Skip to main content
People working in an Network Operations Center
Cyber Resilience

From risk to readiness: Lessons from the F5 incident

The October 2025 F5 security breach revealed a critical truth: no organization is immune to advanced cyber threats. A nation-state actor infiltrated F5’s internal development systems, stealing sensitive source code and vulnerability research—shifting risk from visible flaws to long-tail threats that may persist for years.

Key lessons:

  • Reactive security isn’t enough. Source code exposure enables attackers to craft zero-day exploits and uncover hidden backdoors.
  • Outdated systems amplify risk. End-of-support hardware and software may never receive future patches.
  • Source code breaches strike at the foundation of security. Patching and upgrading are essential, but they are insufficient on their own.
04 steps to
respond to a breach
01
Protect
Secure what you have immediately
02
Analyze
Understand the scope and impact
03
Defend
Strengthen your security posture
04
Build
Modernize for long-term resilience

Resources

Diverse young designers working online with an office laptop - 16x9

A Kyndryl guide to modernization and enhanced security

Navigating F5 end-of-life and today’s evolving security threats doesn’t have to be overwhelming. Kyndryl brings deep expertise in network security and mission-critical infrastructure to help you move beyond hardware replacement—building a resilient, secure foundation for your critical applications.

Man using computer in office

When the foundation is breached: Lessons from the F5 incident

The F5 breach shows risk isn’t always downtime—it hides in code. Modernization isn’t a cost; it’s security. Discover why proactive resilience is crucial for maintaining trusted and adaptable digital systems.
 

Your most common questions

No. While applying vendor patches is essential, source code exposure means attackers may have discovered hidden flaws or created backdoors that remain undetected even after patching. A comprehensive security assessment and modernization strategy are critical to reduce long-tail risks.

The timing coincides with many F5 appliances reaching End-of-Life (EoL) or End-of-Support (EoS). These systems can no longer receive updates or patches, making them highly vulnerable. Combined with leaked source code, this creates a high-risk environment for organizations still running legacy F5 hardware or software.

The breach introduces long-term, systemic risk because attackers now understand the inner workings of F5 products. This knowledge can be weaponized to bypass traditional defenses, making legacy configurations and outdated systems especially vulnerable.

End-of-Life devices no longer receive security patches or vendor support. Combined with leaked source code, these systems represent a critical exposure point. Immediate modernization or migration is strongly recommended.

Take the next step

Talk to an expert to take the next step on your digital transformation journey.