F5, Inc. (FFIV) FY2025 10-K and Q3 FY2026 10-Q Summary

Business

Source: Annual Report on Form 10-K for fiscal 2025, accession 0001048695-25-000157.

F5 sells application delivery and security technology: products that sit in front of an organization's applications and APIs, route and balance their traffic, keep them available and fast, and protect them from attack, whether the applications run in a data center, in a public cloud or at the network edge. Its customers are large enterprises (the company points to Fortune 1000 and Business Week Global 1000 companies in technology, financial services, transportation, education, manufacturing and health care), governments and public sector institutions, and service providers. Revenue comes from two lines of roughly equal size. Product revenue ($1.51 billion in fiscal 2025, 48.9% of the total) comes from hardware systems and from software sold as subscriptions, perpetual licenses, usage-based consumption, and SaaS or managed services. Services revenue ($1.58 billion, 51.1%) is mostly annual maintenance contracts, plus consulting and training. F5 sells mainly through distributors, value-added resellers, managed service providers and systems integrators. Two worldwide distributors accounted for 33.3% of fiscal 2025 revenue.

F5 reports as one segment and manages the business by geography. In fiscal 2025 the Americas generated $1.72 billion of revenue ($1.63 billion of it in the United States), EMEA $827.2 million and APAC $536.8 million. Sales outside the Americas were 44.2% of revenue. The company had 6,578 employees at September 30, 2025, 47% of them in the United States.

The portfolio is built on three product families:

• F5 BIG-IP, the company's established line for traditional ("legacy") applications built on monolithic, three-tier or client-server designs, which F5 says are still the most common application architecture. It covers application delivery (Local Traffic Manager, BIG-IP DNS, Policy Enforcement Manager, BIG-IP Next for Kubernetes) and security (Access Policy Manager, Advanced Web Application Firewall, an SSL decryption and traffic-steering product, Advanced Firewall Manager, Carrier Grade NAT, DDoS Hybrid Defender). BIG-IP is sold as packaged software on subscription or perpetual terms, and on F5's own hardware, the rSeries systems and VELOS chassis, which use custom FPGA logic alongside off-the-shelf silicon.
• F5 NGINX, built on the NGINX open-source software, a lightweight load balancer, web server, API gateway and Kubernetes ingress controller for modern, container-native applications. It is sold on subscription (NGINX Plus, NGINX One Console, NGINX Ingress Controller, F5 WAF for NGINX), including as a managed native service on Microsoft Azure.
• F5 Distributed Cloud Services, a SaaS and managed-service portfolio running on F5's private global network. It covers web application and API protection (WAF, DDoS mitigation, API security, bot defense, account-takeover protection), multicloud networking (Network Connect, App Connect), DNS, CDN and a managed Kubernetes App Stack.

In 2025 F5 introduced the F5 Application Delivery and Security Platform (ADSP) to unify these families under one platform, in response to what it describes as customers' growing preference for a platform over point solutions. The company describes a four-part AI strategy: selling current products for AI data delivery, AI runtime security and AI-factory load balancing; using AI models to enhance existing products; building new offerings; and partnering with AI leaders. In September 2025 it completed the acquisition of CalypsoAI Corp., an enterprise AI security provider, whose technology is meant to complete an F5 solution for securing AI inference. It also completed several smaller acquisitions in fiscal 2025.

In BIG-IP the company names Citrix and Broadcom as competitors. NGINX competes with AWS, Google Cloud Platform, Envoy and HAProxy. In application security F5 lists Akamai, Cisco, Cloudflare, Fortinet, Juniper Networks, Palo Alto, Radware and Thales (Imperva), and for Distributed Cloud Services it adds Fastly, Aviatrix and the public cloud providers. Hardware is built by a single primary contract manufacturer, Flex Ltd., in Guadalajara, Mexico and Zhuhai, China, and shipped from a fulfillment center in Memphis, Tennessee for the Americas and EMEA and from Zhuhai for APAC.

The Cyber Incident. On October 15, 2025, shortly after fiscal 2025 closed, F5 disclosed that a highly sophisticated nation-state threat actor had held long-term, persistent access to certain company systems and had exfiltrated files, including portions of BIG-IP source code and information about undisclosed BIG-IP vulnerabilities. The 10-K says F5 had no evidence that its software supply chain had been modified, and that it had prioritized BIG-IP software updates addressing all undisclosed high vulnerabilities. The incident runs through the rest of this document: in sales cycles, guidance, expenses, risk factors and litigation.

Risk factors

Source: Form 10-K for fiscal 2025, accession 0001048695-25-000157, Item 1A, with the updates in the Form 10-Q for the quarter ended June 30, 2026, accession 0001048695-26-000067, Part II, Item 1A.

The risks that bear most directly on F5's results and valuation:

• Security failures and the Cyber Incident. F5 sells security, so a compromise of its own systems or products affects demand as well as cost. The company warns that customers may defer purchases or decline to renew, that insurance may become much more expensive or unavailable on comparable terms, that government investigators could impose undertakings, consent decrees or penalties that raise development costs or change how it operates, and that new findings about the incident's scope could add costs and liabilities. It also warns that the incident could encourage other attackers. In the June 2026 10-Q the company added a warning that increasingly capable AI models and coding agents can discover and exploit vulnerabilities faster, shortening the time F5 and its customers have to respond.
• AI disruption of the core business. Also new in the June 2026 10-Q: F5 warns that AI technologies could automate or simplify functions its application delivery and security products now perform. If customers or investors come to believe that AI tools can replace parts of its offerings, demand and the stock price could suffer whether or not that disruption actually happens. Separately, AI features in its products carry legal, regulatory and reputational risk under evolving rules such as the EU's.
• Channel and customer concentration. Most product sales go through partners on non-exclusive, typically one-year agreements, and two worldwide distributors accounted for 33.3% of fiscal 2025 revenue. In the first nine months of fiscal 2026, one distributor alone accounted for 23.1% of revenue.
• Single-source manufacturing and components. Hardware assembly is subcontracted to a single contract manufacturer, and several components come from single or limited sources with long and variable lead times. The June 2026 10-Q names rising costs of memory and storage as part of the supply-chain environment.
• Lumpy, back-end-loaded quarters. Sales cycles are long and unpredictable, a substantial share of orders arrives in the last weeks of each quarter, and the delay of a single large order can push revenue out of a quarter or a year.
• Product transitions and the shift to cloud and SaaS. New products can shorten the life of existing ones or lead customers to wait, and building cloud and SaaS infrastructure adds costs that may pressure the gross and operating margins F5 has achieved. Large cloud providers offer their own application delivery and security functions.
• Competition and consolidation. Larger rivals with more resources may bundle traffic management or security into broader offerings, and as F5 expands into security and AI, the set of competitors grows.
• Government sales. Sales to government agencies are a significant portion of revenue, made mostly through channel partners. They depend on budget cycles, certifications and audits, and can be ended for convenience. U.S. buyers may also require domestic manufacturing.
• Personal data, export controls and regulation. Privacy laws are tightening and some safe-harbor mechanisms for data transfers have been challenged. F5's products contain encryption and are subject to U.S. export controls, and diversion of products to restricted parties could bring penalties.
• Litigation and intellectual property. F5 is defending the long-running Lynwood copyright claim over NGINX code, the securities class action and derivative suits that followed the Cyber Incident (see Current quarter), and patent claims that it expects to grow as its market exposure grows. It also relies on open-source and third-party licensed code.
• Taxes and currency. The tax rate depends on the geographic mix of profits, stock-based compensation, audits and rules such as the OECD Pillar Two minimum tax. Sales are priced in U.S. dollars, so a stronger dollar makes F5's products more expensive abroad, and a growing share of operating costs is incurred in foreign currencies. F5 has not hedged currency exposure.
• Israel and other operations. F5 has offices and employees in Israel, where hostilities and military reserve call-ups could disrupt operations. It also has facilities in the seismically active San Francisco Bay Area.

Management's discussion: fiscal 2025

Source: Form 10-K for fiscal 2025, accession 0001048695-25-000157, Item 7.

Fiscal 2025 was a year of hardware-led growth. Net revenues rose to $3.09 billion from $2.82 billion in fiscal 2024. Product revenue grew 18.5% (up $235.8 million) to $1.51 billion and services revenue grew 2.3% to $1.58 billion. Within products:

• Systems revenue rose 31.3% to $705.6 million, which management attributes to higher customer demand and price increases on systems. The year before it had fallen 19.9%, which the company attributed to lower shipments after demand constrained by the 2022 supply-chain shortage was fulfilled in fiscal 2023.
• Software revenue rose 9.2% to $803.1 million on renewals and new purchases of subscriptions. Subscription revenue was $507.6 million, SaaS and managed services $175.6 million (down from $193.2 million) and perpetual licenses $119.9 million.

Management said demand had stabilized and improved after the macroeconomic uncertainty at the start of fiscal 2024. Gross margin rose to 81.4% from 80.2%. Management says a more favorable product mix improved product margins, largely offsetting higher product costs. Operating expenses grew to $1.75 billion. Research and development rose 10.1% and general and administrative 19.9%, the latter partly from acquisition-related professional fees. Restructuring charges were $25.5 million, from workforce reductions in the first and fourth quarters ($11.3 million and $14.3 million). Income from operations rose to $765.9 million (24.8% of revenue) from $658.6 million (23.4%). The effective tax rate fell to 14.3% from 18.5%, mainly because of stock-based compensation and tax reserves. Net income was $692.4 million, or $11.80 per diluted share, against $566.8 million, or $9.55, in fiscal 2024.

F5 carries no debt. Its $350 million revolving credit facility expired undrawn on January 31, 2025. Operating cash flow was $949.7 million. The company spent $502.1 million on share repurchases (1,879,403 shares at an average of $266.04, with $922.4 million of authorization left at year-end), $171.1 million on acquisitions and $43.3 million on capital expenditures. It pays no dividend. Cash and investments rose to $1.36 billion from $1.08 billion, with 64.0% held outside the United States. Deferred revenue kept growing on subscription and maintenance contracts. Days sales outstanding in the fourth quarter were 46.

Looking ahead, the 10-K said the Cyber Incident had not had a material impact on operations so far. Management expected it to disrupt sales cycles in the near term, with demand effects heaviest early in fiscal 2026 and normalizing in the second half, and possibly a near-term hit to operating margin.

Current quarter: third quarter of fiscal 2026 (three months ended June 30, 2026)

Sources: Form 10-Q for the quarter ended June 30, 2026, accession 0001048695-26-000067; third-quarter results release furnished on Form 8-K, accession 0001048695-26-000063.

Third-quarter net revenues were $865.1 million, up from $780.4 million a year earlier (the company rounds this to 11% growth). Product revenue rose 19.0% to $462.8 million, which F5 called its eighth consecutive quarter of double-digit product growth. Services revenue rose 2.7% to $402.2 million. Hardware again led:

• Systems revenue grew 32.4% to $239.5 million on higher customer demand, and became the larger part of product revenue (51.8%, against 46.5% a year earlier).
• Software revenue grew 7.4% to $223.3 million, mainly from subscription sales.

By region, the Americas grew to $478.6 million from $431.0 million and EMEA to $256.0 million from $202.1 million, while APAC fell to $130.5 million from $147.3 million.

Gross margin improved to 82.2% from 81.0%. Operating expenses grew faster than revenue, to $498.2 million (57.6% of revenue against 55.8%), so GAAP operating margin slipped to 24.7% from 25.2%. Income from operations was $213.3 million. The largest increases were:

• research and development, up $28.3 million (20.8%), from technology costs (up $13.5 million), personnel (up $10.9 million) and higher professional services fees (up $2.6 million), which F5 says were driven by its response to the Cyber Incident;
• general and administrative, up $16.9 million (21.5%), mainly personnel (up $11.7 million), plus $3.2 million more in professional services fees, which F5 also says were driven by its response to the Cyber Incident;
• sales and marketing, up $17.6 million (8.0%).

The 10-Q's Cyber Incident note puts the costs F5 incurred in response to the incident at $3.0 million for the quarter and $26.5 million for the nine months, and records $5.3 million of insurance recoveries in other income, net. Other income was $12.9 million, against $16.7 million, and included those recoveries. The effective tax rate fell to 8.0% from 10.8%, mainly because of a change in unrecognized tax benefits. During the quarter the IRS closed its audit of F5's fiscal 2019 federal return with no adjustments. Net income was $208.2 million, or $3.62 per diluted share, against $189.9 million, or $3.25. On the company's non-GAAP basis, which excludes items including stock-based compensation, amortization of purchased intangibles, acquisition-related charges, incident costs and the insurance recoveries, operating margin was 35.0% (34.3% a year earlier) and diluted EPS was $4.73 ($4.16).

For the nine months, revenue was $2.50 billion (against $2.28 billion), net income $536.0 million and diluted EPS $9.29 (against $8.54). Operating cash flow rose to $841.4 million from $741.6 million on higher collections. F5 used $501.1 million of cash for share repurchases, including excise taxes, buying 1.91 million shares at an average of $261.83. Capital expenditures were $63.7 million, up from $27.1 million. Cash and investments reached $1.63 billion. Deferred revenue rose to $2.19 billion from $2.0 billion at September 30, 2025, which the company attributes to maintenance contracts on strong systems shipments and to subscriptions. Remaining performance obligations were $2.2 billion, 58.8% of it expected to be recognized within 12 months. Inventories rose to $126.9 million from $77.2 million, most of the increase in raw materials ($95.9 million against $50.3 million).

Acquisition. On June 15, 2026, F5 acquired SurePath AI, Inc., a provider of network-based AI discovery, intent classification and shadow-AI detection, for $50.1 million; its technology will be integrated into the F5 AI Security Platform, and the 10-Q says the acquisition did not have a material impact on operating results.

Outlook. With third-quarter results on July 27, 2026, F5 raised its fiscal 2026 outlook for the third time this fiscal year, to revenue growth of approximately 9% to 10%.

Litigation. A putative securities class action (Smith v. F5, Inc., et al., W.D. Wash., filed December 19, 2025) alleges false or misleading statements about F5's cybersecurity capabilities. It covers buyers of the stock from October 28, 2024 to October 27, 2025. Two pension funds were appointed lead plaintiffs on March 13, 2026 and filed an amended complaint on May 20, 2026. Two related derivative suits were consolidated on March 11, 2026 as In re F5 Inc. Derivative Litigation and are stayed until the motions to dismiss the class action are resolved. In the separate Lynwood case, discovery continues on the remaining copyright claim over NGINX Plus code. F5 has recorded no loss accrual for any of these matters.

Subsequent events

Source: Form 10-Q for the quarter ended June 30, 2026, accession 0001048695-26-000067; Form 8-K, accession 0001048695-26-000063.

The June 2026 10-Q has no subsequent-events note, and it discloses no acquisitions, divestitures, borrowings or other financings after the quarter ended June 30, 2026. The SurePath AI acquisition described under Current quarter closed on June 15, 2026, before the quarter ended. The post-quarter developments the filings do disclose are:

• July 22, 2026: F5 and certain of its executives moved to dismiss the amended complaint in the securities class action. The company says it intends to defend the claims vigorously.
• July 27, 2026: F5 reported third-quarter results and raised its fiscal 2026 guidance, as described above.
• August 3, 2026: 56,627,182 shares of common stock were outstanding, against 56.8 million at June 30, 2026.