Skip to main content

F5, INC.

For the period ended Sep 30, 2025. Filed Nov 25, 2025.

View on SEC.gov

About this filing

A company's yearly report to the SEC, with audited financial statements. It is the fullest account a company gives of its business, its finances and the risks it sees.

FY2025 · Filed Nov 25, 2025

FFIV$310.84-0.3%Stored close · as of Nov 6, 2026

What changed in Risk Factors?

Read the current filing

The baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.

Compared 204 previous paragraphs and 210 current paragraphs.

180 unchanged; 22 reworded; 7 added; 2 removed; 0 previous and 1 current paragraphs rearranged.

Tables are not compared: 0 previous and 0 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.

A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.

Added paragraphs (7)

Current report

•The Cyber Incident has had and may continue to have an adverse effect on our business, reputation, customer, employee and partner relations, results of operations, financial condition and cash flows;

Current report

The Cyber Incident has had and may continue to have an adverse effect on our business, reputation, customer, employee and partner relations, results of operations, financial condition and cash flows

Current report

The Cyber Incident may harm our reputation, our customers, employee and partner relations and our operations and business. Customers may in the future defer purchasing or choose to cancel or not renew their agreements or subscriptions with us.

Current report

We may expend significant costs and expenses related to the Cyber Incident including in connection with our investigations, and to address the damage to our reputation, customer, employee and partner relations. If we are unable to maintain the trust of our current and prospective customers and partners, or our personnel continue to have to devote significant time to the Cyber Incident, our business, market share, results of operations and financial condition could be negatively affected.

Current report

As a result of the Cyber Incident and market forces beyond our control, the cost of our insurance may increase substantially, and we may not be able to obtain additional or comparable insurance coverage on commercially reasonable terms. In addition, governmental authorities investigating the Cyber Incident may seek to impose undertakings, injunctive relief, consent decrees, or other civil or criminal penalties, which could, among other things, materially increase our software development and related expenses or otherwise require us to alter how we operate our business. Further, any legislative or regulatory changes adopted in reaction to the Cyber Incident could require us to make modifications to the operation of our business that could have an adverse effect or increase or accelerate our compliance costs.

Current report

We have not seen any evidence of modification to our software supply chain, including our source code and our build release pipelines. We have confirmed that the threat actor exfiltrated files from our BIG-IP product development environment and engineering knowledge management platform. The discovery of new or different information regarding the Cyber Incident, including with respect to its scope and impact on our systems, products or customers, could increase our costs and liabilities related to the Cyber Incident and result in further damage to our business, reputation, intellectual property, results of operations and financial condition. The Cyber Incident also may embolden other threat actors to further target our systems, which could result in additional harm to our business. We cannot ensure that our steps to secure our systems, our product development environments and protect the security and integrity of the products that we deliver will be successful to protect against threat actors or cyberattacks or perceived by existing and prospective customers as sufficient to address the harm caused by the Cyber Incident.

Current report

Further, our Distributed Cloud Services infrastructure is dependent on our IT systems and related software interfaces, including third-party cloud hosting providers, in order to maintain a reliable and consistent level of performance for our customers. If those systems experience an outage, fail, or are otherwise interrupted, or if our ability to connect to or interact with one or more networks is interrupted, platform services may function at a diminished level or not at all. This could harm our ability to deliver services to our customers, which could harm our customers and our financial results.
Removed paragraphs (2)

Previous report

Our products must successfully operate with products from other vendors. As a result, when problems occur in a network, it may be difficult to identify the source of the problem. The occurrence of software or hardware problems, whether caused by our products or another vendor’s products, may result in the delay or loss of market acceptance of our products. The occurrence of any of these problems may harm our business and results of operations.

Previous report

•economic uncertainty around the world, including continued economic uncertainty as a result of sovereign debt issues in Europe; and
Reworded paragraphs (22)

Previous wording

Security vulnerabilities or control failures in our IT infrastructure or multicloud application security and delivery products and services as well as unforeseen product errors could have a material adverse impact on our business results of operations, financial condition and reputation

Current wording

•Security vulnerabilities or control failures in our IT infrastructure or multicloud application delivery and security products and services as well as unforeseen product errors could have a material adverse impact on our business, results of operations, financial condition and reputation;

Previous wording

•Our success depends on sales and continued innovation of our application security and delivery product lines;

Current wording

•Our success depends on sales and continued innovation of our application delivery and security product lines;

Previous wording

•We may not be able to compete effectively in the application security and delivery market; and

Current wording

•We may not be able to compete effectively in the application delivery and security market; and

Previous wording

•Security vulnerabilities or control failures in our IT infrastructure or multicloud application security and delivery solutions and services as well as unforeseen product errors could have a material adverse impact on our business results of operations, financial condition and reputation;

Current wording

Security vulnerabilities or control failures in our IT infrastructure or multicloud application delivery and security products and services as well as unforeseen product errors could have a material adverse impact on our business, results of operations, financial condition and reputation

Previous wording

In the ordinary course of business, we store sensitive data, including intellectual property, personal data, our proprietary business information and that of our customers, suppliers and business partners on our networks. In addition, we store sensitive data through cloud-based services that may be hosted by third parties and in data center infrastructure maintained by third parties. The secure maintenance of this information is critical to our operations and business strategy. Our IT infrastructure and those of our partners and customers are subject to the increasing threat of intrusions by a wide range of bad actors and malicious parties, including computer programmers, hackers or sophisticated nation-state and nation-state supported actors, or they may be compromised due to employee error or wrongful conduct, malfeasance, or other disruptions. Despite our security measures, and those of our third-party vendors, our IT infrastructure has experienced breaches or disruptions and may be vulnerable in the future to breach, attacks or disruptions. If any breach or attack compromises our IT infrastructure, creates system disruptions or slowdowns or exploits security vulnerabilities therein, the information stored on our networks or those of our customers could be accessed and modified, publicly disclosed, or lost or stolen, and we may be subject to liability to our customers, individuals, suppliers, business partners and others, and may suffer reputational and financial harm.

Current wording

In the ordinary course of business, we store sensitive data, including intellectual property, personal data, our proprietary business information and that of our customers, suppliers and business partners on our networks. In addition, we store sensitive data through cloud-based services that may be hosted by third parties and in data center infrastructure maintained by third parties. The secure maintenance of this information is critical to our operations and business strategy. Our IT infrastructure and those of our partners and customers are subject to the increasing threat of intrusions by a wide range of bad actors and malicious parties, including computer programmers, hackers or sophisticated nation-state and nation-state supported actors, or they may be compromised due to employee error or wrongful conduct, malfeasance, or other disruptions. Despite our security measures, and those of our third-party vendors, our IT infrastructure has experienced breaches or disruptions, including the Cyber Incident, and may be vulnerable in the future to breach, attacks or disruptions. If any breach or attack, including the Cyber Incident, compromises our IT infrastructure, creates system disruptions or slowdowns or exploits security vulnerabilities therein, the information stored on our networks or those of our customers could be accessed and modified, publicly disclosed, or lost or stolen, and we may be subject to liability to our customers, individuals, suppliers, business partners and others, and may suffer reputational and financial harm.

Previous wording

Our multicloud application security and delivery products and services are used by our customers to manage their critical applications and data. Bad actors and other malicious parties, have in the past and may attempt in the future to exploit security vulnerabilities and control weaknesses in our internal IT infrastructure or cloud environments that support our SaaS-based and managed solutions and services as well as our products that may be deployed in a customer environment. Despite our efforts to harden our IT infrastructure, our security and delivery products and services against these risks, those efforts may not be successful, and from time to time, those systems and products could be compromised. Threat actors can seek to exploit, among other things, known or unknown vulnerabilities and control weaknesses in technology included in our IT infrastructure, security and delivery products and services, and failure to quickly identify, patch or mitigate security vulnerabilities or strengthen security controls could render our IT infrastructure, security and delivery products and services susceptible to a cyber-attack which may subject the Company to liability to our customers, suppliers, business partners and others, as well as reputational and financial harm. Moreover, inadequate or incomplete security monitoring, logging, asset management, or internal reporting and escalation, or gaps in coverage of security tools in our environment, could impact our ability to detect and respond to threats early and efficiently, giving threat actors an opportunity to gain access to our environment undetected. Finally, we rely on a number of third parties who connect to our network or with whom we share data, to support our business and operations, and to the extent that these third parties have weaknesses or deficiencies in their security program or vulnerabilities, they present business, operational, reputational, financial and legal risk. If any one or more of these vendor's security is compromised, it could have similar consequences as if we experienced a security event ourselves.

Current wording

Our multicloud application delivery and security products and services are used by our customers to manage their critical applications and data. Bad actors and other malicious parties, have in the past and may attempt in the future to exploit security vulnerabilities and control weaknesses in our internal IT infrastructure or cloud environments that support our SaaS-based and managed solutions and services as well as our products that may be deployed in a customer environment. Despite our efforts to harden our IT infrastructure, our delivery and security products and services against these risks, those efforts may not be successful, and from time to time, those systems and products could be compromised. Threat actors can seek to exploit, among other things, known or unknown vulnerabilities and control weaknesses in technology included in our IT infrastructure, delivery and security products and services, and failure to quickly identify, patch or mitigate security vulnerabilities or strengthen security controls could render our IT infrastructure, delivery and security products and services susceptible to a cyber-attack which may subject the Company to liability to our customers, suppliers, business partners and others, as well as reputational and financial harm. Moreover, inadequate or incomplete security monitoring, logging, asset management, or internal reporting and escalation, or gaps in coverage of security tools in our environment, could impact our ability to detect and respond to threats early and efficiently, giving threat actors an opportunity to gain or maintain access to our environment undetected. Finally, we rely on a number of third parties who connect to our network or with whom we share data, to support our business and operations, and to the extent that these third parties have weaknesses or deficiencies in their security program or vulnerabilities, they present business, operational, reputational, financial and legal risk. If any one or more of these vendors' security is compromised, it could have similar consequences as if we experienced a security event ourselves.

Previous wording

Our products may also contain undetected errors, defects, or vulnerabilities when first introduced or as new versions are released. We have experienced these issues in the past in connection with new products and product upgrades. As our products and customer IT infrastructures become increasingly complex, customers may also experience unforeseen errors in implementing our products into their IT environments. We expect that these errors, defects, or vulnerabilities will be found from time to time in new or enhanced products after commencement of commercial shipments. Any of these may temporarily or permanently disable our end-customers’ networks, information technology infrastructure or other systems, or expose our end-customers’ networks to attacks or compromise from security threats. These problems may cause us to incur significant warranty and repair costs, divert the attention of our engineering personnel from our product development efforts, cause significant customer relations problems, and impact demand for our products and services. We may also be subject to liability claims for damages. We carry insurance policies covering these types of liabilities, but these policies may not provide sufficient protection should a claim be asserted. A material product liability claim may harm our business and results of operations.

Current wording

Our products may also contain undetected errors, defects, or vulnerabilities when first introduced or as new versions are released. We have experienced these issues in the past in connection with new products and product upgrades. Our products also must successfully operate with products from other vendors. As our products and customer IT infrastructures become increasingly complex, customers may also experience unforeseen errors in implementing our products into their IT environments or integrating them with other vendor products. We expect that these errors, defects, or vulnerabilities will be found from time to time in new or enhanced products after commencement of commercial shipments. Any of these may temporarily or permanently disable our end-customers’ networks, information technology infrastructure or other systems, or expose our end-customers’ networks to attacks or compromise from security threats. These problems may cause us to incur significant warranty and repair costs, divert the attention of our engineering personnel from our product development efforts, cause significant customer relations problems, result in legal claims or liability, and impact demand for our products and services. We may also be subject to liability claims for damages. We carry insurance policies covering these types of liabilities, but these policies may not provide sufficient protection should a claim be asserted. A material product liability claim may harm our business and results of operations.

Previous wording

Any errors, defects or vulnerabilities in our products or IT infrastructure could result in:

Current wording

Any errors, defects, control failures, or vulnerabilities in our products or IT infrastructure, including the Cyber Incident, could result in:

Previous wording

Many of our business processes depend upon our IT systems, the systems and processes of third parties, including cloud hosting service providers, and on interfaces with the systems of third parties. For example, our order entry system provides information to the systems of our contract manufacturers, which enables them to build and ship our products. If those systems fail or are interrupted, or if our ability to connect to or interact with one or more networks is interrupted, our processes may function at a diminished level or not at all. This could harm our ability to ship products or our ability to deliver cloud-based services, which could harm our financial results.

Current wording

Many of our business processes depend upon our IT systems, the systems and processes of third parties, including cloud hosting service providers, and on interfaces with the systems of third parties. For example, our order entry system provides information to the systems of our contract manufacturers, which enables them to build and ship our products. If those systems fail or are interrupted, or if our ability to connect to or interact with one or more networks is interrupted, our processes may function at a diminished level or not at all. This could harm our ability to ship products or our ability to deliver cloud-based services used in our operations, which could harm our financial results.

Previous wording

Customers are transitioning to a hybrid computing environment utilizing various cloud-based software and services accessed via various smart client devices. Pricing and delivery models are evolving and our competitors are developing and deploying cloud-based services for customers. In addition, new cloud infrastructures are enabling the emergence of new competitors including large cloud providers who offer their own application security and delivery functionality as well as smaller companies targeting the growing numbers of "born in the cloud" applications. We devote significant resources to develop and deploy our cloud-based and SaaS software and services strategies. While we believe our expertise and investments in software and infrastructure for cloud-based services provides us with a strong foundation to compete, it is uncertain whether our strategies will continue to attract the customers or generate the revenue required to be successful. In addition to software development costs, we are incurring costs to build and maintain infrastructure to support cloud-computing and SaaS services to secure our customers’ data. These costs may reduce the gross and operating margins we have previously achieved. Whether we are successful in this new business model depends on our execution in a number of areas, including:

Current wording

Customers are transitioning to a hybrid computing environment utilizing various cloud-based software and services accessed via various smart client devices. Pricing and delivery models are evolving and our competitors are developing and deploying cloud-based services for customers. In addition, new cloud infrastructures are enabling the emergence of new competitors including large cloud providers who offer their own application delivery and security functionality as well as smaller companies targeting the growing numbers of "born in the cloud" applications. We devote significant resources to develop and deploy our cloud-based and SaaS software and services strategies. While we believe our expertise and investments in software and infrastructure for cloud-based services provides us with a strong foundation to compete, it is uncertain whether our strategies will continue to attract the customers or generate the revenue required to be successful. In addition to software development costs, we are incurring costs to build and maintain infrastructure to support cloud-computing and SaaS services to secure our customers’ data. These costs may reduce the gross and operating margins we have previously achieved. Whether we are successful in this new business model depends on our execution in a number of areas, including:

Previous wording

We sell our products and services through multiple distribution channels in the United States and internationally, including leading industry distributors, value-added resellers, systems integrators, service providers and other indirect channel partners. We have a limited number of agreements with companies in these channels, and we may not be able to increase our number of distribution relationships or maintain our existing relationships. Recruiting and retaining qualified channel partners and training them in our technologies requires significant time and resources. These channel partners may also market, sell and support products and services that are competitive with ours and may devote more resources to the marketing, sales and support of such competitive products. Our indirect sales channel structure could subject us to lawsuits, potential liability, and reputational harm if, for example, any of our channel partners misrepresent the functionality of our products or services to customers or violate laws or our corporate policies. If we are unable to establish or maintain our indirect sales channels, our business and results of operations will be harmed. In addition, two worldwide distributors of our products accounted for 32.2% of our total net revenue for fiscal year 2024. A substantial reduction or delay in sales of our products to these distribution partners, if not replaced by sales to other indirect channel partners and distributors, could harm our business, operating results and financial condition.

Current wording

We sell our products and services through multiple distribution channels in the United States and internationally, including leading industry distributors, value-added resellers, systems integrators, service providers and other indirect channel partners. We have a limited number of agreements with companies in these channels, and we may not be able to increase our number of distribution relationships or maintain our existing relationships. Recruiting and retaining qualified channel partners and training them in our technologies requires significant time and resources. These channel partners may also market, sell and support products and services that are competitive with ours and may devote more resources to the marketing, sales and support of such competitive products. Our indirect sales channel structure could subject us to lawsuits, potential liability, and reputational harm if, for example, any of our channel partners misrepresent the functionality of our products or services to customers or violate laws or our corporate policies. If we are unable to establish or maintain our indirect sales channels, our business and results of operations will be harmed. In addition, two worldwide distributors of our products accounted for 33.3% of our total net revenue for fiscal year 2025. A substantial reduction or delay in sales of our products to these distribution partners, if not replaced by sales to other indirect channel partners and distributors, could harm our business, operating results and financial condition.

Previous wording

In addition, the impact of Brexit on EU-UK political, trade, economic and diplomatic relations continues to be uncertain and such impact may not be fully realized for several years or more. Continued uncertainty and friction may result in regulatory, operational, and cost challenges to our UK and global operations.

Current wording

•economic uncertainty around the world, including geopolitical, trade, economic and diplomatic relations may result in regulatory, operational, and cost challenges to our global operations; and

Previous wording

Our inability to successfully operate and integrate newly-acquired businesses appropriately, effectively and in a timely manner, or to retain key personnel of any acquired business, could have a material adverse effect on our ability to take advantage of further growth in demand for application security and delivery solutions and other advances in technology, as well as on our revenues, gross margins and expenses.

Current wording

Our inability to successfully operate and integrate newly-acquired businesses appropriately, effectively and in a timely manner, or to retain key personnel of any acquired business, could have a material adverse effect on our ability to take advantage of further growth in demand for application delivery and security solutions and other advances in technology, as well as on our revenues, gross margins and expenses.

Previous wording

Our continued success depends on our ability to identify and develop new software and systems products and new features for our existing software and systems products, to meet the demands of these changes, and the acceptance of those products and features by our existing and target customers. In addition, our software and systems products must interoperate with our end customers’ IT infrastructure, including the expanding use of the cloud and hybrid cloud environments, which often have different specifications, deploy products from multiple vendors, and utilize multiple protocol standards. Our customers’ IT infrastructure is becoming more complex and we may be reliant on orchestration and interoperability with third party vendors on whom we are reliant for testing and support of new software and systems product versions and configurations. If we are unable to identify, develop and deploy new software and systems products and new product features on a timely basis, our business and results of operations may be harmed.

Current wording

Our continued success depends on our ability to identify and develop new software and systems products and new features for our existing software and systems products, to meet the demands of these changes, and the acceptance of those products and features by our existing and target customers. In addition, our software and systems products must interoperate with our end customers’ IT infrastructure, including the rapid adoption of AI-enabled software and systems, expanding use of the cloud and hybrid cloud environments, which often have different specifications, deploy products from multiple vendors, and utilize multiple protocol standards. Our customers’ IT infrastructure is becoming more complex and we may be reliant on orchestration and interoperability with third party vendors on whom we are reliant for testing and support of new software and systems product versions and configurations. If we are unable to identify, develop and deploy new software and systems products and new product features on a timely basis, our business and results of operations may be harmed.

Previous wording

Our success depends on sales and continued innovation of our application security and delivery product lines

Current wording

Our success depends on sales and continued innovation of our application delivery and security product lines

Previous wording

We expect to derive a significant portion of our net revenues from the sale of our cloud, software and hardware application security and delivery product lines in the future. Implementation of our strategy depends upon these products being able to solve critical network availability, performance and security problems for our customers. If our products are unable to solve these problems for our customers or if we are unable to sustain the high levels of innovation in product feature sets needed to maintain leadership in what will continue to be a competitive market environment, our business and results of operations will be harmed.

Current wording

We expect to derive a significant portion of our net revenues from the sale of our cloud, software and hardware application delivery and security product lines in the future. Implementation of our strategy depends upon these products being able to solve critical network availability, performance and security problems for our customers. If our products are unable to solve these problems for our customers or if we are unable to sustain the high levels of innovation in product feature sets needed to maintain leadership in what will continue to be a competitive market environment, our business and results of operations will be harmed.

Previous wording

•Issues related to the development and use of artificial intelligence ("AI") could give rise to legal and/or regulatory action, damage our reputation or otherwise materially harm of our business;

Current wording

Issues related to the development and use of artificial intelligence ("AI") could give rise to legal and/or regulatory action, damage our reputation or otherwise materially harm our business

Previous wording

A substantial portion of our business depends on the demand for information technology by large enterprise customers and service providers. We are dependent upon the overall economic health of our current and prospective customers. International, national, regional and local economic conditions, such as recessionary economic cycles, protracted economic slowdown or further deterioration of the economy could adversely impact demand for our products. Demand for our products and services depends substantially upon the general demand for application security and delivery solutions, which fluctuates based on numerous factors, including capital spending levels and growth of our current and prospective customers, as well as general economic conditions. Moreover, the purchase of our products is often discretionary and may involve a significant commitment of capital and other resources. Future economic projections for the information technology sector are uncertain as companies continue to reassess their spending for technology projects and embrace a range of consumption models from physical systems to software, SaaS-based and managed services solutions. As a result, spending priorities for our current and future customers may vary and demand for our products and services may be impacted. In addition, customer buying patterns are changing over time and more customers seek to rent software on a subscription basis and to reduce their total cost of ownership. These evolving business models could lead to changes in demand and licensing strategies, which could have a material adverse effect on our business, results of operations and financial condition.

Current wording

A substantial portion of our business depends on the demand for information technology by large enterprise customers and service providers. We are dependent upon the overall economic health of our current and prospective customers. International, national, regional and local economic conditions, such as recessionary economic cycles, protracted economic slowdown or further deterioration of the economy could adversely impact demand for our products. Demand for our products and services depends substantially upon the general demand for application delivery and security solutions, which fluctuates based on numerous factors, including capital spending levels and growth of our current and prospective customers, as well as general economic conditions. Moreover, the purchase of our products is often discretionary and may involve a significant commitment of capital and other resources. Future economic projections for the information technology sector are uncertain as companies continue to reassess their spending for technology projects and embrace a range of consumption models from physical systems to software, SaaS-based and managed services solutions. As a result, spending priorities for our current and future customers may vary and demand for our products and services may be impacted. In addition, customer buying patterns are changing over time and more customers seek to rent software on a subscription basis and to reduce their total cost of ownership. These evolving business models could lead to changes in demand and licensing strategies, which could have a material adverse effect on our business, results of operations and financial condition.

Previous wording

We may not be able to compete effectively in the application security and delivery market

Current wording

We may not be able to compete effectively in the application delivery and security market

Previous wording

The markets we serve are rapidly evolving and highly competitive, and we expect competition to persist and intensify in the future. As we expand our reach and role into a broader set of multicloud solutions, the companies that we consider competitors evolves as well. In addition to server load balancing, traffic management, and other functions normally associated with application delivery, our suite of solutions has expanded our addressable market into security, and policy management, where we compete with a number of companies focused on niche areas of application security.

Current wording

The markets we serve are rapidly evolving and highly competitive, and we expect competition to persist and intensify in the future. As we expand our reach and role into a broader set of multicloud solutions, the companies that we consider competitors evolves as well. In addition to server load balancing, traffic management, and other functions normally associated with application delivery, our suite of solutions has expanded our addressable market into security, and policy management, where we compete with a number of companies focused on niche areas of application security. Similarly, as we continue building AI functionality into our offerings, we expect competition to increase in the future, from established competitors and new market entrants, as AI technologies are integrated into the markets in which we compete.

Previous wording

We are a party to lawsuits in the normal course of our business. Litigation in general, and intellectual property and securities litigation in particular, can be expensive, lengthy and disruptive to normal business operations. Moreover, the results of complex legal proceedings are difficult to predict. Responding to lawsuits has been, and will likely continue to be, expensive and time-consuming for us. An unfavorable resolution of these lawsuits could adversely affect our business, results of operations or financial condition.

Current wording

We are a party to lawsuits in the normal course of our business. Litigation in general, and intellectual property and securities litigation in particular, can be expensive, lengthy and disruptive to normal business operations. Further, we could face litigation in connection with the Cyber Incident. Moreover, the results of complex legal proceedings are difficult to predict. Responding to lawsuits has been, and will likely continue to be, expensive and time-consuming for us. An unfavorable resolution of these lawsuits could adversely affect our business, results of operations or financial condition.

Previous wording

•Continued macroeconomic downturns or uncertainties may harm our industry, business, and results of operations;

Current wording

Macroeconomic downturns or uncertainties may harm our industry, business, and results of operations
Rearranged current paragraphs (1)

Current report — wording carried from elsewhere

Climate change and associated regulation may have an impact on our business