SurePath AI

• The secure web gateway and platform incumbents whose network path already carries enterprise traffic can ship comparable AI-usage visibility, the absorption F5 has now performed by acquiring SurePath rather than partnering.
• SurePath's discovery capability now depends on F5's roadmap, so a reprioritization of the AI Security Platform could leave the acquired product and team sidelined.
• Public traction depends on one self-displayed customer testimonial and the acquisition itself, so no independently reported customer scale exists to confirm demand.
• The public record shows no proprietary corpus or benchmark that would make the intent-classification and redaction hard to reproduce, so what survives as an advantage is the network placement and the acquired customers, not proprietary technology.

SurePath AI sold to the enterprise security leader who has lost sight of how employees, applications, and agents use generative AI. The company framed the problem as a visibility and control gap: AI operates across the organization without the security team seeing which tools are in use or what data leaves in a prompt, and blocking the tools outright pushes usage underground.

F5's own research, cited when it acquired the company, reports that most organizations already face an AI-related operational or security challenge and are preparing for autonomous agents, which corroborates that the pain is real and current. The problem statement is clear and the buyer is named, though the pain is framed in terms common to the shadow-AI category rather than quantified for SurePath's own customers. [s1, s3, s4]

SurePath AI governs GenAI use through network redirects, out-of-band analysis, and SASE, proxy, DNS, and SWG integrations, without requiring direct application integrations. It captures AI traffic through network redirects and out-of-band analysis, reveals which public and private models, tools, and agents are in use, classifies the intent behind each request, redacts sensitive data before a prompt reaches a model, and logs every interaction for audit. Access is enforced by role and group, and traffic can be routed to approved private models through a branded portal.

The mechanism is documented on the company's own pages and described in F5's acquisition announcement, which is a detailed acquirer account of what the product does. No independent technical benchmark of its detection or redaction is in the public record, so the capability rests on the vendor's description and F5's due-diligence interest rather than external evaluation. [s3, s4, s7]

SurePath AI competed in the emerging market for governing workforce use of generative AI, alongside network- and gateway-based peers that discover shadow AI and enforce policy on AI traffic. Its differentiator was placement: a network-based approach that needs no changes to existing applications, which lowers the cost of deployment for a security team.

That position is also its exposure. The vendors whose network path already carries enterprise traffic, the secure web gateway and platform incumbents, can add the same AI-usage visibility, and F5 has now done exactly that by acquiring SurePath rather than building it. The capability is valuable but absorbable, which the acquisition demonstrates. [s4, s5, s7]

Public evidence of SurePath's traction is thin in absolute terms but carries one strong indirect signal. The company's own site names one customer, C&R Software, in testimonials, and no independently reported customer count or revenue figure appears in the record.

The acquisition supplies what the customer list does not. F5, a large publicly traded application and API security vendor, chose to buy SurePath and make its discovery capability a launch component of a new platform, which implies the product and its customers passed a strategic buyer's technical and commercial review. That is an indirect indicator of traction, not proof of independent scale. [s1, s5]

SurePath AI was founded in 2023 by Casey Bleeker, who served as chief executive, and Randy Birdsall, its chief product officer. Both are publicly identifiable and hold relevant senior roles at the company.

The cited record does not document a prior exit, a sustained publication record, or independent industry recognition for the founders beyond their work at SurePath, so the team reads as credible and in-domain without the category-defining track record that would earn a higher mark. The acquisition by F5 is an outcome for this company, not evidence of a prior pattern. [s2, s5]

SurePath AI records every generative-AI interaction and generates audit trails, which supports a customer's own compliance and monitoring obligations. Access control by role and group, and redaction of sensitive data before it reaches a model, are the product's main data-protection controls.

SurePath states in its FAQ that it holds both SOC 2 Type I and Type II attestations, validated through completed independent audits. Its trust center at trust.surepath.ai gates every document behind an access request, so a buyer sees the attestation claim before the audit reports. F5 now positions the combined platform for regulated environments with data-residency and sovereignty requirements. [s3, s4, s8, s9]

Add analyzed competitors to compare them side by side with SurePath AI.

SurePath AI sold to the security or compliance leader at an enterprise that adopted generative AI faster than it could govern it. The buyer is defined by the need to see and control AI use across employees, applications, and agents without blocking the tools people want. F5 describes the target for the combined post-acquisition platform as regulated industries with data-residency and sovereignty needs, a statement of where the acquirer aims the platform rather than of SurePath's own customer mix.

The segment reads as exposed to gateway and network-platform competition. Vendors selling network- or gateway-based governance address the same buyer, and a larger platform already sitting in enterprise traffic could reach that buyer without a new purchase.

SurePath's technical advantage was where it sat and how little it required. By capturing AI traffic at the network level through redirects and out-of-band analysis, it discovered shadow AI, classified the intent of each request, redacted sensitive data before a prompt reached a model, and traced agent tool calls and MCP connections, all with no changes to existing applications.

The intent classification and redaction are the kind of engineering a funded competitor can rebuild, and no named proprietary dataset appears in the record to make the models hard to match. The durable part of the advantage is the network placement and frictionless deployment, not a technical secret.

SurePath courted buyers through a demo-led funnel built on rapid, low-friction deployment, with channel or partner evidence absent from the cited record. Its public proof of who was buying is thin: C&R Software is quoted in site testimonials, and the site's trusted-organizations wall also shows Georgia United Credit Union and Divine Savior Academy without deployment detail.

SurePath ran a demo-led motion with limited public customer proof, and F5 then incorporated the company into its new AI Security Platform. What that integration yields in distribution for the SurePath line is not yet evidenced.

SurePath's reviewed pages publish no pricing, which is typical for an enterprise security product sold through negotiated deals to security teams, and its site routes buyers to a demo rather than a price. The public record does not state the unit it charged by.

Post-acquisition packaging and standalone pricing are not described in the cited record, and F5 positions the product as a component of a broader platform rather than a standalone line with its own list price.

SurePath's public materials describe software the customer deploys, and they name no managed service that accepts accountability for outcomes. Its lightweight network-based model was designed to stand up quickly and without changes to existing application architectures, which lowers the operational cost of adoption.

On the reviewed pages, operation of the control appears to sit with the customer. The audit logging and analytics support the customer's own operations rather than substituting a vendor-run service for them.

SurePath's trust story depends on giving the customer visibility and records: it logs every AI interaction, generates audit trails, and redacts sensitive data before it leaves for a model. SurePath states in its FAQ that it holds both SOC 2 Type I and Type II attestations, controls that ease procurement rather than guaranteeing outcomes. Its trust center at trust.surepath.ai showed an access-request gate with no openly listed certifications in the February 2025 capture.

F5 now positions the combined platform for regulated environments with data-residency and sovereignty requirements.

SurePath's design is an ecosystem play by construction: it brokers access between users and many public and private models, routes traffic to approved models, and traces connections to agent tools and MCP servers. It positioned itself as the control point between the workforce and the growing set of AI services rather than as a single-model tool.

F5 now uses that control-point position inside a broader platform: it folded SurePath's discovery into a platform that also tests and protects AI, so SurePath's visibility feeds F5's red-teaming and runtime protection rather than standing alone.

SurePath AI was founded in 2023 by Casey Bleeker, who led as chief executive, and Randy Birdsall, its chief product officer, and grew to about nineteen people before the acquisition. The founders are publicly identifiable in relevant senior roles.

The record does not show a prior exit or a sustained public research or engineering profile for the team beyond SurePath itself. A team of that size building a product a strategic acquirer wanted between its 2023 founding and mid-2026 is a credible execution signal, though not the independently recognized track record a stronger team credential would require.