Search K
Appearance
Remediate AI risks
EARLY ACCESS
AI Remediate is not generally available yet. Contact F5 sales if you are interested in joining the early access program.
Overview
AI Remediate closes the loop between detection and mitigation of AI risks. When an AI Red Team report finds that a model is vulnerable to one or more of your custom intents, AI Remediate generates a package of GenAI guardrails designed to block those attacks. You review the package, then deploy it to the projects that use the vulnerable models.
Use AI Remediate when:
- A Red Team report shows successful attacks against a custom intent, and you want guardrails that target those attacks.
- You want to measure how much a set of guardrails would reduce attack success before you put it in front of live traffic.
- You run scheduled Red Team campaigns and want a remediation package created automatically each time vulnerabilities are found.
AI Remediate requires both AI Guardrails and AI Red Team. AI Red Team finds the vulnerabilities, and AI Guardrails runs the guardrails that AI Remediate generates.
In the UI, AI Remediate appears in the navigation as AI remediate > Remediation.
For a worked example from Red Team finding to deployed package, see Remediate Red Team findings end to end.
Before you begin
Make sure you have the following.
License and entitlements
An F5 AI Security license that includes AI Guardrails, AI Red Team, and the AI Remediate capability. AI Remediate requires both AI Guardrails and AI Red Team. Contact your F5 team to confirm your entitlements.
If your organization doesn't have the entitlement, the AI remediate navigation section and the Remediate options on reports don't appear.
Roles and permissions
AI Remediate uses one permission, Remediation access. Assign it to a role in Settings > Roles. For the full list, see Role permissions.
You also need permission to read AI Red Team reports, and permission to update the projects that you deploy a package to. For more information, see Permissions in AI Security.
Red Team campaign with custom intents
Remediation is based on custom intent results. To request a remediation, you need a completed AI Red Team report that:
- Was created from a campaign that contains custom intents (agent attack prompts or agentic resistance attacks). Signature attack and operational attack results aren't used.
- Found at least one vulnerability for a custom intent.
To create a campaign with custom intents, see Get started with AI Red Team.
Deployment type
| Deployment | Support |
|---|---|
| SaaS | Available through the early access program. |
| Self-hosted (operator or Helm) | Supported from operator Helm chart 1.10.0 and Red Hat Ecosystem Catalog 0.14.0. See September 23, 2026 Operator release notes. |
| Self-hosted (CAI deploy application) | Supported from CAI deploy application v3.8.0. See CAI deploy application v3.8.0 release notes. |
Infrastructure for self-hosted deployments
Self-hosted deployments need the AI Guardrails and AI Red Team models deployed, plus the AI Remediate model. The AI Remediate model runs on its own GPU node.
| Resource | Minimum for AI Remediate |
|---|---|
| GPU | 1x CUDA-compatible GPU with 24 GB memory, dedicated to the application |
| CPU | 4 cores (x86) |
| Memory | 16 GB |
| Disk | 200 GB on the AI Remediate node, to download the model |
Add these requirements to the requirements for AI Guardrails and AI Red Team.
To enable AI Remediate, use the guide for your installation method:
- Helm: Set
inference.values.remediate.enabled,inference.values.guardrails.enabled, andinference.values.redteam.enabledtotrue. See Install with Helm. - Red Hat OpenShift: Set
inference.enabledandinference.values.remediate.enabledtotruein the operator YAML, and make sure AI Guardrails and AI Red Team are also enabled. See Deploy on Red Hat OpenShift. - CAI deploy application: Deploy AI Guardrails and AI Red Team, and answer
yesto Would you like to deploy F5 Remediate to the cluster? The installer creates a dedicatedremediatenode group on AWS, Azure, Google Cloud Platform, or Oracle Cloud Infrastructure. See Deploy AI Security to the cloud and Installer prompts.
How remediation works
What happens when you request a remediation
- AI Remediate collects the conversations from the report's custom intent attacks, including whether each attack succeeded.
- It generates one or more GenAI guardrails. Each guardrail is a natural-language description of what to block.
- It evaluates the guardrails against the report's attacks and records how many attacks the guardrails would prevent.
- It optimizes the guardrail definitions, then tests them again. It repeats this process several times and aims for a package F1 score above 90%.
- When it finishes, the remediation is ready for review. Nothing is added to your guardrails or projects until you import or deploy the package.
Results
A completed remediation shows:
| Result | Description |
|---|---|
| Attack prevention rate | The share of the report's successful attacks that the suggested guardrails would block. The Remediation list shows Pre-remediation and Post-remediation values. |
| Suggested guardrails | The individual guardrails that make up the package, and their definitions. |
| F1 and Details | Evaluation metrics for the package: F1 score, overall accuracy, and a confusion matrix (true and false positives and negatives). |
| Performance per custom intent | Pre- and post-remediation scores for each custom intent in the report. |
| Download results | A file with the detailed results. The download expires 7 days after the results are created. |
| Time to respond | For deployed or imported packages, the time from when the report finished to when the package was deployed. |
Statuses
| Status | Meaning | What you can do |
|---|---|---|
| Remediation requested | The remediation is queued. | Cancel |
| In progress | AI Remediate is generating and evaluating guardrails. | Cancel |
| Ready | The package is ready for review. | Import and test, Import and deploy, Reject, Delete |
| Error | The remediation failed. | Retry |
| Imported | You imported the package without deploying it to projects. | Test, Reject |
| Deployed | You deployed the package to one or more projects. | Test |
| Rejected | You rejected the package. | Delete |
| Canceling / Canceled | You canceled the remediation. | Delete (when canceled) |
Defaults and limits
- One remediation for each report. After a remediation is created for a report, the report's Remediate button changes to View.
- Auto-remediation is off by default. Turn it on for each report or schedule.
- Packages deploy as a whole. Remediation guardrails are deployed as a package. You can't choose individual guardrails from the package to deploy. After deployment, you can delete or change the guardrails in the package, but this might reduce the package's efficacy, because the guardrails are tested together as an ensemble.
- Deployed guardrails scan prompts by default. To change the scan direction, select Guardrails > Custom guardrails, find the remediation package, and open the guardrail details. You can set the scan direction to prompts, or to prompts and responses.
- Deployed guardrails default to Block mode and are enabled. You can change each guardrail to Audit mode or turn it off before you deploy.
- Package name. The package is named after the report, in the format
<report name> package. - Remediation guardrails can't be exported or added to another package. On the Guardrails page, guardrails with a Remediation source are excluded from export and package creation.
- Deployed packages can't be rejected. You can reject a package that is ready or imported, but not one that you've deployed to projects.
- Deleting a remediation. You can delete a remediation only when its status is Ready, Rejected, or Canceled.
How AI Remediate interacts with other features
- AI Red Team reports: Remediation is requested from, and linked to, a single report. Eligible reports show a Remediate button in the reports list and in the report's custom intents section. After a remediation exists, the button changes to View.
- Guardrails and the playground: Importing a package adds it to the playground and your custom guardrails list, with the source Remediation. The guardrail and package names show Created by: Remediation.
- Projects: You can deploy only to projects that use the same connections (models) as the report. Deploying adds the guardrails to each selected project's guardrail configuration.
- Data purge: Organization data purge includes remediation prompt data.
- Audit logs: Creating, deploying, rejecting, and deleting a remediation create the audit events
remediation-created,remediation-deployed,remediation-rejected, andremediation-deleted. See Get audit logs.
Request a remediation from a report
Log in to the AI Security UI.
Select AI Red Team > Reports.
Find an eligible report. Do one of the following:
- In the reports list, select Remediate for the report. Eligible reports show a Remediate button.
- Open the report, then select Remediate in the custom intents section.
If you don't see Remediate, the report has no vulnerable custom intents. See Troubleshooting.
In Remediate vulnerabilities, review the custom intents and models that the report found to be vulnerable.
Select Remediate.
AI Security opens the Remediation page. The status shows Remediation requested, then In progress.
Turn on auto-remediation
Turn on auto-remediation to request a remediation automatically when a report finishes and finds vulnerable custom intents.
Select AI Red Team > Reports, then start a new report or schedule.
Select a campaign that contains custom intents.
Select the Remediate checkbox.
The checkbox is unavailable until you select a campaign with custom intents.
Finish creating the report or schedule.
When the report completes with at least one vulnerable custom intent, AI Security creates the remediation for you. In the remediation's Time to respond details, auto-created remediations show Auto-remediation instead of Remediation requested.
To set auto-remediation with the API, set remediationSettings.autorun to true when you run a campaign or create a schedule. See the API reference.
Review a remediation
- Select AI remediate > Remediation.
- Optional: Filter the list by Last updated, Status, or Remediation by.
- Select a remediation to open its details.
- Review the Attack prevention rate, F1 score, and Suggested guardrails.
- Optional: Select Details to see the confusion matrix and accuracy.
- Optional: Review Performance per custom intent and select Download results for the full data.
Import and test the package
Import the package to try it in the playground before you add it to projects.
Open a remediation with the status Ready.
Select Import and test.
Review the dialog, then confirm.
The package is added to the playground and your custom guardrails list. The status changes to Imported.
Test the package in the playground. You can also select Test on the remediation later.
To make the guardrails available to your projects, publish the package.
For more information on testing guardrails, see Work with guardrail versions.
Deploy the package to projects
Open a remediation with the status Ready.
Select Import and deploy.
If the button is unavailable, no projects use the connections from the report. Add the required connections to a project, then try again.
Select the projects to deploy to. Optional: Select Live projects only to show only projects with the Live flag.
For each guardrail, choose a Mode (Block or Audit) and set Enable.
Select Import and deploy.
The status changes to Deployed, and the guardrails are added to the selected projects.
TIP
To monitor a new package before it blocks traffic, deploy it in Audit mode first. After you review the results in the prompt logs, switch to Block mode in the project.
Reject a package
Reject a package if you don't want to use it. You can't undo a rejection.
- Open a remediation with the status Ready or Imported.
- Select Reject package.
- Optional: Enter a reason.
- Confirm.
If you imported the package, AI Security deletes it from the playground. The status changes to Rejected.
Cancel, retry, or delete a remediation
- Cancel: While the status is Remediation requested or In progress, select Cancel.
- Retry: If the status is Error, select Retry. The panel shows how many times the remediation has been retried.
- Delete: In the Remediation list, delete a remediation with the status Ready, Rejected, or Canceled.
Verify the remediation
After you deploy a package:
- Open the project and confirm that the remediation guardrails appear in its guardrail list with the mode you chose.
- Send a test prompt similar to one of the successful attacks in the report. Confirm that the guardrail blocks or flags it.
- Review the prompt logs for the project. See Understand prompt history logs.
- Run the same AI Red Team campaign again against the project's connections and compare the results with the original report.
Troubleshooting
| Issue | Cause | Resolution |
|---|---|---|
| No AI remediate section in the navigation | Your organization doesn't have the entitlement, or your role lacks the permission. | Confirm the entitlement with your F5 team. Ask your administrator to add the Remediation access permission to your role. |
| No Remediate button for a report | The campaign had no custom intents, or no custom intent attack succeeded. | Run a campaign with custom intents. Signature and operational attack results aren't used for remediation. |
| Remediate checkbox is unavailable when creating a report | The selected campaign has no custom intents. | Select a campaign with custom intents. |
| "It was not possible to create a remediation" | The report isn't eligible, or a remediation already exists for it. | Open the existing remediation from the report's View button. |
| Status is Error | The remediation job failed, for example because a model server didn't respond. | Select Retry. For self-hosted deployments, check that the Remediate and scanner model pods are running. |
| Remediation stays in Remediation requested | The job hasn't started. On self-hosted deployments, the Remediate model or worker might not be running. | Check the remediate node group and inference pods. See Installer prompts. |
| Import and deploy is unavailable | No projects use the connections from the report. | Add the report's connections to a project. |
| Rejecting fails with "package has already been deleted" | The imported package was deleted from the playground. | Delete the remediation, or contact support. |
| The package's F1 score is below 90% | AI Remediate couldn't reach its target after several optimize-and-test loops. This can happen when the attacks are varied or the custom intent is broad. | Review Performance per custom intent and the confusion matrix to see where the package falls short. Test the package in the playground or deploy it in Audit mode to check its behavior on real traffic. If it isn't good enough, reject it, then run a new report and request a new remediation from it. |
| One guardrail in the package has a low F1 score | That guardrail catches few of the attacks, or flags benign prompts. The package is evaluated as an ensemble, so other guardrails might cover the attacks it misses. | Check the package's overall F1 score before you act. If you edit or delete the guardrail after deployment, retest the package, because changes can reduce the package's efficacy. |
| A remediation guardrail uses the same language as the original custom intent | The guardrail is generated from the custom intent and the attack conversations, so its definition can repeat the intent's wording. | This isn't an error. Review the definition to confirm it describes what you want to block. To make it broader or more specific, edit it in Guardrails > Custom guardrails, then retest the package. |
| Download results shows Download expired | Results downloads expire 7 days after creation. | Review the results in the UI. |
References
For more information, see: