F5 expanded application and API security within ADSP because, as F5’s Joel Moses put it, the industry’s “all gas, no break” approach to AI raises serious concerns about safety and security, the company revealed at AppWorld 2026.
At AppWorld 2026, F5 focused on application and API security across its flagship Application Delivery and Security Platform (ADSP) to help enterprises secure distributed applications in the AI era and prepare for emerging post-quantum risks.
“I think we’re moving very fast in the AI space right now. It’s kind of an all-gas, no-break scenario going on, and I don’t have a lot of confidence in the safety of these things,” Joel Moses, vice president of strategic engineering and CTO of platforms and systems at F5, told CRN. “I sometimes worry that if we rush too quickly into something with a very large explosive radius, we won’t understand the effects until they’ve already occurred.”
That’s why businesses need a dynamic, programmable platform to respond to emerging threats, he said.
[Related: F5 To Acquire CalypsoAI For GenAI Security Push]
A new feature of F5 ADSP announced at AppWorld 2026 on Wednesday is F5 AI Remediate. This is a feature that bridges the gap between identifying vulnerabilities in AI models with the F5 AI Red Team offering and applying validated runtime protections with F5’s AI guardrails. AI Remediate helps you automate the creation, optimization, and validation of targeted guardrail packages. As part of ADSP, AI Remediate helps organizations quickly reduce infection risk without disrupting live AI applications or eliminating repetitive tasks, the company said.
A flexible new feature, AI remediation, will enable partners to build new services around AI, such as model vulnerability management, Moses said.
“That’s definitely a role for partners to play, and they can get a lot of value out of it,” he said. “One of the reasons I came to F5 was that the existing platform they had was very dynamic and programmable. In an era of rapidly expanding technology and rapidly emerging threats, I think the most programmable platform will ultimately win.”
F5 also attended the event to introduce the latest release of its F5 Distributed Cloud WAF product, which has the ability to turn once-manual processes into automated protection with AI-powered risk scoring and outcome-based blocking policies across clouds on-premises and edge locations, the company said.
François Locoh-Donou, president and CEO of F5, told CRN during AppWorld 2026 that enterprises are taking API security more seriously, especially as AI models become targets of attack.
“Customers know that whenever an AI application calls an AI model, or an AI agent calls a tool, it’s the APIs that are performing that work. So knowing where all the APIs are, whether the APIs are configured properly, whether the data going in and out of those APIs is correct, all of these issues around API security have become very important to customers over the last few years,” he said.
On average, companies run seven AI models, all of which have vulnerabilities of their own, Locoh-Donou added.
Chris Conrad, vice president of global cyber at F5 partner WWT, said all of the solutions provider giant WWT’s current customers are focused on AI and digital transformation. Cybersecurity, AI and digital transformation were once separate business concerns, but they can no longer be siled conversations, he said.
“Most of our customers face infrastructure modernization challenges. [and] “F5 helps with this challenge through secure applications and scalable solutions that allow us to deploy AI workloads that many customers struggle with. At F5, we serve as a strategic advisor across AI infrastructure and modernization campaigns from a partnership perspective. It goes beyond just implementation.” [to include] AI data processing, secure API services. We really help move people from pilot to production quickly. ”
agent AI security
On the agent AI front, F5 is introducing new capabilities within its F5 Distributed Cloud Bot Defense product, which is part of its suite of distributed cloud services, and is aimed at addressing the emerging challenges of AI-driven automation, F5 said. Distributed Cloud Bot Defense now provides greater visibility across application traffic and a clearer distinction between humans, bots, and AI agents. The company says this allows trusted and verifiable AI agents to interact with applications while blocking other activities with unified governance and consistent policy controls for human, bot, and AI agent interactions.
ADSP is also now integrating F5 Distributed Cloud Web App Scanning with F5 BIG-IP Advanced WAF, which F5 says will provide BIG-IP customers with scalable and automated vulnerability detection.
