At a college football ticket sale described by Paciolan, 250,000 people tried to buy 50,000 tickets. Consider the arithmetic. Four out of five hopeful buyers could leave disappointed even if every computer worked perfectly. But if the computers stopped working, everyone would leave angry. Somewhere between those two outcomes sits F5.
- F5 manages and protects the traffic reaching applications.
- Its advantage is serving companies that run old systems and new clouds together.
- AI brings another traffic problem; F5’s own breach brings a test of trust.
Paciolan uses F5’s BIG-IP Local Traffic Manager to protect backend servers during surges and direct buyers into virtual waiting rooms. The example is useful because it strips infrastructure of its mystique. You cannot manufacture extra seats with a load balancer. You can stop the queue from knocking over the box office.
The queue is part of the product
F5 occupies a peculiar corner of technology: its work often becomes visible through its absence. A bank’s app hangs. A checkout stalls. A legitimate customer gets mistaken for a bot. The screen takes the blame, although the trouble may lie in how a request reached the application.
A load balancer distributes requests among servers. Health checks help avoid an unhealthy destination. Security controls inspect traffic and apply rules before it reaches something valuable. These functions overlap at an unusually useful location: the application’s front door. F5 combines them, selling availability and protection to the teams responsible for keeping that door open.
One decision point, many destinations. Actual deployments vary.
The cloud arrived. The old machines stayed.
Co-founded in 1996 by Jeff Hussey and Mike Almquist, F5 released its first BIG/ip Controller in 1997. The underlying question was wonderfully concrete: which server should take the next request? The question survived. The places where servers live multiplied.
For an enterprise, moving to the cloud rarely resembles changing apartments. It resembles renovating a railway while trains continue running. Paciolan, for example, describes using virtual BIG-IP deployments for cloud applications while keeping on-premises systems for workloads still there. F5’s opportunity lives in that overlap.
Today, BIG-IP supplies delivery and security services in hardware and software. NGINX brings web serving, reverse proxying, and application delivery into developer workflows. Distributed Cloud Services adds SaaS security and multicloud networking. F5 groups these capabilities under its Application Delivery and Security Platform. The names matter less than the different operational worlds they reach.
The buyers include banks, healthcare organizations, retailers, governments, and service providers. F5 says more than 80% of the Fortune Global 500 rely on it. That is a company-reported measure of reach, rather than proof that every customer uses the same product. The shared problem is less glamorous than a new app launch: keeping a complicated estate working while somebody changes it.
The $670 million bridge
In 2019, F5 announced its purchase of NGINX at an enterprise value of approximately $670 million. Its stated reasoning was explicit: connect network operations and development teams while accelerating its software and multicloud transformation. A company associated with appliances was buying a place in software developers’ daily work.
Other purchases filled different gaps. Shape Security added defenses against automated attacks in a deal announced at approximately $1 billion. Volterra added distributed cloud technology; announced terms combined roughly $440 million in cash with $60 million in deferred consideration and assumed incentives. Those are acquisition terms, rather than a customer’s implementation budget.
The resulting market position spans several competitive neighborhoods. NetScaler and A10 overlap in application delivery. Akamai and Cloudflare overlap in application security and edge services. Cloud providers offer their own controls. F5’s case is strongest when a customer needs consistency across environments, has existing F5 expertise, or must support applications that cannot move together.
The relationship is bigger than the box
F5 reported approximately $3.09 billion in fiscal 2025 revenue. Global services contributed $1.58 billion, ahead of either software or systems. That mix tells you something about the purchase. An enterprise is buying an operating relationship: maintenance, support, and expertise around infrastructure it cannot casually switch off.
Rounded company-reported figures. Services accounted for about 51% of the total.
The commercial menu includes hardware, subscriptions, perpetual software licenses, and consumption-based services. A useful buying exercise therefore includes capacity, support, staff time, and migration effort. For a modest application in one cloud, native services or a simpler software setup may be enough. Breadth becomes valuable when complexity makes separate controls expensive to operate.
Inside the company, F5 describes a human-first culture, with mentoring and a Volunteer Sprint that gives employees two paid weeks to work with nonprofit partners. These are published commitments. As with any enterprise supplier, customers ultimately judge the organization through the people who help configure, troubleshoot, and maintain its products.
Then the guard needed guarding
In October 2025, F5 disclosed a nation-state intrusion affecting internal systems, including its BIG-IP development environment. A security supplier is also a target. For customers, that fact makes supplier access, engineering systems, and incident communication part of the buying decision.
“Our controls were uneven - strong in some places and not in others.”
Christopher Burger, F5 CISO · October 2025
F5 described steps to strengthen its environment and urged customers to update software and keep management interfaces off the public internet. The transferable lesson is specific: protect the administrative path as carefully as the application path. A firewall purchase does not relieve anyone of patching, segmentation, or scrutiny of the vendor itself.
There is a second limit worth remembering. Routing can redirect requests around a failed server, but an application bug shared by every server remains an application bug. Delivery controls buy room to operate; they require working destinations.
The next queue leads to an AI model
September 2025’s CalypsoAI acquisition brought another destination into view. F5 introduced AI Guardrails and AI Red Team, addressing runtime protection and adversarial testing. In October 2026, Telenor AI Factory selected BIG-IP Next for Kubernetes for traffic, isolation, telemetry, and policy on NVIDIA-powered sovereign AI infrastructure. The request still needs a route; now its destination may generate an answer.
The practical idea to copy is older than AI: draw the request’s journey before adding another tool. Identify where capacity runs out, where policy applies, and what happens when a destination fails. Test those assumptions. F5 can help manage the crowd. The operator still has to decide what a fair, safe, working queue looks like.