- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
F5 AI Red Team
Your AI apps answer customers and your agents take actions. Someone should attack them before an outsider does — F5 AI Red Team sets swarms of attacker agents on your AI apps, models and agents — in AWS, Azure, Google Cloud or on your own OpenShift cluster — and pushes what they find into F5 AI Guardrails.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The F5 platform family
This page covers F5 AI Red Team — the testing product, not the F5 AI Guardrails runtime product. The rest:
Quick facts
30-second orientation- Product
- Automated adversarial testing of AI apps, models and agents by swarms of attacker agents
- Maker
- F5, Inc.; Chairman, President and CEO François Locoh-Donou
- Heritage
- Built on F5’s 2025 acquisition of CalypsoAI, which closed on 26 September 2025
- Price
- Not published on f5.com and not listed on any cloud marketplace; quote only
- Licence
- Its own product, quoted apart from F5 AI Guardrails; the licensing unit is not published
- Attacks
- F5 claims its attack database gains more than 10,000 new patterns every month
- Output
- Findings feed F5 AI Guardrails; F5 AI Remediate, shown at AppWorld 2026, links the two
- Deploys
- AWS, Azure or Google Cloud, or on-premises as a certified Red Hat OpenShift operator
- India
- On OpenShift in your own Indian data centre, tests and results stay with you
- In India via
- TechBag — AI target inventory, quote in INR with GST, first test cycle
Understand AI red teaming before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is AI red teaming?
Attacking your own AI on purpose — jailbreaks, prompt injection and misuse — so weak points surface before a real attacker finds them.
A one-off manual test vs automated attacker agents — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | A one-off manual test | F5 AI Red Team |
|---|---|---|
| How attacks are made | A consultant writes prompts by hand | Swarms of automated attacker agents |
| How often it runs | Once, before launch | Repeated as the attack database grows |
| New techniques | Whatever the tester knew that week | 10,000+ new patterns a month, per F5 |
| What a finding becomes | A line in a PDF report | Input to F5 AI Guardrails policy |
| Where test data sits | On the consultant’s laptop | Your cloud account or OpenShift cluster |
| What it is NOT | — | A runtime blocker, or a published price |
The cleanest test is one target, one run and one re-run after the fixes: read every finding with its owner, then decide on the rest.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Attackers
Instead of one script replaying fixed prompts, AI Red Team sets many automated attacker agents loose on a target together, each probing a model, app or agent for a weak spot.
Database
The agents draw on an attack database that F5 says gains more than 10,000 new patterns every month, so a re-test later in the year meets techniques the first run never saw.
Hand-off
Results are pushed into F5 AI Guardrails, the runtime product; F5 AI Remediate, introduced at AppWorld 2026, ties a red-team finding to the guardrail policy meant to close it.
Runtime
Pick a public cloud, whether AWS, Azure or Google Cloud, or install the certified operator F5 ships for Red Hat OpenShift, so a regulated team keeps attack prompts and results in-house.
Attacker agents and a growing pattern database — run in three public clouds or on OpenShift, with findings sent to AI Guardrails.
Six capabilities. Attack, remediate, deploy.
F5 AI Red Team attacks your AI on purpose, then hands each finding to F5 AI Guardrails.
Many attackers at once
Automated attacker agents work in parallel against one target, so testing no longer waits on a person writing jailbreak prompts by hand.
A library that keeps growing
F5 claims more than 10,000 new attack patterns join the database each month, which is why a test should be repeated, not run once a year.
Findings become defences
What a test uncovers is passed to F5 AI Guardrails, so a weakness found in testing can then be blocked in production by the sibling product.
Closing the loop
F5 AI Remediate, shown at AppWorld 2026, connects a finding to a Guardrails policy instead of leaving it as one more line in a PDF report.
Hosted in three clouds
Run it in AWS, Microsoft Azure or Google Cloud, next to the models and AI apps your teams already host with one of those providers.
On your own cluster
A certified Red Hat OpenShift operator installs it on-premises, for teams whose prompts, test data and results must not leave the building.
Watch F5 AI Red Team in action
F5 on continuous AI red teaming, how results are scored and reach guardrails, the AI Remediate launch, and the CalypsoAI deal behind the product.
F5 AI Red Team: Continuous Testing. Explainable Results, Proven Resilience | On-demand Webinar
F5’s own session on the product, framed around testing that repeats rather than a one-off assessment.
Pop Goes the Stack | AI Red Teaming in Practice: Scores, guardrails, auto-remediation | AI
An F5 discussion of AI red teaming in practice: how results are scored and how they reach guardrails.
Introducing F5 AI Remediate | AppWorld 2026
The AppWorld 2026 introduction of AI Remediate, the step between a red-team finding and a guardrail.
F5 enters into agreement to acquire pioneer in enterprise AI security, CalypsoAI | AI Security
The September 2025 announcement of the CalypsoAI deal that this product line is built on.
Want a live, India-context walkthrough for your environment?
Book a guided demo →New jailbreaks appear every month. AI Red Team keeps attacking so you find them first.
Here’s what genuinely sets it apart — and exactly where it stops.
Testing that keeps pace with new attacks
A manual red-team exercise is a snapshot; a jailbreak published next month is not in it. AI Red Team points swarms of automated attacker agents at your model, app or agent, and F5 says its attack database gains more than 10,000 new patterns every month. Re-running the same target therefore tests new techniques, not the old list.
A finding that turns into a control
Most red-team output ends as a report someone must translate into rules. Here the findings are pushed into F5 AI Guardrails, the runtime product, and F5 AI Remediate, introduced at AppWorld 2026, links each weakness to the guardrail policy meant to close it. The value is highest if you run both F5 products.
It runs where your models run
Attack prompts and the answers they draw out can be sensitive. F5 offers AI Red Team in AWS, Azure or Google Cloud, and also as a certified Red Hat OpenShift operator on your own premises. For an Indian bank or insurer, the OpenShift route keeps every prompt and finding inside its own data centre.
Where it stops
There is no public price and no published licensing unit. It tests; blocking in production is AI Guardrails, quoted on its own. TechBag has not verified which frameworks its reports map to. Gartner’s 2026 Market Shaper label sits in an Emerging Market Quadrant, not a Magic Quadrant, and the line dates from the CalypsoAI deal of September 2025.
The numbers behind the platform
What your F5 AI Red Team rollout looks like
List what you would attack
Inventory the AI apps, models and agents in production or close to it, and rank them by the data and actions each can reach.
Choose cloud or OpenShift
Decide whether tests run in AWS, Azure or Google Cloud or on your own OpenShift cluster, given where the prompts may go.
Attack one target first
Point the attacker agents at a single chatbot or agent, read every finding with its owner, and agree what counts as a fail.
Turn findings into policy
Feed the findings to AI Guardrails if you hold it, switch on the policies in a staging app, and re-test to confirm the fix.
Make re-testing routine
Schedule repeat runs for each target after model or prompt changes, so new attack patterns are tried as the database grows.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“The attacker agents found a way to make our loan chatbot quote internal rate rules. A manual test last year had missed it.”
“We run it on our OpenShift cluster, so claim-handling prompts never left our data centre during testing. That settled compliance.”
“Findings landed in Guardrails as policies we could switch on, rather than a spreadsheet the app team would ignore.”
“Our second run a quarter later caught two jailbreak styles the first one had not tried. Schedule it, do not do it once.”
“Ask early how licensing is counted. Our quote changed once we added the internal agents beside the customer chatbot.”
“Strong if you also buy AI Guardrails. On its own, someone still has to turn each finding into a fix in another tool.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the AI red-teaming market — tap any vendor to see why it sits where it does.
TechBag AI Red Teaming Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Quote-only; findings flow to F5 AI Guardrails.
Deployment Choice × Attack Depth
The grid nobody publishes — how many places the tester can run, your own premises included, vs how deep and varied its automated attacks go.
Three clouds or OpenShift; agent swarms and a growing database.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
F5 AI Red Team vs the AI red-teaming field
Against Palo Alto Prisma AIRS AI Red Teaming, Cisco AI Defense, Check Point AI Red Teaming, Promptfoo and Microsoft PyRIT — on attack method, coverage, fixes, price, support and India.
| Dimension | F5 AI Red Team | Palo Alto Prisma AIRS AI Red Teaming | Cisco AI Defense (AI Validation) | Check Point AI Red Teaming | Promptfoo | Microsoft PyRIT |
|---|---|---|---|---|---|---|
| What it is | Agent-swarm AI testing | Red teaming in AIRS | AI Validation module | Formerly Lakera Red | Open-source red teaming | Microsoft OSS framework |
| Deployment | 3 clouds or OpenShift | SaaS via Strata | Cloud, VPC or AI POD | Hosted platform | Local, cloud or on-prem | Your own Python setup |
| Attack method | Attacker-agent swarms | Library, agent, custom | Algorithmic prompts | Objectives + strategies | Plugins, then grading | Crescendo, TAP and more |
| Attack coverage | 10,000+ new a month | 50+ techniques | 200+ subcategories | 23 default objectives | Plugin catalogue | Build your own |
| Frameworks mapped | Not verified | OWASP, ATLAS, NIST | NIST, ATLAS, OWASP | Own three categories | OWASP, NIST, EU AI Act | Not documented |
| Scoring and reports | Format unpublished | 0–100 risk score | Per-model results | Severity per finding | Graded vulnerabilities | Scorers + memory |
| Finding to runtime fix | Into AI Guardrails | Informs AIRS runtime | Auto-made guardrails | Mapped to Guard levels | Gate, then fix | No runtime layer |
| Pricing model | Quote; unit unpublished | NGFW credits | Three tiers | Enterprise quote | Free tier, then custom | Free, MIT licence |
| Published entry price | Not published | No public rate | Not published | No list price | $0 Community tier | $0 open source |
| Included vs add-on | Guardrails sold apart | Needs SCM Pro | Validation in 2 tiers | Guardrails sold apart | SLA in Enterprise | Bring your own models |
| India data location | Your OpenShift cluster | Not in India | VPC option | Not published | Self-host anywhere | Runs where you run it |
| Support | Per F5 contract | Palo Alto portal | With subscription | Enterprise contract | Community or SLA | Community only |
| Lock-in and exit | Best inside F5 | Strata platform | Cisco Security Cloud | Check Point AI stack | Open-source exit | MIT, no vendor tie |
| Best fit | F5 shops securing AI | Palo Alto AI estates | Model-registry checks | Check Point AI stacks | Developers in CI/CD | In-house red teams |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose F5 AI Red Team if…
- ✓You already run, or plan to buy, F5 AI Guardrails and want test findings to arrive there as policy, not as a report
- ✓Prompts and model answers used in testing must stay on your own OpenShift cluster in an Indian data centre
- ✓You want automated attacks that repeat as F5’s database grows, not a one-off consultant engagement
Compare alternatives if…
- ✓Your runtime protection is Prisma AIRS, Cisco AI Defense or Check Point AI Guardrails — each vendor’s tester feeds its own
- ✓You want to start free — Promptfoo’s Community tier and Microsoft PyRIT cost nothing to licence
- ✓You need a published framework mapping today — Palo Alto, Cisco and Promptfoo document OWASP and NIST alignment
Do not expect…
- ✓A published price or licensing unit for AI Red Team on f5.com
- ✓Runtime blocking from this product alone; that is AI Guardrails, quoted on its own
- ✓A Gartner Magic Quadrant placement — the 2026 Market Shaper label is from an Emerging Market Quadrant
TechBag has no AI red teaming guide yet, so F5 AI Red Team sits outside the category guides. Browse all products to compare it with the rest of the catalogue. →
What does testing your own AI by hand cost you?
Drag the sliders (AI apps, models and agents tested; security-engineer-hour cost). Estimates model in-house time spent writing attack prompts, running tests and turning findings into fixes at an assumed 1.5 hours per AI target a year, with 70% of it removed by automated attacker agents and findings sent to guardrails. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Not published: f5.com shows no price for AI Red Team, it has no cloud-marketplace listing, and F5 does not say what the licence counts. The runtime fix, F5 AI Guardrails, is a separate product with its own quote. TechBag inventories your AI targets first, then gets both quoted in INR with GST.
F5 AI Red Team
Best for testing AI apps, models and agents
- Quote only; licensing unit not published
- AWS, Azure, Google Cloud or OpenShift
- Findings flow to F5 AI Guardrails
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
With F5 AI Guardrails
Best for closing findings at runtime
- Guardrails quoted as its own product
- AI Remediate links findings to policy
- Ask for both on one INR quote
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Which AI apps, models and agents will be tested first, and who owns the fix when one of them fails?
What does F5 count in the quote: targets, scans, capacity or time? Ask before adding more agents.
Will tests run in your AWS, Azure or Google Cloud account, or on an OpenShift cluster you operate?
If prompts or answers are sensitive, can the OpenShift operator run in your Indian data centre?
Do you hold F5 AI Guardrails, or will someone translate findings into another runtime product by hand?
Ask F5 for a sample report: does it map findings to OWASP LLM Top 10, NIST AI RMF or MITRE ATLAS?
How often will each target be re-tested, and who triggers a run after a model or system-prompt change?
Is Guardrails quoted together with Red Team? Ask for INR with GST, the term and the support level.
Questions buyers ask
Ready to evaluate F5 AI Red Team?
List the AI apps and agents worth attacking first, or let a TechBag advisor scope a pilot against one chatbot or agent on the deployment route you choose.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.