Enterprise adoption of AI models and agents has created a paradox. As artificial intelligence becomes more powerful and capable, security teams have less insight into what it is doing.
Employees who once experimented with chatbots are now connecting models to corporate data, while organizations deploy
AI agents that authenticate themselves, invoke tools and act autonomously.
In a
recent blog post, F5 Chief Product Officer Kunal Anand labels this phenomenon, in which AI access and autonomy increase while visibility and control decline, as the "adoption-control inversion."
"The more AI an organization absorbs, the less it can see or govern, precisely because the thing being absorbed is built to act faster and more independently than the controls watching it," Anand explains.
Blocking AI outright won't solve this problem, as such a policy will just push AI usage into the shadows.
Instead, enterprises need a control point that can observe interactions among users, models, agents, APIs, tools and data — and apply security policies without preventing legitimate AI adoption.
Anand says F5 has created such a control point with its AI Security Platform, which runs a continuous adaptive loop that involves discovery, testing and enforcement.
"Scattered insights, multi-week remediation cadences, and static policies cannot keep pace with attackers who retool in hours," says Anand. "Defenders have spent years on the wrong side of that asymmetry. A closed loop narrows the asymmetry."
How models and agents outstrip the abilities of security teams to find and govern them
The AI attack surface is, to put it politely, becoming more dynamic. Unsanctioned models work alongside approved applications. Autonomous agents access data, call tools and connect to Model Context Protocol (MCP) servers, often while possessing far more privileges than they need.
F5's latest
State of Application Strategy report found that 98% of organizations are preparing to deploy agentic AI even as controls struggle to keep pace.
The problem superficially resembles what organizations went through with shadow SaaS just a few years ago. But this time, the stakes are much higher because
AI agents can take decisive action that can affect an entire organization's security rather than just store or process information.
"Shadow AI is shadow SaaS with a faster clock and a larger blast radius," writes Anand. "You do not resolve the inversion with a smarter blocklist. You resolve it by occupying the position in the path where you can see usage, classify intent, and enforce policy at once."
How continuous discovery provides the needed visibility
Network interactions can help organizations regain the visibility they need. F5's AI Security Platform uses network-based discovery that identifies sanctioned and shadow AI without requiring direct integration with every application. The platform can recognize the intent behind each AI workflow and continuously trace agent tool calls and MCP connections.
"Most AI security today is a wrapper around a chatbot. That is not security,” writes Anand. "The F5 AI Security Platform gives CISOs and security leaders what they have been missing: continuous control over every model, agent, and API, wherever the AI runs.”
Discovery changes from an occasional inventory exercise to continuous observation. Organizations can automatically identify AI services appearing in
network traffic, maintain an inventory of models and agent tools, and examine prompts and data flows to understand how employees use AI.
Visibility also informs control. A security team can distinguish an approved enterprise model performing an expected task from an unauthorized service receiving sensitive information, then route, restrict or block interactions according to context and policy.
How a feedback loop lets defenses adapt to changing AI deployments
Discovery becomes more powerful when it feeds directly into testing and enforcement. F5's platform is designed around a continuous cycle: discover AI activity, identify what needs examination, adversarially test applications and models, then translate findings into runtime protections.
F5 AI Red Team tests systems against attack patterns, while AI Guardrails applies policies at runtime to address risks such as prompt injection, excessive agent autonomy and data leakage. Observability then records AI interactions, creating another source of intelligence for subsequent discovery, testing and policy changes.
By observing network interactions, organizations can continuously discover AI usage, including shadow AI, and determine what models, agents and
MCP connections are actually doing.
Connecting that visibility with adversarial testing and inline runtime enforcement creates an adaptive feedback loop. Rather than choosing between uncontrolled AI adoption and blanket restrictions, enterprises can continuously adjust protections as their AI environment evolves.
