Securing Private AI: Convenience or control? 

Mark TolerProduct Marketing Manager | F5

John WyssDirector, Product Management | F5

For every AI deployment, a rollout strategy must chart a course between convenience and control. For some, a public cloud tenant is attractive, as it optimizes for speed of implementation and shifts the burden to the cloud provider for managing the infrastructure. For others, essential privacy obligations, data sovereignty requirements, and the need for physically isolated compute boundaries require dedicated resources, more immune from noisy neighbors or credential leakage.

As more critical enterprise workloads are re-imagined as AI applications backed by specialized models and trained with vast amounts of enterprise data, delegating trust to a cloud provider is completely out of the question.

Even setting aside compliance and audit concerns, more organizations are looking to avoid major surprise inference compute bills, preferring to take AI infrastructure within their private data centers. As these debates play out between information security and application owners, what often emerges is that risk appetite actually varies by workload, and the classification of its related data: one size doesn’t fit all.

I’ll take a side order of security with that

As AI strategies mature, organizations inevitably determine that without protections in place against prompt injection, content moderation, and private data leakage, AI can’t reach its potential in the enterprise. So, the race begins to select a vendor with a model-agnostic AI security platform. Great! Of course, any solution to inspect, govern, and audit AI usage requires full inspection of prompts, responses, and AI API traffic on the wire.

Where and how those “guardrails” run (and where the audit data lives) is not a decision to be taken lightly. But the catch is that most commercial solutions tightly constrain the available deployment models. Many vendor solutions are SaaS only, or offer their version of privacy, which, in fact, creates a shared responsibility model with the hosting provider and the platform vendor, well above the infrastructure level. Even for some of the most interesting-sounding solutions that espouse a “zero trust” approach, there are heavy privacy caveats. A dreadful trend degrading data privacy is vendors training their security models on private customer logs, defeating the entire purpose of private AI.

Even for some of the most interesting-sounding solutions that espouse a “zero trust” approach, there are heavy privacy caveats.

Fortunately, there has been some progress in the form of security platforms offering customers the option to operate at least the data plane under their own control, but when the management plane resides in the vendor’s cloud, configuration data, policy definitions, telemetry, and operational metadata still flow to external infrastructure, where policy enforcement takes place. Needless to say, this systemic design flaw breaks the security posture of every application being “protected,” introducing threats such as reverse tunneling and perimeter bypass, malicious code injection, multi-tenancy leakage. And privilege escalation.

Are these acceptable risks when stacked against the benefits of a hybrid runtime model? Customers should be able to make these decisions for each use case, based on risk appetite, cost, and their compliance posture. In some cases, it may be a fine trade-off. In other instances, effectively expanding an attack surface to include the vendor's entire infrastructure, including the potential for lateral movement back into the core network, is not an option.

Letting the customer decide

This is where F5’s strategy is differentiated with true “private AI,” meaning that the customer has options that don’t involve exceptions you can drive a tractor through. With the F5 AI Security Platform, the level of privacy and control can be adjusted for each location or use case. Provisioning can conform to the highest security standard across the board, and a mix of deployment models can be tailored to various use cases.

For example, red teaming might be done as SaaS, but for evaluating responses from models trained on sensitive data, an on-premises or perhaps a private cloud instance must be used. And lest we forget that it’s not just about how the machines are connected: Human behavior remains a large threat vector.

With regard to access control, some organizations take a no-risk, no-nonsense approach, insisting on a compute boundary, which can only be administered by their trusted staff within a national boundary of their choosing and with predictable cost based on in-house GPU capacity.

In fact, extremely restricted and highly confidential workloads can even be deployed with the F5 AI Security Platform in a fully air-gapped installation, which means the computing environment has zero physical or wireless connections to the Internet or any insecure network.

Overcoming the AI security talent pool problem Solutions built natively with AI at the center to implement policy controls and compliance for AI traffic are so fresh and innovative, there’s very little available talent pool from which to recruit practitioners with experience provisioning and scaling such systems.

This is where F5’s strategy also offers a solution: the entire platform is aligned with the cloud-native workload automation platform that every company is already using: Kubernetes. This has become effectively the cloud operating system to implement declarative state, abstracting entirely the underlying details. What’s more , we’re not just talking about using a package manager like Helm to do the installation. There’s a certified Red Hat OpenShift Operator to make life easier.

How the F5 AI Security Platform enables private AI

The F5 AI Security Platform is built for private AI as a foundational design principle. F5 AI Red Team and F5 AI Guardrails enable the full range of deployment options. Both solutions deploy natively in Kubernetes and can run entirely within a customer-controlled environment. Inspection, enforcement, and remediation can execute locally, without outbound calls to F5 or any third-party cloud service. Most importantly, we never train on customer data: your prompts, responses, and logs reside entirely in your control.

This commitment extends beyond AI-native security. With the announcement of the F5 AI Security Platform at this week's F5 AI Summit, we are bringing that same standard of deployment flexibility and privacy to F5 Web Application and API Protection. For every acquisition and every capability we build, our design philosophy starts with one question: how can we deliver this value to the most secure use cases?

F5 already offers the most deployment flexibility and privacy for AI security. As we expand our offering through the F5 AI Security Platform, we remain committed to an unwavering standard of customer control. Private AI enablement for F5 is not a roadmap item or a special engagement; it is how we build.

To learn more about the F5 AI Security Platform, read the press release. Also, see our blog post, “The F5 AI Security Platform: Eliminating the guesswork from AI security.”

About the Authors

Mark TolerProduct Marketing Manager | F5

More blogs by Mark Toler

John WyssDirector, Product Management | F5

More blogs by John Wyss