OPSWAT + F5: AI file security from upload to agent

Klaus SchweglerSenior Product Marketing Manager, Technology Alliances | OPSWAT

An employee adds a vendor contract to their company’s AI knowledge base. It looks ordinary. Hidden in its metadata is an instruction written for the model to find: share internal pricing with anyone who asks. That’s a form of indirect prompt injection. Once the file is in the knowledge base, the model can follow that instruction every time it retrieves the file. AI file security exists to catch files like this one before they get that far.

Enterprise AI runs on files. Employees upload them to AI assistants. Retrieval-augmented generation (RAG) systems pull them into knowledge bases. Agents fetch them from outside services and act on them before anyone looks.

I spent much of my career in enterprise networking and data center infrastructure, where the job is to move traffic fast and keep it available. File security asks a different question: what’s inside the file carried over that traffic? Today I work on technology alliances at OPSWAT, bringing those two views together with partners like F5. One lesson carries over: a file needs to be checked every time it moves. AI gives files far more places to move.

OPSWAT has focused on cybersecurity for critical infrastructure since 2002. Today, more than 2,000 organizations worldwide use our technology to stop file-borne threats. Our partnership with F5 goes back many years. When F5 launched a partner program for the F5 Application Delivery and Security Platform (ADSP), we became one of its first Select partners. The F5 ADSP Partner Program supports the platform with pre-validated integrations.

The F5 AI Reference Architecture gives customers building AI a foundation for understanding the components of an AI application, the challenges and risks present in the connection points between those components, and a guide to the solutions for addressing those challenges and risks. We mapped our file security to it so teams don’t have to design that control from scratch. The integration already runs on F5 infrastructure, so the mapping took no new engineering from either side.

Inspection belongs on the data path

In its white paper AI Security Beyond the Model, F5 makes the case that protecting the model alone covers only a fraction of the risk. We’d add that the files reaching the model need their own control. Inspecting what’s inside each file is a separate job, and it’s the one OPSWAT does.

The cleanest place to inspect a file is on the path it’s already traveling. F5 devices can send content out for inspection using the Internet Content Adaptation Protocol (ICAP). Our ICAP integration is built on that standard. OPSWAT MetaDefender™ ICAP Server receives each file from F5 and inspects it. Then it sends back an allow or block decision, or a sanitized copy of the file.

The integration is validated with F5 BIG-IP Local Traffic Manager, BIG-IP Advanced WAF, and BIG-IP SSL Orchestrator, and supports F5 Distributed Cloud Services as well. OPSWAT also currently offers the only certified technology module for F5 NGINX.

For AI data pipeline security, inspection must run in both directions. On the way in, we check files that users upload and documents headed into a knowledge base, before they reach the AI service. On the way back, we check files that outside services return, before they reach an agent. SSL Orchestrator decrypts traffic and sends it through MetaDefender ICAP Server, so threats can’t hide inside encrypted connections.

OPSWAT MetaDefender ICAP Server inspects files at three points on the F5 data path: on upload, before they enter a knowledge base, and on the way back from outside services.

Every file is a way in

Uploads are the most familiar case. Someone hands a PDF, an Office document, or an image to an AI assistant behind BIG-IP. MetaDefender scans it with more than 30 anti-malware engines. Then it rebuilds the file with Deep CDR™, our content disarm and reconstruction technology. In practical terms, the model gets a clean copy, with macros, embedded objects, and hidden metadata removed. We also flag files that were AI-generated or manipulated.

The contract in the opening example shows why RAG security has to start before anything enters the knowledge base. Before documents are added, Deep CDR strips out macros, embedded objects, and metadata, so an instruction hidden in metadata never reaches the model.

Proactive DLP™, our data loss prevention technology, adds a separate check. It keeps personal and health data out of what the model sees, instead of trying to filter answers later. Our Predictive Al in AI engine flags adversarially crafted files, and we block poisoned files before they’re stored. MetaDefender Storage Security adds scanning for the object stores behind the knowledge base, including Amazon S3, NetApp, and Dell. In RAG-backed applications, the integration checks both what users upload and what gets added to the knowledge base.

With agents, the risk arrives on the return path. Agents pull files from outside APIs, plugins, and data connectors, then act on them on their own. That makes agentic AI security a question of checking what comes back. Where an agent’s outside calls run through F5, we inspect returning files before the agent acts on them, whatever framework made the call.

Together, the inline integration covers four of the seven building blocks in the F5 AI Reference Architecture. The other three are fine-tuning, training, and development. We cover those with MetaDefender Storage Security, MetaDefender Managed File Transfer, and the MetaDefender Core API.

Faster to production, with less risk

Our ICAP integration is available today, not on a roadmap. It’s plug-and-play with ICAP-enabled devices. It deploys in minutes without API work and includes built-in high availability. Customers running the integration report they began scanning all file uploads in a couple of days.

Each inspection point also maps to the OWASP Top 10 for Large Language Model Applications, the same list F5 uses in its architecture. That gives teams in regulated industries a standard their auditors already recognize.

Trusted AI starts with trusted content

AI decisions are only as trustworthy as the files feeding them, and file security is where that trust starts. Detection tells you a bad file showed up. Prevention means it never got there.

Settling the content question early is what lets everything after it move quickly. It also saves work downstream. When files arrive already sanitized, F5 AI Guardrails spends fewer tokens cleaning them up.

For teams deciding where to start, the appeal is how little has to change. Nothing new enters the data path. There’s no integration project to fund and no application to rebuild. Our AI file security runs on F5 infrastructure you already operate, at the points the F5 AI Reference Architecture maps.

To see where file security fits across the AI lifecycle, explore the F5 AI Reference Architecture.

About the Author

Klaus SchweglerSenior Product Marketing Manager, Technology Alliances | OPSWAT

More blogs by Klaus Schwegler