Scaling SaaS security to manage agentic AI

AI agents are supercharging SaaS platforms. What had once been passive, subscription-based applications are now autonomous, outcome-driven systems that use tools, access sensitive data, and make decisions that influence business results.

This sounds great on the surface, but there are hidden risks to AI-powered SaaS applications. A single flawed prompt, abused privilege, or compromised plugin could trigger cascading failures or catastrophic data leaks. To keep pace with these changes, SaaS security must evolve.

The newly released OWASP Top 10 for Agentic Applications list of risks offers a framework for understanding these new kinds of SaaS apps. While the earlier OWASP Top 10 for Large Language Model Applications focused on issues like harmful outputs and prompt injection, the Top 10 for Agentic Applications addresses what might happen when AI models act on behalf of their human operators.

At their core, these are runtime risks. AI agents operate in dynamic environments where multiple AI models, APIs, data sources, and users continuously interact. Traditional security controls such as WAF rules, static code scanning, and basic rate limiting are not designed to monitor or govern this kind of unpredictable, rapid-output, non-human behavior in real time.

Among the most serious threats in the Agentic AI Top 10 is Agent Goal Hijack (ASI01), in which attackers manipulate prompts or context to subtly redirect an AI agent's objectives or decision pathways. Preventing this requires runtime purpose monitoring, a side-channel control that verifies each action against the AI agent's original intent.

Tool Misuse (ASI02) is another major issue. Without strict access controls based on the principle of least privilege, an AI agent authorized to read valuable data could be tricked into deleting, modifying, or exporting it. To counter this, SaaS providers must enforce granular tool permissions, explicit authorization for major decisions, and tightly scoped access.

Identity and Privilege Abuse (ASI03) highlights how AI agents frequently "borrow" the credentials of their human users — and the users' privileges as well, potentially creating exploitable pathways to sensitive systems.  Mitigations include implementing short-lived access tokens, limited-scope permissions, and human approval for sensitive decisions.  

The attack surface also expands through Agentic Supply Chain Vulnerabilities (ASI04). Agents commonly rely on third-party APIs, plugins, and skills, but a compromised external component can turn a helpful AI agent into an insider threat . Maintaining an AI Bill of Materials (AI-BOM), using signed plugins, and monitoring API dependencies are essential countermeasures.

Other risks listed in the OWASP Top 10 for Agentic AI include Unexpected Code Execution (ASIo5), in which attackers exploit AI agents' abilities to generate and run code; Memory and Context Poisoning (ASI06), which involves corrupting data and training resources; and Insecure Inter-Agent Communication (ASI07) as poorly secured agent-to-agent messages run the risks of being intercepted, altered, spoofed or blocked. Each scenario underscores the need for agent sandboxing, encrypted communications (preferably with mTLS), and rigorous context validation.

Beyond security threats, operational risks such as Cascading Failures (ASI08), Human-Agent Trust Exploitation (ASI09) and Rogue Agents (ASI10) can disrupt entire SaaS ecosystems. Kill switches, rate limits, immutable logging, and drift detection become critical safeguards in complex agentic systems.

For SecOps teams, mitigating these risks and securing SaaS platforms requires a unified strategy built around five principles:

Blocking AI innovation is not an option. Agentic AI is rapidly becoming standard in SaaS platforms built on hybrid architectures with expanding API ecosystems. Organizations must instead extend their application security foundations into inference-time behavior.

The F5 Application Delivery and Security Platform (ADSP) helps SaaS providers do exactly that. By extending visibility and enforcement into the application, API, data, and control planes, F5 enables runtime protection aligned with the OWASP Top 10 for Agentic Applications. Solutions such as F5 AI Guardrails provide real-time enforcement and policy controls, while F5 AI Red Team proactively identifies weaknesses through adversarial testing.

As SaaS evolves into autonomous infrastructure, security must scale accordingly. Centralized visibility, real-time enforcement, and governance aligned to regulatory mandates are no longer optional. They are prerequisites for running agentic AI safely and responsibly at enterprise scale.