F5's Maddison: AI erases patch window, making virtual patching essential

Speaking at the Fal.Con security event, Maddison told theCUBE that AI-powered security must inspect traffic and produce real-time protection against zero-day threats. "All the protections that sit in what we call CDNs or WAFs are going to be AI-powered," he said. "They have to be going forward."

The urgency is measurable. CrowdStrike's threat research found AI-enabled adversary activity rose 89% year over year, with average breakout time down to 29 minutes and the fastest recorded intrusion at 27 seconds. Maddison said that inversion means an exploit often lands before an official patch is available.

F5's response includes embedding CrowdStrike's Falcon sensor directly onto F5 BIG-IP appliances, which sit at the network perimeter. More than 200 customers were already running the integration before the companies formalized it, with performance overhead measured at just 1% to 2%, Maddison said.

"We measured it at 1 to 2%, and they're perfectly willing to deal with that for the security that gets added to it," Maddison said. "That was always the trade-off between security and networking, high performance versus checking everything that comes through."

F5 is also applying a similar approach to AI gateways. The company announced a partnership this week with Salesforce Inc.'s MuleSoft, aimed at controlling how information is used and remediated rather than focusing on the information itself. "It's more around what you do with the information, how you remediate, versus the information itself," Maddison said.

The interview was part of SiliconANGLE's and theCUBE's coverage of Fal.Con. SiliconANGLE disclosed that theCUBE is a paid media partner for the event and that sponsors, including CrowdStrike, had no editorial control over the content.