Blab AI
F5 Acquires SurePath AI to Tackle Shadow AI Risks in Enterprise Workflows
On June 24 2026, Seattle‑based application delivery and security firm F5 announced it had bought Denver‑based startup SurePath AI. The terms of the deal were not disclosed, but the purchase gives F5 a technology that scans corporate networks to flag generative‑AI tools and automated agents employees use—often without IT approval. It is part of F5’s broader push to give security teams continuous visibility into the “shadow AI” that has become a new threat in modern enterprises.
In a GeekWire Podcast interview, F5’s chairman, president and CEO François Locoh‑Donou explained how the rapid uptake of generative AI has blurred traditional security boundaries. Employees can now launch powerful AI tools with a single click, creating blind spots that expose sensitive data to external models or allow internal models to be poisoned. Locoh‑Donou said the company’s new platform will “illuminate the blind spots that have kept security professionals awake at night.”
Founded in 2023 by CEO Casey Bleeker, SurePath AI operated with a team of about nineteen people and raised roughly $6 million in venture funding before the acquisition. Its core product quietly monitors traffic, identifies which AI services are active, and tracks data flows to and from those services. According to reports, the technology can reveal both sanctioned and unsanctioned AI tools that employees may have installed or accessed through cloud APIs.
F5’s chief product officer, Kunal Anand, compared shadow AI to a faster‑moving, higher‑stakes version of the shadow SaaS phenomenon that appeared during the early cloud era. He noted that a single employee pasting proprietary code or financial data into an unvetted large‑language‑model API can expose intellectual property to the open web or corrupt internal models. The new platform will combine SurePath’s discovery engine with F5’s existing AI Guardrails and AI Red Team products, which were introduced after the company’s earlier acquisition of Calypso AI.
The integrated solution is designed to discover active AI models, test them for hidden vulnerabilities, and apply automated guardrails that enforce acceptable usage policies. F5 markets the platform as a single, cohesive tool that can replace the fragmented point‑solutions many security teams currently manage. The company’s leadership has emphasized a people‑centric acquisition philosophy, weighing whether a technology can be built faster internally, whether it delivers tangible customer value, and whether the team fits with F5’s collaborative culture.
F5’s move comes as the firm celebrates its 30th anniversary and reports annual revenue exceeding $3 billion. The company has expanded from its original application delivery controller business into multi‑cloud management and AI security. The new platform is available on major cloud marketplaces, including AWS and Microsoft, and is already being deployed in hybrid and on‑premises environments.
While the financial details of the SurePath acquisition remain undisclosed, industry observers see the deal as a signal that AI‑centric security will become a core component of enterprise infrastructure. The platform’s ability to provide continuous visibility and governance over AI tools addresses a gap that has grown as employees increasingly rely on generative models for coding, email drafting, and workflow automation.
In the coming months, F5 will roll out the AI security platform to its existing customer base and expand its partner ecosystem. The company has not yet announced a pricing model or a public roadmap for additional features. Regulatory developments around AI governance and data protection are also likely to influence the platform’s adoption, as enterprises seek to comply with emerging privacy and security standards.
Overall, the acquisition of SurePath AI and the launch of an integrated AI security platform represent a strategic effort by F5 to bring order to the rapidly evolving landscape of enterprise AI usage. The company’s focus on visibility, governance, and cultural fit positions it to address the growing threat of shadow AI while supporting the broader adoption of generative technologies.
In a GeekWire Podcast interview, F5’s chairman, president and CEO François Locoh‑Donou explained how the rapid uptake of generative AI has blurred traditional security boundaries. Employees can now launch powerful AI tools with a single click, creating blind spots that expose sensitive data to external models or allow internal models to be poisoned. Locoh‑Donou said the company’s new platform will “illuminate the blind spots that have kept security professionals awake at night.”
Founded in 2023 by CEO Casey Bleeker, SurePath AI operated with a team of about nineteen people and raised roughly $6 million in venture funding before the acquisition. Its core product quietly monitors traffic, identifies which AI services are active, and tracks data flows to and from those services. According to reports, the technology can reveal both sanctioned and unsanctioned AI tools that employees may have installed or accessed through cloud APIs.
F5’s chief product officer, Kunal Anand, compared shadow AI to a faster‑moving, higher‑stakes version of the shadow SaaS phenomenon that appeared during the early cloud era. He noted that a single employee pasting proprietary code or financial data into an unvetted large‑language‑model API can expose intellectual property to the open web or corrupt internal models. The new platform will combine SurePath’s discovery engine with F5’s existing AI Guardrails and AI Red Team products, which were introduced after the company’s earlier acquisition of Calypso AI.
The integrated solution is designed to discover active AI models, test them for hidden vulnerabilities, and apply automated guardrails that enforce acceptable usage policies. F5 markets the platform as a single, cohesive tool that can replace the fragmented point‑solutions many security teams currently manage. The company’s leadership has emphasized a people‑centric acquisition philosophy, weighing whether a technology can be built faster internally, whether it delivers tangible customer value, and whether the team fits with F5’s collaborative culture.
F5’s move comes as the firm celebrates its 30th anniversary and reports annual revenue exceeding $3 billion. The company has expanded from its original application delivery controller business into multi‑cloud management and AI security. The new platform is available on major cloud marketplaces, including AWS and Microsoft, and is already being deployed in hybrid and on‑premises environments.
While the financial details of the SurePath acquisition remain undisclosed, industry observers see the deal as a signal that AI‑centric security will become a core component of enterprise infrastructure. The platform’s ability to provide continuous visibility and governance over AI tools addresses a gap that has grown as employees increasingly rely on generative models for coding, email drafting, and workflow automation.
In the coming months, F5 will roll out the AI security platform to its existing customer base and expand its partner ecosystem. The company has not yet announced a pricing model or a public roadmap for additional features. Regulatory developments around AI governance and data protection are also likely to influence the platform’s adoption, as enterprises seek to comply with emerging privacy and security standards.
Overall, the acquisition of SurePath AI and the launch of an integrated AI security platform represent a strategic effort by F5 to bring order to the rapidly evolving landscape of enterprise AI usage. The company’s focus on visibility, governance, and cultural fit positions it to address the growing threat of shadow AI while supporting the broader adoption of generative technologies.
