F5, Inc.

“Table of Contents Legal and Regulatory Risks Our failure to adequately protect personal information could have a material adverse effect on our business A wide variety of local, state, national, and international laws, directives and regulations apply to the collection, use, retention, protection, disclosure, transfer, and other processing of personal data. These data protection and privacy-related laws and regulations continue to evolve and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions and increased costs of compliance.”

Annual report 2025A · The company itself

“Item 1.Business General F5 is a multicloud application delivery and security provider committed to bringing a better digital world to life. F5 partners with the world’s largest, most advanced organizations to optimize and secure every application and Application Programming Interface ("API") anywhere, including on-premises, in the cloud, and at the network edge.”

Annual report 2025A · The company itself

“First, our current portfolio is solving security and performance challenges associated with AI model training and inference and in support of AI-driven workloads. We are selling F5 solutions in support of AI data delivery, AI runtime security and AI factory load balancing use cases.”

Annual report 2025A · The company itself

“We sell application delivery and security solutions for web application and API protection, hybrid multicloud networking, enterprise AI delivery and security, application migration, application modernization, zero trust architecture and post quantum cryptography readiness.”

Annual report 2025A · The company itself

“F5 Distributed Cloud Service offerings are available as packaged software and SaaS-based consumption models and include the following: •F5 Distributed Cloud Web App and API Protection ("WAAP"). A comprehensive SaaS-based security solution, F5 Distributed Cloud WAAP allows our customers to accelerate time-to-service, lower total cost of ownership, and increase security efficacy on a cloud native platform that is fully integrated across a single policy engine and management console.”

Annual report 2025A · The company itself

“•Mitigation against OSI Model Layer 3-Layer 7 application-based and volumetric DDoS attacks through advanced F5 Distributed Cloud DDoS Mitigation, a managed, cloud-delivered mitigation service that detects and mitigates large-scale network, SSL, and application-targeted attacks in real time. •Enhanced API security, which leverages machine-based learning, auto-discovery, and anomaly detection, which automates the entire process of finding, securing, and monitoring APIs for anomalous behavior. •Next-generation, AI enabled bot mitigation through F5 Distributed Cloud Bot Defense provides our customers the ability to defend applications and APIs from automated attacks.”

Annual report 2025A · The company itself

“The solution leverages AI to analyze massive amounts of traffic and machine learning to ensure sustainable bot prediction models with high efficacy. •Protection from sophisticated account takeover attempts. •F5 Distributed Cloud Multi-Cloud Networking ("MCN"). Our MCN solutions simplifies networking with an integrated service stack that securely connects both networks and application workloads, lowering operational costs and increasing agility.”

Annual report 2025A · The company itself

“Our failure to comply with applicable laws and regulations, or to protect such data, could result in enforcement action against us, including fines, imprisonment of company officials and public censure, claims for damages by end-customers and other affected individuals, damage to our reputation and loss of goodwill (both in relation to existing end-customers and prospective end-customers), any of which could have a material adverse effect on our operations, financial performance, and business.”

Annual report 2025A · The company itself

“Table of Contents Sales and Marketing Our customers include a wide variety of large enterprise businesses, public sector institutions, governments, and service providers, including many among Fortune 1000 and Business Week Global 1000 companies. Our customers include businesses in technology, telecommunications, financial services, transportation, education, manufacturing, healthcare, and government.”

Annual report 2025A · The company itself

“Strategic and Industry Risks •Our success depends on our timely development of new software and systems products and features, market acceptance of new software and systems product offerings and proper management of the timing of the life cycle of our software and systems products; •Our success depends on sales and continued innovation of our application delivery and security product lines; 12 Table of Contents •Issues related to the development and use of artificial intelligence ("AI") could give rise to legal and/or regulatory action, damage our reputation or otherwise materially harm our business; •Our business could be adversely impacted by conditions affecting the markets in which we compete; •Industry consolidation may result in increased competition; •We may not be able to compete effectively in the application delivery and security market; and •Misuse of our products could harm our reputation.”

Annual report 2025A · The company itself

“We may not be able to compete effectively in the application delivery and security market The markets we serve are rapidly evolving and highly competitive, and we expect competition to persist and intensify in the future. As we expand our reach and role into a broader set of multicloud solutions, the companies that we consider competitors evolves as well. In addition to server load balancing, traffic management, and other functions normally associated with application delivery, our suite of solutions has expanded our addressable market into security, and policy management, where we compete with a number of companies focused on niche areas of application security.”

Annual report 2025A · The company itself

“F5 is leveraging AI to accelerate the strength of both our current and future offerings. F5 uses AI in its application delivery and security solutions to support performance and efficacy.”

Annual report 2025A · The company itself

“In September 2025, we completed the acquisition of CalypsoAI Corp. ("CalypsoAI") which is expected to integrate into our F5 ADSP to create a complete solution for securing AI inference.”

Annual report 2025A · The company itself

“Item 1.Business General F5 is a multicloud application delivery and security provider committed to bringing a better digital world to life. F5 partners with the world’s largest, most advanced organizations to optimize and secure every application and Application Programming Interface ("API") anywhere, including on-premises, in the cloud, and at the network edge.”

Annual report 2025A · The company itself

“Our F5 NGINX family also delivers essential application delivery and security services but is optimized for modern, container-native and microservices-based applications and APIs. Our F5 Distributed Cloud Services is a portfolio of SaaS and managed services designed for both traditional and modern applications where a SaaS deployment model is preferred.”

Annual report 2025A · The company itself

“First, our current portfolio is solving security and performance challenges associated with AI model training and inference and in support of AI-driven workloads. We are selling F5 solutions in support of AI data delivery, AI runtime security and AI factory load balancing use cases.”

Annual report 2025A · The company itself

“In response to customers' growing preference for a platform approach, in 2025 we introduced the F5 Application Delivery and Security Platform ("ADSP"). The F5 ADSP aims to unify high-performance traffic management with advanced application and API security at scale across hybrid and multicloud environments.”

Annual report 2025A · The company itself

“We sell application delivery and security solutions for web application and API protection, hybrid multicloud networking, enterprise AI delivery and security, application migration, application modernization, zero trust architecture and post quantum cryptography readiness.”

Annual report 2025A · The company itself

“The solution leverages AI to analyze massive amounts of traffic and machine learning to ensure sustainable bot prediction models with high efficacy. •Protection from sophisticated account takeover attempts. •F5 Distributed Cloud Multi-Cloud Networking ("MCN"). Our MCN solutions simplifies networking with an integrated service stack that securely connects both networks and application workloads, lowering operational costs and increasing agility.”

Annual report 2025A · The company itself

“Built from the F5 NGINX open-source software that powers hundreds of millions of websites and applications across the world, our F5 NGINX technology suite delivers a lightweight, agile ADC and API connectivity solution 5 Table of Contents for modern, container-native, micro-services-based applications and APIs. F5 NGINX delivers a range of capabilities including web server, load balancer, proxy, API gateways and caches in packaged software subscription consumption models.”

Annual report 2025A · The company itself

“Our F5 NGINX family also delivers essential application delivery and security services but is optimized for modern, container-native and microservices-based applications and APIs. Our F5 Distributed Cloud Services is a portfolio of SaaS and managed services designed for both traditional and modern applications where a SaaS deployment model is preferred.”

Annual report 2025A · The company itself

“Built from the F5 NGINX open-source software that powers hundreds of millions of websites and applications across the world, our F5 NGINX technology suite delivers a lightweight, agile ADC and API connectivity solution 5 Table of Contents for modern, container-native, micro-services-based applications and APIs. F5 NGINX delivers a range of capabilities including web server, load balancer, proxy, API gateways and caches in packaged software subscription consumption models.”

Annual report 2025A · The company itself

“Capturing growth in security and SaaS We continue to invest in expanding our SaaS-based F5 Distributed Cloud Services. Our F5 Distributed Cloud Services console extends visibility and simplifies management for F5 BIG-IP and F5 NGINX customers.”

Annual report 2025A · The company itself

“We sell packaged software in perpetual, subscription, and usage-based consumption models. We also sell our solutions in software-as-a-service ("SaaS") and managed services deployment models with subscription and usage-based consumption models.”

Annual report 2025A · The company itself

“Table of Contents Sales and Marketing Our customers include a wide variety of large enterprise businesses, public sector institutions, governments, and service providers, including many among Fortune 1000 and Business Week Global 1000 companies. Our customers include businesses in technology, telecommunications, financial services, transportation, education, manufacturing, healthcare, and government.”

Annual report 2025A · The company itself

“Key components of our strategy include: Solving multicloud application delivery and security challenges Our F5 BIG-IP family delivers essential application delivery and security services, ensuring applications operate efficiently and securely. It is optimized for traditional applications whether deployed on premises, in co-located data centers, or in cloud environments.”

Annual report 2025A · The company itself

“Table of Contents Sales and Marketing Our customers include a wide variety of large enterprise businesses, public sector institutions, governments, and service providers, including many among Fortune 1000 and Business Week Global 1000 companies. Our customers include businesses in technology, telecommunications, financial services, transportation, education, manufacturing, healthcare, and government.”

Annual report 2025A · The company itself

“F5 BIG-IP. Our F5 BIG-IP family of product offerings provide feature-rich, highly programmable and configurable application delivery and security solutions for legacy applications in enterprises and service providers.”

Annual report 2025A · The company itself

“A portion of our revenue is generated by sales to government entities, which are subject to a number of challenges and risks Sales to U.S. and foreign, federal, state, and local governmental agency end-customers account for a significant portion of our revenues and we may in the future increase sales to government entities.”

Annual report 2025A · The company itself

“General Risks •Macroeconomic downturns or uncertainties may harm our industry, business, and results of operations; •We face risks associated with having operations and employees located in Israel; •Our business is subject to the risks of earthquakes, fire, power outages, floods, and other catastrophic events, and to interruption by man-made problems such as terrorism; and •Climate change and associated regulation may have an impact on our business.”

Annual report 2025A · The company itself

“We face risks associated with having operations and employees located in Israel We have offices and employees located in Israel. As a result, political, economic, and military conditions in Israel and the surrounding region directly affect our operations.”

Annual report 2025A · The company itself

“In addition, cyber-attacks, acts of terrorism, or other geopolitical unrest could cause disruptions in our business or the business of our supply chain, manufacturers, logistics providers, partners, or end-customers or the economy as a whole. Any disruption in the business of our supply chain, manufacturers, logistics providers, partners or end-customers that impacts sales at the end of a fiscal quarter could have a significant adverse impact on our quarterly results.”

Annual report 2025A · The company itself

“General Risks •Macroeconomic downturns or uncertainties may harm our industry, business, and results of operations; •We face risks associated with having operations and employees located in Israel; •Our business is subject to the risks of earthquakes, fire, power outages, floods, and other catastrophic events, and to interruption by man-made problems such as terrorism; and •Climate change and associated regulation may have an impact on our business.”

Annual report 2025A · The company itself

“Table of Contents General Risks Macroeconomic downturns or uncertainties may harm our industry, business, and results of operations We operate globally and as a result, our business, revenues, and profitability may be impacted by global macroeconomic conditions. Adverse macroeconomic conditions both in the U.S. and abroad, including, but not limited to, rising interest rates, inflationary pressures on goods and services, challenges in the financial and credit markets, labor shortages, supply chain disruptions, trade uncertainty, adverse changes in global taxation and tariffs, sanctions, outbreaks of pandemic diseases, political unrest and social strife, armed conflicts, or other impacts from the macroeconomic environment could adversely affect our business, financial condition, results of operations and cash flows through, among others, softer demand of our products and services as well as unfavorable increases to our operating costs, which could negatively impact our profitability.”

Annual report 2025A · The company itself

“Cyber Incident On October 15, 2025, we disclosed a security incident in which a threat actor maintained long-term, persistent access to F5 systems, and exfiltrated certain files, referred to as the "Cyber Incident." For further information about the Cyber Incident, see "Risk Factors" included in Item 1A of Part I of this Annual Report on Form 10-K, and "Management’s Discussion and Analysis of Financial Condition and Results of Operations - Cyber Incident" included in Item 7 of Part II of this Annual Report on Form 10-K.”

Annual report 2025A · The company itself

“Further, we could face litigation in connection with the Cyber Incident.”

Annual report 2025A · The company itself

“In addition, as many of our products are subject to export control regulations, diversion of our products to restricted third parties by others could result in investigations, penalties, fines, trade restrictions and negative publicity that could damage our reputation and materially impact our business, operating results, and financial condition.”

Annual report 2025A · The company itself

“We are subject to governmental export and import controls that could subject us to liability or impair our ability to compete in international markets Our products are subject to U.S. export controls and may be exported outside the U.S. only with the required level of export license or through an export license exception because we incorporate encryption technology into our products. In addition, various countries regulate the import of certain encryption technology and have enacted laws that could limit our ability to distribute our products or our customers’ ability to implement our products in those countries.”

Annual report 2025A · The company itself

“Manufacturing We outsource the manufacturing of our products to various manufacturing partners, including our primary third-party manufacturer service provider, Flex Ltd. ("Flex"), to manufacture our hardware systems according to our specifications.”

Annual report 2025A · The company itself

“Table of Contents General Risks Macroeconomic downturns or uncertainties may harm our industry, business, and results of operations We operate globally and as a result, our business, revenues, and profitability may be impacted by global macroeconomic conditions. Adverse macroeconomic conditions both in the U.S. and abroad, including, but not limited to, rising interest rates, inflationary pressures on goods and services, challenges in the financial and credit markets, labor shortages, supply chain disruptions, trade uncertainty, adverse changes in global taxation and tariffs, sanctions, outbreaks of pandemic diseases, political unrest and social strife, armed conflicts, or other impacts from the macroeconomic environment could adversely affect our business, financial condition, results of operations and cash flows through, among others, softer demand of our products and services as well as unfavorable increases to our operating costs, which could negatively impact our profitability.”

Annual report 2025A · The company itself

“Table of Contents General Risks Macroeconomic downturns or uncertainties may harm our industry, business, and results of operations We operate globally and as a result, our business, revenues, and profitability may be impacted by global macroeconomic conditions. Adverse macroeconomic conditions both in the U.S. and abroad, including, but not limited to, rising interest rates, inflationary pressures on goods and services, challenges in the financial and credit markets, labor shortages, supply chain disruptions, trade uncertainty, adverse changes in global taxation and tariffs, sanctions, outbreaks of pandemic diseases, political unrest and social strife, armed conflicts, or other impacts from the macroeconomic environment could adversely affect our business, financial condition, results of operations and cash flows through, among others, softer demand of our products and services as well as unfavorable increases to our operating costs, which could negatively impact our profitability.”

Annual report 2025A · The company itself

“General Risks •Macroeconomic downturns or uncertainties may harm our industry, business, and results of operations; •We face risks associated with having operations and employees located in Israel; •Our business is subject to the risks of earthquakes, fire, power outages, floods, and other catastrophic events, and to interruption by man-made problems such as terrorism; and •Climate change and associated regulation may have an impact on our business.”

Annual report 2025A · The company itself

“Our business is subject to the risks of earthquakes, fire, power outages, floods, and other catastrophic events, and to interruption by man-made problems such as terrorism A significant natural disaster, such as an earthquake, a fire, a flood, or a significant power outage could have a material adverse impact on our business, operating results, and financial condition. We have an administrative and product development office and a third party contract manufacturer located in the San Francisco Bay Area, a region known for seismic activity.”

Annual report 2025A · The company itself

“However, there may be business operational risk due to the significant impacts climate change could pose to our employees’ lives, our supply chain, or electrical power availability from climate-related weather events.”

Annual report 2025A · The company itself

“Government demand and payment for our products and services may be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our products and services.”

Annual report 2025A · The company itself

“Finally, for purchases by the U.S. government, the government may require certain products to be manufactured in the United States and other relatively high cost manufacturing locations, and we may not manufacture all products in locations that meet the requirements of the U.S. government, affecting our ability to sell these products to the U.S. government.”

Annual report 2025A · The company itself

“As of September 30, 2025, we had 6,578 employees – over 99% of whom were full-time employees.”

Annual report 2025A · The company itself

“In addition, many of our employees in Israel are obligated to perform annual reserve duty in the Israeli military and are subject to being called for active duty under emergency circumstances. We cannot predict the full impact of these conditions on us in the future, particularly if emergency circumstances or an escalation in the political situation occurs. If many of our employees in Israel are called for active duty for a significant period of time, our operations and our business could be disrupted and may not be able to function at full capacity.”

Annual report 2025A · The company itself

“In addition, we are subject to a range of new and anticipated climate-related and sustainability-focused laws and regulations, including the E.U.’s Corporate Sustainability Reporting Directive. To meet the compliance requirements of these new regulations, we may incur extra costs to implement more internal controls, processes, and procedures, in order to assist in the oversight responsibilities for our management and board of directors.”

Annual report 2025A · The company itself

“Rapidly changing customer requirements to reduce carbon emissions also presents a risk of loss of business if we are not able to meet criteria.”

Annual report 2025A · The company itself

“In addition, natural disasters could affect our supply chain, manufacturing vendors, or logistics providers’ ability to provide materials and perform services such as manufacturing products or assisting with shipments on a timely basis. In the event our or our service providers’ information technology systems or manufacturing or logistics abilities are hindered by any of the events discussed above, shipments could be delayed, resulting in missed financial targets, such as revenue and shipment targets, for a particular quarter.”

Annual report 2025A · The company itself

“In the future, it may be necessary to renew licenses for third party intellectual property or obtain new licenses for other technology. These third party licenses may not be available to us on acceptable terms, if at all.”

Annual report 2025A · The company itself

“Industry consolidation may result in increased competition Some of our competitors have made acquisitions or entered into partnerships or other strategic relationships to offer a more comprehensive solution than they had previously offered. We have also entered into large, strategic partnerships to enhance our competitive position in the marketplace. As technology companies attempt to strengthen or maintain their market positions in the evolving application delivery, mobility, cloud networking and cloud platform markets, these companies continue to seek to deliver comprehensive solutions to end users and combine enterprise-level hardware and software solutions that may compete with our solutions and which could negatively impact our partnerships.”

Annual report 2025A · The company itself

“Government demand and payment for our products and services may be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our products and services.”

Annual report 2025A · The company itself

“In fiscal year 2025, sales outside of the Americas represented 44.2% of our net revenues.”

Annual report 2025A · The company itself

“In fiscal year 2025, sales outside of the Americas represented 44.2% of our net revenues.”

Annual report 2025A · The company itself

“In fiscal year 2025, sales outside of the Americas represented 44.2% of our net revenues.”

Annual report 2025A · The company itself