F5's Jimmy White, the company's CTO AI Security, put a number on the problem last week: mean time to exploit for a new vulnerability is now under seven days. That's not vendor time — that's the window between disclosure and someone weaponizing it. If your patch cycle runs longer than that, and for most engineering teams it does, you're exposed by default.
F5 just shipped an answer to that gap: an AI-powered Web Application Firewall running on Distributed Cloud that has autonomously detected 15 zero-day attacks and cut false positives from about 18% to about 1%. I talked with White about how it actually works, and the answer is more interesting than "we added AI to a WAF."
Why a custom model instead of a fine-tuned LLM
F5 built a proprietary neural network rather than fine-tuning a foundation model, and White says the decision came down to where the model has to live. "It's around speed and it's on the data path," he told me. A WAF inspects every request in real time. There's no room for the latency a general-purpose LLM would add, and F5 already had the volume of security traffic needed to train something purpose-built and fast.
The model doesn't lean on any single signal. It combines signatures, malicious-user detection, anomaly detection, and behavioral zero-day patterns — the same categories WAFs have always used, but correlated instead of evaluated in isolation. That correlation is what took false positives from 18% down to 1%. White's analogy: a hammer near a nail looks fine. The same hammer near a window looks like a threat. Context, not any one rule, makes the call.
How the "patch" actually happens
Here's the part developers will want to understand: F5's virtual patching isn't a rule someone writes after a CVE drops. When the neural net flags traffic as novel and malicious, that pattern gets treated as known-bad from that moment forward — no re-scanning, no waiting on a signature update. "It's novel the first time," White said. "It's not going to be novel from then on." That's the patch: a real-time classification that turns a zero-day into ordinary traffic filtering within the same session it was discovered.
It also explains the variant problem. Attackers typically don't stop at one exploit. They generate hundreds of small variations to see what gets through. Because the model has already learned the underlying pattern, White says it catches the variants too, not just the original.
None of this runs fully unsupervised end to end. Model upgrades go through human review before release, and F5 tests new versions internally — "dog fooding," in White's words — before pushing them to production.
The stack matters more than the model
White was clear that AI WAF isn't meant to stand alone. F5 pairs it with DDoS protection and bot defense specifically so a traffic spike, like a DDoS event or a scraper storm, gets filtered out before it ever reaches the WAF's training pipeline. Skip that step and a bad batch of traffic could skew what the model learns as normal. It's a detail worth remembering if you're evaluating any AI-driven security tool: ask what protects the training data, not just what the model does with clean data.
The results are validated by SecureIQLab, an independent testing firm F5 has no ability to influence. "The only guarantee we have is our protections have never seen the attacks before," White said. That test produced a 100% score against the OWASP WAF and API Top 10 lists — numbers worth taking with the usual skepticism toward vendor-selected benchmarks, but the blind-test structure is at least a real attempt to earn that skepticism's benefit of the doubt.
What this doesn't change
AI WAF currently runs on Distributed Cloud only. F5 plans to bring it to BIG-IP, NGINX Plus, and NGINX Open Source over the next couple of quarters, and White describes the upgrade path as simple: no SDK, no API integration, just an update that adds the capability to an existing WAF deployment.
What it doesn't do is give engineering teams permission to slow down. I asked White directly whether this changes how a developer should think about patch cadence. His answer was blunt: "I wish you could relax." The WAF buys time in the gap between disclosure and a real fix — White offered one to six days as a rough example of that window — but it's not a substitute for shipping the fix. "It'd be very dangerous for me to say you can kind of rest on your laurels," he said. "In this era, it's super important to find and fix as quickly as possible."
That's the honest read on where AI-assisted security tools stand right now. They're buying real time in a race that's gotten faster on both sides. They're not ending the race.
