iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A practical 90-day AI security plan starts with one application, turns its safeguards into repeatable fleet-wide operations, and then adds controls for autonomous agents. F5’s framework sequences the work this way: first establish and test the security of a single AI application, then build the operating processes to manage many applications, and finally address agents that plan and act through tools. The sequence matters because scaling controls before you understand one application’s risks can spread weak assumptions; agent controls, in turn, must account for behavior beyond a simple prompt and response.
What is F5’s 30-60-90-day AI security framework?
It is a phased implementation plan for building AI security practices, not a claim that every organization can complete the work in exactly three calendar months. F5 describes the phases as cumulative: establish a secure application foundation, make the controls operational across an AI estate, and adapt them for autonomous agents. Teams can use the 30-, 60-, and 90-day marks as planning checkpoints, adjusting the pace to their application count, risk, and capacity.
The framework is useful because it connects security design to ongoing operations. Model evaluation and red teaming are not treated as a one-time approval; guardrails are expected to change as threats and applications change. At scale, a team also needs to know who is accountable for each application, when it was last tested, how updates are deployed, and whether security operations staff can investigate incidents. For agents, the program must observe the chain of reasoning, decisions, and tool calls, and constrain what actions they can take.
| Phase | Primary outcome | Controls emphasized |
|---|---|---|
| Days 0–30 | A tested security baseline for one AI application | Model selection, red teaming before and after application integration, guardrail design, staging validation, and a repeatable remediation loop |
| Days 30–60 | Repeatable operations across the AI estate | Risk-tiered test schedules, guardrail rollout and rollback, fleet-wide zero-day response with service-level agreements, SOC enablement, and application ownership records |
| Days 60–90 | Controls suited to autonomous agents | Linked observability of reasoning, tool calls, and decisions; action-level permissions; approval gates; and thought injection when a step becomes risky |
F5’s central premise is that each phase builds on the previous one. The checkpoints are therefore more than a calendar: the organization should carry the practices and evidence from the single-application phase into fleet operations, and use those operating capabilities as a foundation for agent-specific safeguards.
#1 Best Overall
What should we do in the first 30 days?
Choose one representative AI application and establish its security baseline before expanding the program. Evaluate the model on its own, build the application around it, test the combined system, and then design and validate guardrails against the risks the tests reveal.
1. Select a bounded application and model
Start with an application whose purpose, users, and expected behavior can be described clearly enough to test. Record which model is being considered and what the application adds around it. The point is not to assume a model is safe because it has existing safeguards: the application’s instructions, data, integrations, and user experience can change how the overall system behaves.
Set the scope of the first exercise so the team can identify what it is testing. The framework does not prescribe a model, a test suite, or a particular application type; the organization must choose a use case that is meaningful to its own risk. Keep the model-level baseline distinct from the later application-level test so that changes in behavior can be attributed to the added system layer.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems2. Red-team the bare model, then the full application
Test the model before it is integrated to establish a baseline. After building the application, red-team the combined system as well. Comparing the two tests helps show whether the application layer improved or worsened security. The second test should examine the system as users encounter it, not just repeat model-only checks against a different interface.
Use findings to identify where the application’s behavior, instructions, or connected capabilities create risks that need controls. Red teaming is not just a launch hurdle in this plan: it becomes a recurring activity when a new zero-day threat appears and when controls change. F5’s framework explicitly places testing both before and after the application layer is added.
3. Design guardrails from four sources
Build the application’s guardrails around four categories identified by F5:
- Existing regulations: requirements that already apply to the organization or use case.
- AI-specific regulations: relevant obligations specifically concerned with AI.
- Use-case threats: risks arising from the application’s intended purpose and context.
- Red-team findings: weaknesses or unsafe behaviors exposed by testing.
These categories are inputs to control design, not a ready-made list of controls. A guardrail should address an identified requirement or risk and be tested in the application context where it is expected to work. The framework does not prescribe specific policies or regulatory interpretations, so teams should map applicable obligations to their own jurisdiction and use case.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →4. Validate in staging and establish the response loop
Validate the guardrails in staging before redeploying them. The first phase’s essential operational outcome is a repeatable loop: red-team again when a new zero-day threat surfaces, patch the guardrails, validate the change, and redeploy. This makes guardrails a patchable security layer rather than a static launch configuration.
Capture enough information to repeat the cycle: what finding prompted a change, which guardrail was updated, how the update was validated, and what was redeployed. That record makes later review more useful and helps distinguish an untested change from one that has passed the organization’s validation process. These are practical implementation steps; F5’s framework defines the loop but does not specify a record format or a particular staging tool.
How do you scale AI security from one application to dozens?
In days 30–60, turn the successful single-application practices into a program that can be applied across the AI estate. F5 names four pillars: risk-tiered red-team cadences, a guardrail patch pipeline with rollout and rollback, fleet-wide zero-day response with service-level agreements, and SOC enablement.
Set risk-tiered red-team cadences
Not every application needs the same test cadence. Organize applications by risk and use that tiering to determine how often they are red-teamed. The framework calls for risk-tiered cadences but does not define tiers or prescribe intervals; organizations must decide those based on their applications and exposure rather than treating a single schedule as universally appropriate.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Make the cadence operational: each application should have a known testing status and a next expected test. A risk tier without a corresponding schedule, owner, and evidence of completion does not tell operators whether a system is being monitored as intended.
Make guardrail changes deployable and reversible
A fleet-wide guardrail patch pipeline should support rolling updates out across applications and rolling them back. Before an update is distributed, identify which applications it affects and how the organization will validate the change. If a rollout creates a problem, rollback capability provides a recovery path rather than leaving teams to improvise under pressure.
This approach treats guardrails like an operating layer that changes over time. It also exposes an important scaling issue: an update that is appropriate for one use case may not behave identically in another. A pipeline needs to account for which applications receive a patch and whether that patch is suitable for them; the framework establishes the rollout-and-rollback requirement but does not specify a technical implementation.
Rank #3
Define a fleet-wide zero-day response SLA
Establish service-level agreements for responding to zero-day threats across the AI estate. The framework calls for fleet-wide response with SLAs, but it does not publish a specific response time. Each organization must set its own target, communicate who is responsible for meeting it, and make clear how an affected application moves from detection through testing and remediation.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe first phase’s red-team, patch, validate, and redeploy loop provides a starting point for this response. At fleet scale, the additional task is coordinating the response across affected applications and owners rather than treating each discovery as an isolated project.
Prepare the SOC to investigate AI incidents
Enable the security operations center to investigate AI incidents. That means operators need a way to connect an alert or report to the relevant AI application and its accountable owner, and to understand what the application was doing when the incident occurred. The framework names SOC enablement as a pillar but does not prescribe a logging product, data schema, or investigation workflow.
Coordinate this work with the application teams. An incident response process is hard to execute if the SOC cannot identify the system, locate the responsible owner, or establish whether that application has been tested recently.
Know who owns each application and when it was last tested
The second phase is complete when the organization can answer, for every AI application, who owns it and when it was last tested. These two facts are a practical test of whether the program has moved beyond a successful pilot. If either is unknown, the organization cannot reliably route a finding to an accountable person or judge the application’s test status.
Maintain an inventory that makes those answers available to the teams responsible for risk and response. The framework does not require a particular inventory format; what matters is that ownership and last-test information are accurate and usable across the estate.
Why do AI agents need different security controls?
Agents can run continuously, reason through multi-step plans, and take actions through tools. That changes the security problem: controls designed only for a request and its response do not transfer cleanly to a system that can make intermediate decisions and perform actions.
For an ordinary request-and-response interaction, teams may focus on the user input and the final output. An agent’s path to an outcome matters too. If a tool call or an intermediate decision causes harm, reviewing only the final answer may not be enough to reconstruct what happened or identify where a safer intervention could have occurred.
Link reasoning, tool calls, and decisions
F5 recommends observability that links every thought, tool call, and decision so teams can reconstruct an incident after the fact. The goal is a connected account of the agent’s behavior, not isolated records that cannot show how a decision led to a tool action. This is especially relevant when an agent performs multiple steps or acts continuously.
Free tools Windows power users keep installed
One-click scans. No signup required.
Observability supports investigation; it does not, by itself, prevent a risky action. The framework pairs it with controls on what the agent is allowed to do and when a person must intervene. It does not specify a particular observability platform or require a particular format for recording an agent’s reasoning.
Constrain actions with permissions and approvals
Use action-level tool permissions and approval gates for high-impact actions. Permissions limit which tools or actions are available to an agent; approval gates add a human decision point before an action with significant consequences. This is more precise than giving an agent broad access and relying only on general instructions to behave safely.
Decide which actions are high impact in the context of each application, and set controls at the action level accordingly. The framework does not supply a universal list of high-impact actions, so the organization must define the boundary for its own agent and use case.
Use thought injection to redirect a risky step
When reasoning becomes risky, F5’s framework describes thought injection as a way to replace a dangerous step with a safer one while preserving task progress. It is an intervention in the agent’s reasoning flow, rather than simply blocking the entire task. Because the framework does not specify an implementation or guarantee that this technique will work in every system, organizations should treat it as a control to validate in their own agent environment.
What should an AI-security 90-day plan include?
Use the phase boundaries to check whether the program is producing evidence and operating capabilities, not merely completing activities. The following checkpoints translate F5’s framework into outcomes a team can review at each stage.
Best Value
| Checkpoint | Evidence to look for | Question to resolve before moving on |
|---|---|---|
| By day 30 | A model-level baseline, a red-team assessment of the combined application, guardrails informed by the four categories, staging validation, and a repeatable update loop | Can the team identify how the application changed the model’s security behavior and how it will respond to a new threat? |
| By day 60 | Risk-tiered test cadences, a guardrail rollout-and-rollback process, zero-day response SLAs, SOC enablement, and an inventory with owners and last-test dates | Can the organization route an issue to the right owner and manage a response across affected applications? |
| By day 90 | Agent observability linking reasoning, tool calls, and decisions, plus action-level permissions and approval gates for high-impact actions | Can the organization reconstruct an agent’s behavior and constrain or interrupt risky actions? |
The day-90 checkpoint is not a substitute for the earlier work. An organization should not skip application-level testing or fleet operations simply because it has begun deploying an agent. The framework’s logic is sequential: build a tested foundation, make it manageable at scale, then add controls suited to autonomous behavior.
How should you adapt the framework to your organization?
Keep the sequence, but adjust the amount of work and the timing to fit the organization’s AI estate. The framework provides no framework-specific statistics, required product, universal test cadence, fixed response SLA, or guaranteed security outcome. It is a structure for organizing controls, not a certification or proof that an application is secure.
- If you have one application: complete the model and combined-system testing, guardrail design, staging validation, and repeatable update loop before treating the effort as a mature program.
- If applications already exist across teams: inventory them and establish owners and test dates as part of scaling. Unknown applications or owners make fleet response harder to coordinate.
- If you are deploying agents: plan for linked behavioral observability and action constraints. A conventional request-and-response review does not cover the agent’s full sequence of decisions and tool use.
- If the 90-day schedule is unrealistic: retain the phase order and make the checkpoints evidence-based. The framework’s value is the progression of disciplines, not an unsupported promise that every organization can finish by a particular date.
F5’s framework is best read as a route from an individual application to a security operating model and then to agent-aware controls. The practical test at each stage is whether the organization can demonstrate the relevant capability: test and improve one system, manage changes and response across the estate, and observe and constrain agent actions.
Frequently Asked Questions
Does F5’s framework require a specific AI security product?
No product is specified as a prerequisite in the framework. It describes capabilities and operating practices, so an organization can map them to its existing processes and systems.
Can we use the plan if our AI applications are already in production?
Yes. The phases can be used as maturity checkpoints rather than a rule that work must begin before launch. Start by establishing what is deployed and who owns it, then prioritize the applications that need baseline testing and controls.
Does passing a red-team exercise prove an AI application is secure?
No. A red-team result describes what was tested and found under particular conditions; it cannot establish that every future threat or behavior has been covered. The framework’s recurring test-and-patch loop reflects that security work continues after an initial assessment.
What is the difference between an AI agent and a chatbot for this framework?
The relevant distinction is whether the system can carry out multi-step plans and take actions through tools, potentially on an ongoing basis. Those capabilities create intermediate decisions and actions that need to be observable and constrained, not just a final response.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
