Prime Bank transforms digital banking with F5 ADSP

Prime Bank PLC operates 146 branches and 153 ATMs across Bangladesh. Recognized internationally in 2020 as the nation’s best bank, they rely on F5 ADSP, choosing the comprehensive platform— spanning application delivery and security with centralized insights—for the solution’s evident ROI as the bank evolves their business model and innovates.

Business challenge

Corporate and institutional banking helped Prime Bank grow from the institution’s founding in 1995 to gain international recognition by 2020. In recent years, the bank has continued their expertise in corporate banking while increasingly courting consumers with innovative financial services that range from tap-to-pay stickers to PrimeAgrim Nano Loans, which may be approved in two hours or less.

That evolution places pressure on the bank’s technology operations in at least three ways. First, the bank’s increasingly consumer-centric, fintech focus brings more customers, more digital interactions, more personalization, and more data on which to base that personalization. Md Mahbubul Alam Rafel, Chief Information Security Officer at Prime Bank, says, “That data becomes the asset that will enable the organization to take more sustainable decisions.”

To handle it, the company is building their data storage and processing capabilities, including a data lake and their own LLMs, to ensure innovative and data-driven new products and services. Those offerings present new delivery and cybersecurity challenges. Rafel says, “We are adopting the global open banking framework, which needs more API security, more bot defense, and—last but not least—zero trust in each and every traffic hop.”

Second, Bangladesh maintains strict data compliance and sovereignty requirements that influence Prime Bank’s app infrastructure. Public clouds are not currently an option, but the bank operates in on-premises data centers and locally built, private cloud environments with selected SaaS solutions that together comprise hybrid multicloud deployments.

Finally, consumer banking is fiercely competitive, underscoring the importance of managing costs and accelerating effective use of AI, which Prime Bank has been employing since 2019 in tasks ranging from security monitoring to alternate credit scoring. Rafel explains, “In that competitive consumer environment, you always need to focus on the technology operational ROI.”

Solutions

Prime Bank began using F5 technologies about a decade ago, initially deploying F5 BIG-IP products for load balancing and web application firewall (WAF) protection. As the bank expanded its digital footprint, they adopted F5 Distributed Cloud Services to support evolving security and compliance needs.

Distributed Cloud Services helped Prime Bank ensure that all sensitive payload data is processed within a controlled environment, while only metadata is handled externally to meet regulatory and data sovereignty requirements. At the same time, the F5 solutions extended security capabilities, including API discovery and WAF services, into this environment, strengthening protection without exposing sensitive data. As the first bank in Bangladesh to adopt this hybrid approach, Prime Bank successfully balances control, compliance, and modern application security.

Most recently, the bank added NGINX One to build cloud-native capacity and introduce containerized services focused on customer engagement. NGINX, used as an ingress controller across multiple front-end, back-end, and data instances, delivers observability via the Distributed Cloud console for the bank’s 24-hour security operations center (SOC) systems. “It’s a mighty platform,” says Rafel. The result is a comprehensive solution that provides delivery, performance, security, and observability for the bank’s monolithic and modern apps deployed across hybrid multicloud environments.

“F5 has a comprehensive platform that serves the purposes of different stakeholders for services such as load balancing, DNS security, web application firewall, API security, and NGINX as an ingress controller,” says Rafel. “And at the end of the day there is a central dashboard with AI working to assist with rectifying API errors as well as promoting the business goal of time to market for services and products. That comprehensiveness of the F5 platform is a key attraction point.”

Ready availability of F5 products in Bangladesh—and the impact of that availability on business continuity—was also a factor in the bank’s F5 deployment decisions. So was the platform’s usage-based billing structure. Rafel explains, “Whatever I’m using, I’m paying for it. There is no oversizing. So, it’s very easy for me to describe the investment for management. That’s very important.”

He adds, “It’s not about the best of breed. It’s all about the best of need.”

Results

Protect apps with a stronger security posture

Prime Bank strengthens their security posture and reduces the risk of shadow APIs through a unified approach to application delivery and security using F5 solutions. Rafel says, “F5 is a partner for our security-first digital banking approach.” For instance, the bank is introducing a new platform called Prime NOW aimed at Gen Z customers. It will provide complete digital banking services without ever requiring a branch visit.

“It’s a shift in culture,” says Rafel. “And we are already in the journey to introduce this digital product with the comprehensive security umbrella of F5.”

He says the protection provided by F5 Distributed Cloud API Security plays a key role in securing integrations with third-party providers. He adds, “We can identify shadow APIs, discovering API endpoints by analyzing the traffic and blocking accordingly.” F5 security tools—including Distributed Cloud Services and F5 Insight for ADSP, which Prime Bank has recently adopted—employ AI insights. Together, these tools have helped the bank’s developers to identify and remediate API vulnerabilities such as shadow APIs and to ensure safe, compliant transmission of personally identifiable information (PII). Meanwhile, traffic visibility delivered by F5 helps the Prime Bank SOC investigate and remediate security threats.

Rafel also sees F5 security as a deterrent because attackers fail after repeated attempts and eventually move to softer targets. “F5 is helping us create our strong, secure digital avatar,” he says. “Attackers are seeing us as a cyber-healthy bank. This is important, because it’s a basic human instinct not to want to fight someone who looks stronger.”

Of course, such deterrence won’t always be enough as cybercriminals deploy AI-driven attacks. Rafel notes, “AI is amplifying cyber risk and challenging financial institutions. You do not need a human to generate an attack anymore, so you must have solutions with AI capacity as well. You have to fight fire with fire. We are already taking advantage of AI-based security insights with our existing consumption of F5 ADSP.”

Save time and gain operational flexibility

Rafel praises the F5 solutions for increasing the bank’s technical agility. “The platform has application delivery components with security as well as operational flexibility we need,” he explains. “That is important because operational teams always consider security as a road blocker.” He says the flexibility of F5 solutions change this dynamic and help align stakeholders for effective use cases, meeting the needs of developers and operations teams, not just the security team. That enables multiple teams to move faster with confidence.

For instance, the InfoSec team had to spend significant time going back and forth with IT operations staff to validate and gain agreement on security findings. This process typically required a minimum of four to five hours for each case. With Distributed Cloud Services in place, the back-and-forth effort has been eliminated, saving hours per case and significantly improving mean time to remediate (MTTR) security findings.

“When they get value from a solution that makes their lives easy, they cooperate with the security professionals,” Rafel notes. “Our F5 solutions are not only creating security but giving us flexibility, too.”

Increase ROI and value

Rafel notes that the comprehensive nature of F5 ADSP and its utility across multiple use cases and teams working in a highly regulated environment ensure a strong return on the bank’s technology investment. “ROI is very important,” he says. “The one F5 platform solves problems for different parts of our organization—technology operations, security, development—in short, the DevSecOps pipeline. From an ROI perspective, F5 gives consistent value delivery, and the ROI is evident. That’s why F5 is the right solution for Prime Bank.”

Accelerate business and social transformation

As Prime Bank’s evolution into customer-centered digital banking proceeds, F5 will be there. Rafel says, “F5 is helping us transform the business model, ensuring the security of the channel that ends with the customer and ensuring we meet the requirements of regulators and the business.”

He sums up the bank’s partnership with F5 by saying, “Going forward, F5 is our business enabler.”

He notes that cyberthreats will continue to evolve with the business. For instance, he says, “API endpoints are going to be the next big vulnerability factors because next-generation cyber risk is all about identity and privilege.”

He says Prime Bank plans to work with F5 going forward not only for its own business transformation but also for the sake of the country’s cyber resilience.

“We have to think big,” he declares. “We have to chase the dream. Why not?”

See all customer stories ›