Incident disclosureDisclosed 2025-10-15F5, Inc.SEC filing

F5, Inc. discloses a cybersecurity incident with data taken without authorization (SEC 8-K, October 2025)

On August 9, 2025, F5, Inc. (the “Company”, “F5”, “we”, or “our”) learned that a highly sophisticated nation-state threat actor had gained unauthorized access to certain Company systems.

What happened

  • The Company promptly activated its incident response processes, and has taken extensive actions to contain the threat actor.Form 8-K Item 1.05, F5, Inc., filed 2025-10-15
  • The Company believes its containment actions have been successful and, since the initiation of its containment efforts, has not observed any evidence of new unauthorized activity.Form 8-K Item 1.05, F5, Inc., filed 2025-10-15
  • During the course of its investigation, the Company determined that the threat actor maintained long-term, persistent access to certain F5 systems, including the BIG-IP product development environment and engineering knowledge management platform.Form 8-K Item 1.05, F5, Inc., filed 2025-10-15

The failure pattern

Known vulnerability left unremediatedA patch or fix exists, but the vulnerable component keeps running because nobody knew it was there or owned the fix.How to prevent it Audit trail missing actor, target or decisionAfter something goes wrong nobody can tell who or what took the action, on which object, or why.How to prevent it
Watch the pattern: Known vulnerability left unremediated

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern