F5 & Oracle plan OCI security tie-up for AI threats

F5 and Oracle have announced a planned collaboration to bring web application and API protection to Oracle Cloud Infrastructure customers. The effort is intended to integrate F5 security technology into Oracle's cloud environment.

The arrangement sits under a non-binding memorandum of understanding and is aimed at organisations running applications on Oracle Cloud Infrastructure, or OCI. It is designed to help customers protect critical applications and APIs against more advanced attacks while reducing operational complexity.

The move reflects growing demand for security tools that can be deployed inside existing cloud environments rather than through separate specialist systems. Web application and API protection has become a bigger focus for cloud providers and security vendors as businesses rely more heavily on internet-facing applications and machine-to-machine connections.

Oracle presented the collaboration as a way to give customers access to additional application security tools within OCI. F5, which focuses on application delivery and security, said the integration is meant to give cloud, security and platform teams a more direct way to secure workloads.

According to the companies, the planned offering is expected to address two main issues: defending applications and APIs from sophisticated attacks, and simplifying day-to-day security operations. Customers should be able to use those protections without needing specialist security expertise, they said.

That emphasis comes as companies face a rising volume of automated and AI-assisted threats. Attackers are increasingly using automation to identify and exploit software vulnerabilities quickly, putting pressure on technology teams to find interim protections while patches and remediation are completed.

"As cyber threats evolve, our customers need application and API protection that keeps pace without adding operational complexity," said KP Papamiltiadis, Senior Vice President of Global Partnerships at Oracle.

"Together, we plan to bring F5's application security expertise into OCI, helping customers protect critical applications and APIs while simplifying security operations, backed by Oracle's cloud infrastructure and support," Papamiltiadis said.

The companies did not disclose commercial terms or a launch timeline. They also did not specify which OCI services would first receive the planned protections, beyond saying the work would focus on securing web applications and APIs hosted on the platform.

For Oracle, the collaboration adds another security layer to a cloud business that has been expanding its networking, AI and infrastructure services. For F5, it extends its reach into one of the large public cloud platforms as customers seek to consolidate security tools closer to where applications run.

AI threats

The reference to AI-era security in the announcement underlines how cloud and security vendors are adjusting their messaging and product plans around a new generation of threats. Security providers argue that AI-supported attacks can speed up reconnaissance, vulnerability discovery and exploitation, leaving defenders with less time to respond.

F5 linked the planned Oracle work to that trend and pointed to AI runtime defence and virtual patching as important tools for cloud teams. Virtual patching is generally used to shield exposed systems from known weaknesses before permanent fixes can be applied.

"AI-powered attacks can find and exploit vulnerabilities faster than enterprises can patch them. Oracle and F5 see AI runtime defence as the answer for cloud teams, allowing for virtual patching that shields exposed systems while teams catch up on remediation," said John Maddison, Chief Marketing Officer at F5.

"Through the planned integration of F5's application security technology into OCI, we intend to provide security, application and platform teams with a proven, straightforward way to help protect their critical workloads with next-generation solutions powered by F5, without adding operational friction," Maddison said.

The announcement stops short of confirming a formal product launch and repeatedly describes the effort as planned rather than finalised. Even so, it signals that both companies see application and API security as a core requirement for cloud customers dealing with more distributed software environments and a faster threat cycle.