technical solutions, a governance framework, and ongoing efforts, such as:

• Specialist scanners to perform content moderation and filtering for prompt inputs and model responses, in order to identify and block those containing malicious or otherwise inappropriate content
• Ethical guidelines that align users’ model interactions to the organization’s values and standards
• Fact-checking capabilities to verify information and flag inaccuracies or misinformation before it is incorporated into company content
• Model agnosticism to avoid vendor lock-in and issues with provider limitations
• Full visibility across the system so security personnel can see what’s going on in real time
• A comprehensive set of policies and procedures governing the ethical and responsible use of the models to ensure transparency, accountability, and adherence to company, industry, or regulatory requirements
• Role- or policy-based access controls to ensure only authorized personnel have access to the models, data, and features they need to perform their duties
• Capabilities to track and audit engagement in terms of both users and content to identify vulnerabilities, assess risks, and implement appropriate safeguards.

Perhaps most importantly, such remedies must be customizable to an organization’s specific needs, risk profile, and regulatory environment. F5’s model-agnostic AI runtime security solutions provide comprehensive security features in one easy-to-install and use solution for organizations using AI models of any quantity or type–LLMs, multimodal, retrieval-augmented generation (RAG), fine-tuned, internal, external, private, or open-source. The F5 solutions provide full observability across the system, enabling administrators to see every model and its activity.

F5 puts strong guardrails in place to protect against both common and novel threats. For example, policy-based access controls restrict model accessibility to admin-identified individuals and groups, while also providing admins with the opportunity to set rate limits that monitor and regulate model usage and prevent model denial-of-service (DoS) attacks. Customizable scanners review outgoing and incoming content to ensure confidential personal or company data doesn’t leave the organization and malicious, suspicious, or otherwise unacceptable content doesn’t get in. Other scanners review AI prompts for content that, while not detrimental to the company, is not aligned with company values or doesn’t conform to business use. 

All queries and responses are reviewed by the scanners and either redacted, blocked, or approved based on organizational thresholds, and all interactions executed on the platform are recorded for administrator review, auditability, and accountability purposes. Our Model-Agnostic Bot integrates seamlessly into workplace tools, such as Slack and Microsoft Teams, allowing users access to all available models from within those tools, providing both strong security and uncompromising performance while also boosting productivity and nurturing communication and innovation. This single solution provides a robust foundation for a proactive, holistic approach to security that can effectively mitigate risks associated with GenAI model deployment. Click here to find out more about our GenAI runtime security and enablement solutions.

About the Author

F5 Newsroom Staff

More blogs by F5 Newsroom Staff