10-Q: F5 Reports Q1 Growth Amid Cyber Incident Costs

F5, Inc. reported a 7.3% increase in net revenues to $822.5 million for Q1 2026, driven by strong systems sales, despite an 8.1% decline in software revenue and significant costs related to a recent cyber incident.

Summary

• Net revenues increased by 7.3% to $822.5 million for the three months ended December 31, 2025, compared to $766.5 million in the prior year period.
• Product revenues grew 11.3% to $410.3 million, primarily due to a 36.7% increase in systems revenue to $218.4 million, driven by customer demand.
• Software revenue decreased by 8.1% to $191.9 million, mainly due to a decline in perpetual software sales.
• Service revenues increased by 3.6% to $412.2 million, attributed to increased initial purchases and renewals of maintenance contracts.
• Net income rose 8.2% to $180.1 million, resulting in diluted EPS of $3.10, up from $2.82 in the prior year.
• Operating expenses increased, with significant rises in sales and marketing (+9.1%), R&D (+8.2%), and G&A (+24.1%), partly due to costs associated with a cyber incident.
• The company incurred $17.5 million in costs during the quarter in response to a cyber incident disclosed on October 15, 2025.
• Cash and cash equivalents decreased by $144.5 million to $1.2 billion, primarily due to $301.1 million used for common stock repurchases.
• F5 acquired CalypsoAI Corp. on September 26, 2025, for $145.2 million in cash, enhancing its enterprise AI security offerings.

Sentiment

Score: 6

Explanation: StockSavvy.ai views this as a moderately positive report, with solid revenue and net income growth driven by strong systems sales, but tempered by a decline in software revenue and significant, ongoing costs and legal risks associated with a recent cyber incident.

Positives

• Overall net revenues increased by 7.3% year-over-year to $822.5 million.
• Product revenues saw an 11.3% increase, driven by strong systems sales growth of 36.7%.
• Net income grew by 8.2% to $180.1 million.
• Diluted earnings per share (EPS) increased by 9.9% to $3.10.
• Restructuring charges were significantly lower at $(43) thousand compared to $11.3 million in the prior year, indicating a more stable operational structure.
• The acquisition of CalypsoAI Corp. strengthens F5's position in enterprise AI security.
• The Revolving Credit Facility expired with no outstanding borrowings, indicating no current reliance on that debt.

Negatives

• Software revenue decreased by 8.1% to $191.9 million, primarily due to a decline in perpetual software sales.
• Gross margin slightly decreased from 81.7% to 81.5%.
• Operating expenses increased across sales and marketing (+9.1%), research and development (+8.2%), and general and administrative (+24.1%).
• General and administrative expenses were significantly impacted by $9.3 million in costs related to the Cyber Incident.
• Net cash provided by operating activities decreased by $43.6 million to $159.2 million, primarily due to increased payments in excess of cash received from customers.
• Cash and cash equivalents decreased by $144.5 million, largely due to substantial share repurchases.

Risks

• Cyber Incident Impact: A security incident disclosed on October 15, 2025, involved a threat actor maintaining long-term access and exfiltrating files, leading to $17.5 million in costs in Q1 2026, governmental inquiries, and potential claims from customers and third parties.
• Legal Proceedings: Ongoing litigation, including a remanded copyright claim related to NGINX software and a new putative class action alleging false/misleading statements regarding cybersecurity capabilities, could result in costly litigation and/or substantial settlement charges.
• Macroeconomic Conditions: Uncertain economic conditions, including inflation, tariffs, global supply chain shortages, higher interest rates, slower growth, and foreign exchange rate fluctuations, may adversely affect results of operations and financial performance.
• Software Revenue Decline: A decrease in perpetual software sales contributed to an 8.1% decline in overall software revenue, indicating a potential shift in customer preference or competitive pressures in this segment.

Future Outlook

The company anticipates that its current cash, cash equivalents, and investment balances, along with anticipated cash flows from operations, will be sufficient to meet its liquidity needs. It will continue to evaluate possible strategic acquisitions or investments. The company is evaluating the impact of new accounting pronouncements (ASU 2023-09, ASU 2024-03, ASU 2025-06) on its future disclosures and financial statements.

Management Comments

• "Our financial condition remains strong with significant cash and investments."
• "The decrease in cash and investments for the first three months of fiscal year 2026 was primarily due to cash used to repurchase outstanding common stock under our stock repurchase program, including excise taxes, of $301.1 million, partially offset by cash provided by operating activities of $159.2 million."
• "Going forward, we believe the primary driver of cash flows will continue to be net income from operations."
• "We will continue to evaluate possible acquisitions of, or investments in businesses, products, or technologies that we believe are strategic, which may require the use of cash."
• "Deferred revenues continued to increase in the first quarter of fiscal year 2026 primarily due to an increase in initial and renewal maintenance contracts related to strong systems shipments and our existing product installation base, respectively."
• "Management believes that the Company has meritorious defenses to the allegations made in its pending cases and intends to vigorously defend these claims and lawsuits."

Industry Context

StockSavvy.ai notes that F5's strong growth in systems revenue, particularly a 36.7% increase, suggests robust demand for its core hardware-based application delivery and security solutions, potentially benefiting from enterprises upgrading infrastructure or expanding on-premises capabilities. The decline in perpetual software sales, however, could indicate a broader industry shift towards subscription-based models or increased competition in the software-defined networking and security space. The acquisition of CalypsoAI aligns with the growing industry focus on AI security, a critical area as enterprises increasingly adopt generative AI, positioning F5 to address emerging threat vectors. The significant costs incurred due to the cyber incident highlight the escalating and pervasive cybersecurity risks faced by technology companies, underscoring the importance of resilient security postures in the current threat landscape.

Legal Proceedings

• Lynwood Investment CY Limited v. F5 Networks et al.: A copyright claim related to NGINX software, partially remanded to the District Court for further proceedings focusing on NGINX Plus code. The company intends to vigorously defend.
• Smith v. F5, Inc., et al.: A putative class action complaint filed on December 19, 2025, alleging false or misleading statements regarding the company's cybersecurity capabilities (related to the Cyber Incident). The company intends to vigorously defend.
• Cyber Incident: The company is cooperating with governmental inquiries and may face claims from customers and third parties related to the October 15, 2025 security incident.

Stakeholder Impact

• Shareholders: Impacted by the $301.1 million in common stock repurchases, which can reduce share count and potentially boost EPS. Also affected by the cyber incident costs and legal proceedings, which could impact future profitability and share price.
• Customers: Potentially impacted by the cyber incident, which involved exfiltrated files and could lead to claims. The acquisition of CalypsoAI aims to enhance security solutions for customers.
• Employees: Affected by restructuring plans in fiscal 2025, which included reductions in force. Management's adoption of Rule 10b5-1 trading plans indicates planned stock sales by executives.
• Governmental Authorities: Engaged in inquiries regarding the cyber incident, requiring company cooperation.

Next Steps

• Finalize the allocation of the CalypsoAI purchase price within one year from the acquisition date (September 26, 2025).
• Continue vigorously defending the Lynwood Investment CY Limited v. F5 Networks et al. litigation, with discovery focused on NGINX Plus code.
• Vigorously defend the Smith v. F5, Inc., et al. putative class action complaint.
• Cooperate and provide information in connection with governmental inquiries related to the Cyber Incident.
• Recognize future legal and professional services expenses associated with the Cyber Incident as incurred, with potential recovery under insurance policies.
• Evaluate the impact of new accounting pronouncements (ASU 2023-09, ASU 2024-03, ASU 2025-06) on future disclosures and consolidated financial statements.
• Continue to evaluate possible acquisitions of, or investments in businesses, products, or technologies.

Key Dates

Recommendation

F5 demonstrates solid overall revenue and net income growth, driven by strong demand for its systems products. The strategic acquisition of CalypsoAI also positions the company well in the critical AI security market. However, the significant decline in software revenue, particularly perpetual licenses, signals a potential challenge in a key growth area. More importantly, the ongoing cyber incident, its substantial financial costs, and the new class-action lawsuit introduce considerable uncertainty and potential future liabilities. While the core business shows resilience, these headwinds warrant a cautious approach. A "hold" recommendation allows investors to monitor the resolution of the cyber incident and its legal ramifications, as well as the company's ability to re-accelerate software growth, before making further investment decisions.

Keywords

Application delivery, Security solutions, AI security, Cybersecurity, Software, Hardware, SaaS, Cloud, Networking, SEC filing, Financial results, Earnings, Q1 2026, F5 Inc., FFIV, NGINX, CalypsoAI, Share repurchase