Good afternoon, everybody. Thank you so much for being with us. We really appreciate it. I'm Suzanne DuLong. I lead investor relations at F5. We are really glad to have you here today. We've got a great agenda for you. I'm going to start with just a little bit of housekeeping. Of course, before we get started, I need to remind everybody that today's event is being recorded and will be available for replay on our IR website. The webcast replay and the slides will be posted after the event concludes today. I'll also note that today's discussion will contain forward-looking statements, which will include words such as believe, anticipate, expect, and target. These forward-looking statements involve uncertainties and risks that may cause our actual results to differ materially from those expressed or implied by these statements. We have summarized risk factors in our recent SEC filings.
In addition, we'll reference non-GAAP metrics during today's discussion. Please see our full GAAP to non-GAAP reconciliation in the appendix of the slides. Please note that F5 has no duty to update any information presented today. With all that said, let me share with you a quick overview of our agenda and timing. François will kick us off with some perspective on secular trends and the strategic actions we're taking to capitalize on them. Chad Whalen, John Maddison, and Kunal will dive a bit deeper into the actions we're taking to capitalize on those trends. We'll take a 15-minute break around 2:10. Those of you in the room will find refreshments in the area where we entered.
From there, we'll resume at about 2:30 when Lisa Citron, our SVP of Global Partner Ecosystem, will sit down for a fireside chat with a very special guest, Chris Konrad, who's VP of Global Cyber from WWT. Tom will then discuss our services growth and product adoption, and Cooper will discuss how we're driving sustainable revenue and earnings growth. We'll then hear some closing remarks from François before we open the floor to questions from our in-person attendees. Thank you again for being here. We're really excited to be here with you, and it's my pleasure to introduce our Chairman, President, and CEO, François Locoh-Donou.
Thank you so much, Suzanne. Well, welcome everyone. Welcome to those of you joining us here in the room and everyone joining us online. Thank you for being with us today. This is our first analyst and investor event since 2024, a lot has changed in the last two years. The world has changed, the world of IT has changed, of course, F5's opportunity has changed. Today, I'm really excited to be here with our entire executive team, we want to lay out for you how F5's opportunity is unfolding and how we intend to translate that opportunity into sustainable revenue and earnings growth. Let's talk about the trends that F5 is benefiting from. F5 is benefiting from both cyclical and secular tailwinds in our business, I will start with the secular drivers.
We sit at the intersection of 3 secular mega trends that are reshaping IT infrastructure. While each of these trends is unfolding separately, each actually is bigger than the one, and has greater potential than the one that precedes it. I will start with hybrid multi-cloud adoption. Hybrid multi-cloud adoption has been accelerating for several years, and it's driving workloads to be distributed across multiple environments. It started several years ago as a practical way for enterprises to get the flexibility that they need in terms of where they deploy their applications. That more tactical start has now evolved to be a go-forward strategic architecture for most enterprises. Organizations now require the flexibility, the resiliency, and digital sovereignty everywhere they operate, and they are investing in hybrid multi-cloud accordingly.
In our own research at F5, we found that 90% of enterprises now operate applications in hybrid multi-cloud environments. On average, F5 customers operate their applications over 22 locations, multiple cloud regions, colocation facilities, multiple data center facilities. The result of hybrid multi-cloud deployment is complexity, and complexity drives demand for a platform that can simplify the complexity for delivery and security. That platform is the F5 Application Delivery and Security Platform, and we will touch on that today. Hybrid multi-cloud accelerates demand for an Application Delivery and Security Platform. The second very substantial trend that we're seeing is the expanding threat landscape, and it is accelerating demand for AI-powered best-in-class security. As AI models grow more capable, they are attacking applications and API with greater variation and greater scale than traditional defenses were built to handle.
Our customers recognize that things are changing, and they are acting. Our customers are expanding their application security deployments, and they are raising the bar for what good looks like. Just good enough, check-the-box security is really no longer viable for most of our customers. They need best-in-class security, and increasingly, that is AI-powered security. That puts F5 in a great position to solve that need and that demand. The third mega trend, of course, is AI inference, and that is accelerating demand for application security and application delivery. Organizations increasingly now are connecting their applications and APIs to AI models, and inference calls are becoming a regular part of how applications run. We've done research, again, at F5, that shows that 78% of organizations are actually operating inference themselves, meaning they own the workloads and they own delivery and security for these workloads.
On average, organizations today already have 7 generative AI models in production. As organizations standardize on the new architecture with models distributed across data center, the cloud, and the edge, demand for delivery infrastructure for these models is growing. The next shift, which is agentic AI, is already on the way. AI agents are moving into production, and enterprises are adapting their applications for agent infrastructure. That is driving more compute, more data delivery, and more security to protect inference. F5, in aggregate, is benefiting from the effect of all of these drivers. Now, we're not just riding these trends, we are using them to grow faster. We're building on our market leadership to capture growing demand in ADCs. We are unifying our product portfolio to drive platform adoption, and we are capturing new AI opportunities.
Today, you're going to hear about each of these from our speakers. You can see the combined effect to sustain that momentum going forward. To put our expectations in context, it helps to look at our track record because it demonstrates our ability to execute. Since our 2024 analyst event, we have driven strong performance and met or exceeded our commitments, including exceeding our mid-single-digit revenue growth target, delivering seven consecutive quarters of double-digit product revenue growth, expanding our operating margins and delivering double-digit CAGR on earnings per share. We're not seeing this in a static environment. The market around us is changing very quickly. Those shifts are widening the set of problems that our customers are dealing with, and it's expanding F5's opportunity. I highlighted earlier that we are at the intersection of these three secular mega trends.
I'm now going to double-click on each of these, and I'm going to explore how they are accelerating demand for F5 solutions. Let's start, of course, with hybrid multi-cloud adoption, which has been accelerating across the board. To talk about hybrid multi-cloud, I'm going to go back in time a little bit and give you a refresher on the origin story of ADCs. If you go back 30 years ago, apps were simple to access. Data went from a user to a data center and back. Typically, in a data center, it was on applications that were hosted on a single server. With the advent of the Internet, the number of users that could and would access an application remotely exploded. As a result, copies of apps were needed to deal with that demand.
Apps were no longer hosted on a single server, but copied across multiple servers. That, in turn, created a need for load balancing technology, which at its core, was routing application traffic between users and multiple servers so that the app would be always available, always fast, regardless of who accessed it from anywhere. F5 pioneered this category. We pioneered load balancers and then broadened their capabilities to become the application delivery controller, or ADC category, to solve those challenges, ensuring applications stayed fast, reliable, available, and secure as traffic scaled. A lot of things changed, and over time, both the type of users and where applications live have changed. The types of users have gone from not just humans, but APIs and bots and machine-to-machine communications and have continued to grow at very rapid pace.
What hasn't changed is that F5 sits in a uniquely valuable place in the flow of customer traffic, directly in front of the applications that matter most. We've capitalized on that position over time by expanding what an ADC delivers. It's no longer just load balancing and availability. The same control point is where our customers need to enforce policy to ensure that their operations are resilient and, of course, to protect applications. We have extended the ADC role into web application firewalls, DDoS protection, API security, bot security, DNS security, and are now allowing our customers to deliver and secure their applications consistently across any environment and at scale. ADCs, for the most part, have been deployed in data centers, in enterprise private data centers.
I want to go back and share with you a little bit the growth of data center capacity over the last 20 years, because it does have correlation with ADC demand. What I'm going to show you here, on the X-axis is time, and on the Y-axis is worldwide core enterprise data center capacity measured in gigawatts. I should note that this does not include hyperscaler infrastructure. This is all enterprise private data centers. In the decade between 2005 and 2015, Enterprises moved aggressively to deploy web-based application in production, and many enterprises also undertook their digital transformations. What that meant is that a lot of customer interactions moved online, a lot of business process moved online. As that happened, the demand for capacity in the data center grew quickly. More applications, more users, more traffic, higher availability expectations.
The result of all of that is that worldwide core data center capacity grew at a CAGR of 12% in that period. In that period, F5 grew at a rate of 21% CAGR on the decade. In the 2015 to 2023 time frame, the growth engine shifted. Enterprises embraced cloud-first strategies. Many embraced SaaS applications, which did not require necessarily additional infrastructure in their data centers. A lot of enterprises either built all their new applications in public cloud or moved a portion of their application portfolio into a public cloud off-premise. The data center did not go away, but the growth curve fundamentally changed. In fact, data center capacity between 2015 and 2023 grew at a compound annual growth rate of only 2% as more incremental demand was absorbed by the cloud. During this period, F5 grew roughly at a rate of 5%.
Now things are shifting again. There are three dynamics today that are accelerating hybrid multi-cloud deployments and driving reinvestment in private data centers. The first of these dynamics is cost and workload optimizations. Customers are getting more surgical about placing workloads where they run best economically and operationally. They are balancing cloud elasticity with predictable, lower cost, private infrastructure for steady state demand. That is why we have seen workload repatriation, and we have seen a rebalancing of application portfolios. The second is regulation and digital sovereignty. A lot of companies, for regulatory reasons, have to build true resilience, have to comply with requirements around how fast they must recover from a disruption that's happening globally and it's causing companies to deploy applications in hybrid multi-cloud environments where they can achieve that resilience.
Especially outside the U.S., digital sovereignty is accelerating, meaning more organizations need to have more autonomy over their data, over their technology stack, and over their operations. For a lot of companies, that means moving away from global cloud environment into either regional or local cloud alternatives or on-premise data centers. That is also causing reinvestment in data centers. Thirdly, data gravity and governance in AI. We're seeing a large number of companies wanting to keep their proprietary data on-premise, in many cases, repatriating data that was in public cloud on-premise because they want this data that has now become enormously valuable for their AI models. They want their data pipelines to be close to the infrastructure they trust. That's causing, again, a wave of investment in private infrastructure.
The result of these dynamics is that enterprises are reinvesting in private infrastructure as part of this hybrid multi-cloud strategy, data center capacity growth is re-accelerating. We expect data center capacity to grow at roughly 7% CAGR, that's a meaningful step up from where they have been in the last decade. As data center capacity grows, ADC demand accelerates with it. When you take it together, these forces are driving hybrid multi-cloud adoption and bringing private data centers back into the investment cycle. Let's go to the second mega trend, which is the expanding threat landscape, which is also accelerating demand for F5. Okay, the data on this slide clearly shows that the number of attack on IT asset continues to grow rapidly, growing more than 60% over the last three years from 180 million to 290 million attacks.
If you double click on that, what's most relevant for F5 is that the front lines of cyber defense are actually shifting to the application layer. It's not just that the attacks are increasing, it's where they're concentrating. Attackers are increasingly targeting the app and API layer, they're doing that because that's where the data is. That's where the business logic lives, and that's where digital experiences are delivered. That is where the value is, that has real implication for customers. It implies that traditional perimeter-oriented approaches aren't enough on their own. Security has to be enforced closer to the applications consistently across hybrid and multi-cloud environments and at the scale and speed that this new threat environment demands.
If you double click on these application layer attacks and you go into what specifically are the type of application layer attacks that we're seeing, what I'm showing you here is data from F5 Labs. F5 Labs is F5's security research and threat intelligence organization. We track and analyze cyber threats and attack trends. We publish reports and guidance, we share data-driven insights to help security teams improve their defenses. What we're seeing in that research is as organizations modernize, they're deploying more applications, more microservices, and far more APIs and integrations. This data is showing rapid growth in web application attacks, API abuse, bot activity, Layer 7 DDoS attacks. All of this is not a theoretical shift.
Our customers know that defending the business now means protecting the app layer, continuing that at scale with controls that can keep pace with both the volume and sophistication of attackers. Going further, I've talked about attacks on the application layer. I'm going to go into a specific type of application, which is AI models, because AI models themselves are a new threat surface and are expanding the Sorry, are a new attack surface and are expanding the attack surface. What you see here is the comprehensive AI Security Index, or CASI, which is a framework developed by F5 Labs to rate the vulnerability of AI models. What we're doing is our AI Red Team uses a swarm of autonomous agents to run more than 150,000 attacks against these models every month, including the latest tactics and techniques.
You look at the most secure or least vulnerable of these models here at the top, that has a 98% score. 98% may appear like a great score, but we are now in the realm of quadrillions of tokens that are flowing in and out of these models. 2% of a very large number is a large problem. In the specific case of the attacks we've run against these models in our own toolkit, 2% on 150,000 attacks, if 2% come through, that's 3,000 successful attacks against even the best-scoring model. That's just the model layer. Now, let's zoom in and look at the full attack surface. The total attack surface today on IT assets, if you will, is 20 billion. It includes endpoints, humans, of course, workloads that includes AI applications, AI models, and IoT devices.
That is about to explode, because it's clear that AI doesn't just change applications. It's going to change the scale of interaction on the Internet. AI agents will dramatically increase machine-to-machine activity, more automated attacks, more API calls, and more always-on workflows operating on behalf of users and businesses. The result of that is a step function increase in the attack surface. Our estimates suggest that agents will increase, of course, by more than 10x between now and 2035, but every one of those interactions becomes a potential point of exposure, an identity to validate, an authorization decision to enforce, a traffic to inspect. The implication of all of that is clear, that security now has to be built for a world of autonomous, high volume, API-driven traffic. We have to protect applications and APIs in line, at scale, and across every environment. Now, that wasn't enough.
There is also, in terms of the expanding threat surface, there is also the risk that quantum brings to the equation. Let me elaborate a little bit on why this is a risk and why it actually creates an opportunity for F5. A bit first on quantum. Classical computers generate bits, a series of zero and one, to encode data. Quantum computers use quantum bits or qubits. Qubit can represent a zero, a one, or a combination of both at the same time. When multiple qubits are linked together, a quantum system can evaluate many possibilities in parallel. The result of that is that certain classes of problems can be solved dramatically faster than with classical computing. That speed actually does matter because modern encryption is built on mathematical problems that are extremely hard for classical computers to solve.
An example of such a problem is breaking 2,048-bit encryption. With classical computers today, that would take 149 million years. With a quantum computer that is powerful enough and stable enough, that could take as little as eight hours. That is why the move to post-quantum cryptography is actually becoming very urgent. We at F5 believe that post-quantum cryptography is shaping up to be a meaningful infrastructure investment cycle, and we believe F5 is well-positioned to benefit as customers migrate. The driver for that is very straightforward. Quantum-related security risk is not hypothetical. It is starting to happen now. How it's happening is cybercriminals and nation-state actors are already capturing encrypted traffic, and they're storing it and betting that they will be able to decrypt it later when the right quantum computers reach the necessary scale.
That threat is what we call harvest now and decrypt later. Q-Day is the point at which a sufficiently powerful fault-tolerant quantum computer becomes available and can break widely used public key cryptography. The exact timing of that is uncertain. Estimates are ranging from as early as 2029 to sometime in the early 2030s. Generally, these estimates have been shifting and coming closer and closer, as folks doing research in quantum are making more and more breakthroughs. In response to the predictions around the coming advance of Q-Day, the National Institute of Standards and Technology, or NIST, has been standardizing post-quantum cryptography, and the industry is moving toward multi-year migration plans that phase out classical algorithms over time. 2025 is the time at which the NIST has declared that classical cryptography will be disallowed. Clearly, organizations are not going to wait for Q-Day.
They will start modernizing ahead of it because it affects compliance, it affects risk, and long-lived data. In our world at F5, in conversations with our customers, what we are already seeing is customers are starting to do planning, early testing, and roadmap work to move to the post-quantum world. The great news for F5 is that ADCs will be central to making that transition practical. PQC can introduce real overhead and handshake certificates, key management. Enterprises will not want to absorb all of that complexity into applications and impact the performance of applications. Customers will want to absorb that complexity at the infrastructure layer and not force every application team to re-architect. That plays to F5's strength, because we can help customers adopt PQC while maintaining performance, availability, and security across environments.
As a result, with PQC to accelerate demand for ADCs, and in particular, hardware ADCs to drive performance. Let's now go to the third mega-trend, which is AI inference. In just a few years, we have shifted from the build phase to the operate phase in AI, and AI traffic growth is now happening and happening quite exponentially. If you go before AI, network traffic growth was steady and pretty predictable, with conventional applications that are expected to grow at a 4% CAGR over the next decade. If you factor in AI-enhanced applications, they will grow at a much faster rate. We expect a 26% CAGR. That's because the network traffic becomes multiplicative with AI agents. AI-enhanced applications are either traditional or modern applications that interact or include AI components. It could be interacting with an agent, it could be interacting with an an AI model.
The traffic between the application and the model, the application and the agent increases overall application traffic. On top of that, we'll see net new AI apps that will start growing very rapidly. The result of all of this is two things. First, AI traffic is going to become the dominant traffic. We expect it will be more than half of the traffic by 2031, and AI traffic will become potentially more than 80% of the traffic within a decade. It will drive a significant increase in overall traffic, a 6x increase in the next decade. The result of that is demand for more infrastructure. That scale is going to show up quickly into demand for infrastructure, largely because agents will increasingly communicate with other agents, shifting interactions from one user and one assistant to many software actors coordinating in real time.
As AI gets embedded into more applications and workflows, inference becomes always on, creating this continuous, bursty, and unpredictable traffic. All of that accelerates demand for delivery and infrastructure in a few concrete ways. First, it means more infrastructure, because AI-driven traffic creates more connections to manage, more APIs to protect, and more services that have to stay available. Second, it demands more data delivery because there's going to be a lot of data that needs to move securely, efficiently, and at scale between data stores and AI models, or between data stores and AI applications. Third, inside of AI factories, it's going to create a need for more traffic management to solve the problems of GPU utilization, to improve the efficiency in these factories that are extraordinarily constrained. Last, it will create more demand for AI-native security.
AI-powered security that can protect AI models, AI applications against all these AI-native threats. All of these are new demands that are coming from this very, very rapid growth of AI traffic. I want to go into that a little more and share with you where specifically in the flow of traffic we see net new opportunities for F5. This here is where we are today. Today, where F5 already sits at the front door of our customers' most critical applications. We load balance and secure all the traffic, humans, APIs, bots, no matter where those applications run. But increasingly, as attackers use AI to find and exploit vulnerabilities faster than signatures and patches can keep up, our security is AI-powered.
You'll hear later today that, for example, our AI-powered WAF that released recently is rapidly gaining adoption amongst our customer base, and we expect our entire portfolio to be AI-powered within a very short timeframe. What I mean by AI-powered is we're using neural networks to inspect Layer 7 traffic and detect attacks at a level of accuracy that our competitors simply cannot match. That is what we are doing today in the flow of traditional and modern applications. With AI, new opportunities emerge. The first one is, this new insertion point is AI runtime security. The future of traffic is AI, as I've just shared, and that AI traffic has to be secure. Building on our Calypso acquisition, we secure AI traffic into the application and from the application to the AI model.
That is a place in infrastructure that we have not been at before, so it's a net new opportunity for F5. The second net new opportunity is data delivery. This is F5 helping data stores connect with AI application with the right efficiency, the right scale, and the right security. It's also helping move data between data stores and AI factories in training, again, with the speed that's needed, the scale, the throughput that's needed, and the right level of security. Again, that's a net new insertion point for F5 and a new opportunity. Lastly, AI factories themselves. As you know, AI factories convert energy into tokens, and they do so at scale. Today, these AI factories often run into low GPU utilization problems. As you may have seen, studies commonly cite 25%-50% utilization on GPUs.
F5 improves traffic efficiency and GPU utilization both across and within the AI factory, boosting token throughput, reducing time to first token, and lowering per-token cost. When customers use F5 to load balance traffic inside of an AI factory, we've seen token throughput increase by 30%-40%. Those are the net new opportunities in AI. If you step back and look at the overall picture for our customers, these dynamics are changing the way that our customers view and manage their IT infrastructure. They were already managing a complex set of challenges across multiple environments, but that complexity is magnified by the new dynamics. Most companies are managing today nine different AI models, which are running in different places, AI factories. In addition to that, you have AI traffic, as I showed earlier, that is growing exponentially. You have the threat of quantum.
These things are compounding the challenges that our customers have had, it creates the need for a platform that simplifies that complexity. F5's Application Delivery and Security Platform, or F5 ADSP, is uniquely positioned to address these new dynamics. We deliver and secure every app, every API, traditional, modern, or AI, anywhere with one unified platform across on-premises, multiple public cloud, and the edge. Our Application Delivery and Security Platform reduces the complexity our customers are facing, without compromising speed or scale. We are able to give customers centralized best-in-class security, industry-leading high-performance delivery, and consistent policy without having to stitch together multiple products. Let's now talk about our addressable market as a result of these dynamics.
When you look at these secular trends that are converging, you look at the actions we have taken to position F5 to capitalize on them, we see demand continuing to rise for both application delivery and security. Based on a combination of third-party analysis and our own research, our own bottoms-up analysis, we estimate that our TAM today is approximately $15 billion. We estimate that it will grow to $28 billion by 2030 if we exclude AI-related demand. That growth we expect to come from continued hybrid multi-cloud deployments, application modernization, API proliferation, and higher security requirements. If I include AI demand, our addressable market by 2030, we estimate to be $40 billion, driven by net new AI use cases that I'm going to double-click on now.
If you look at specifically the use cases in AI demand, we see that AI is already driving accelerated demand in our business, we see that demand across three distinct use cases, AI data delivery, AI runtime security, and AI factory load balancing. Kunal, a little later today, will go in more depth on each of these use cases when he discusses our AI opportunity. At this point in time, these direct AI use cases are contributing modestly to our overall revenue, what's important is the trajectory. We see clear potential for meaningful TAM expansion over time, we expect additional AI-driven use cases to emerge in areas where F5 is uniquely positioned to win, given our role in application delivery and security across hybrid and multi-cloud environments. These are the direct use cases.
Beyond those direct use cases, we see what may be an even larger opportunity. That opportunity is from indirect AI-driven demand. As customers expand capacity to support a rapid acceleration in workloads, and as AI capabilities get embedded into modern applications, AI is increasingly underpinning broader enterprise priorities. For F5, this is showing up in increased demand for application delivery and security, data center modernization, digital sovereignty, and infrastructure capacity expansion. Three direct use cases today, more new AI use cases emerging and coming, and indirect demand from AI already playing a significant role with F5. We believe that we are well-placed and we're taking actions to capitalize on these trends. Cooper will go and elaborate on our financial outlook in more detail in today's agenda. That said, I wanted to preview for you the key takeaways on our guidance.
We expect accelerating revenue growth and earnings expansion as a result of the mega trends we are exposed to and the actions we are taking to drive growth. First, we are guiding to upper single-digit revenue CAGR through 2029, and I'll note that we do not see upper single digits as a ceiling for our opportunity longer term. We aspire to drive the business to double-digit revenue growth beyond this horizon. We also continue to drive durable earnings growth and are guiding to double-digit non-GAAP EPS CAGR through 2029. I'll close with the four takeaways we'd like you to remember today, and our next presenters will take you through the actions that we are taking. Chad Whalen, our Chief Revenue Officer, will speak to what we are doing to build on our market leadership to capture growing demand for ADCs.
John Maddison, our Chief Marketing Officer, will speak to how we are unifying our portfolio capabilities and driving platform adoption. Kunal Anand, our Chief Product Officer, will speak to how we are capturing new AI opportunities. With that, I'm going to hand over to our Chief Revenue Officer, Chad Whalen. Thank you.
Thank you, François. It's a pleasure to be here today. Let me go ahead and get started on what's driving. Before we get going, let me just give you a little background on myself. I've been at F5 for the last eight years, driving our go-to-market and sales organizations. I can tell you, at this point in time, my teams on the go-to-market side have never been more excited than we are right now. Throughout the presentation, I'm going to give you some insights as to what's driving that excitement. Market dynamics are very favorable. In many ways, the market is coming to us, and I'll point to some of those. It's always helpful to ground ourselves before we get into a presentation on the customers and the markets that we serve.
When you look at this slide, it's a fantastic testament to the deep and trusted relationships we have across many industries and governments. The top 10 of 15, the top 10 of 10, whether it's financial services, automotive, what's going on in insurance, and the like. As a result of these fantastic relationships, we are a foundational partner to the largest enterprises and governments the world over. 85% of the Fortune 50 are partnered with F5. Over half and growing every day of the Fortune 1000 are partnered with F5. We have earned a tremendous privilege over the last 30 years of this partnership, which provides us immense access and the ability for brand leverage to drive portfolio scale. As François mentioned in reviewing the Application Delivery and Security Platform, I am going to take this opportunity to drive down and expand a little bit on the deployment modes.
The deployment modes, I want to provide some texture as to why this is so important. This was an explicit decision that we made many, many years ago about being a hybrid multi-cloud solutions provider. The whole premise of that was founded on our customer centricity. Giving them the ability to deploy where they wanted that was best fit for the application. That does not matter if it was cloud native, appliance, purpose-built hardware, software as a form factor, software as a service, or even DPUs. In fact, over the last two years, 1,900 customers have deployed in two or more modalities in the last two years. We have 1,600 customers leveraging our as a service platform today. So what does that mean? Those customers, what we are witnessing and observing, that have two or more modalities, grow at a rate much, much faster than customers that don't.
In fact, they are growing at 25%. So what is underpinning the growth that we are having? There is a couple of factors, both cyclical and structural. From a cyclical standpoint, there is no doubt we are experiencing fantastic demand dynamics in our Refresh Plus event that is going on as we speak. Okay. It's not just refreshing equipment, it's expanding that equipment, and they are doing so simultaneously. The three I want to punctuate and to give you guys some insight and context is the structural trends that are driving the demand. Okay. I will cover these in more detail. The first one is digital sovereignty. The next one I will cover is competitive displacement. Finally, I will talk about AI-driven demand. Going through digital sovereignty, it's a very different time.
Our customers are realizing they cannot meet the evolving government standards and regulations for both data and resiliency without having a hybrid multi-cloud architecture. That is really, really, really important. Okay. If you think about what is going on in EMEA, you have DORA and NIS2. Those are regulations that are in flight today and really come to life in 2027. It does not just end there. We have a very similar thing in APCJ. PDPA is in Singapore, similar thing in India. This is not a one-off. This is happening the world over. We have over 6,000 customers that are shaped between governments, BFSI, healthcare, and telecom that are bound by these regulations. That customer set makes up over $700 million of opportunity for us between calendar year 2027 and calendar year 2030. Let me give you some insight on a recent win.
We had a non-U.S. government customer doing a sovereign data center build-out that required AI data delivery, Francois talked about earlier, web application firewall, and API security. We were the only purpose-built solution they had available. Okay? Why? Hybrid multi-cloud. Many of our deployments are hybrid multi-cloud. Customers have to be able to have that flexibility. We have that with consistent services, unified security services. This means, it's a fantastic opportunity. Not only was the size of the win great, I have expansion with that entity, but also taking that entity to all the other ones that are tightly adjacent. Again, it was all driven by our architecture as a key differentiator from everybody else in the market. Let me talk about competitive displacement, because this is a very significant opportunity for F5. We are successfully displacing customers resulting from, A, our new products to market.
Our innovation velocity is phenomenal. Kunal's going to talk about that later today. The flexibility that we offer in our consumption models, and the choice that you get with how you want to deploy. All of those things are very different and unique. As a consequence of that, we're taking share from Citrix, we're taking share from Broadcom, and others. What you see here is we have identified 3,000 enterprising governments across the globe that we're actively targeting to expand our footprint and take share. This is creating an additional $600 million opportunity, again, from calendar year 2027 to calendar year 2030. Let me talk about a recent win that we just experienced in this space. A Fortune 50 customer in oil and gas was looking for a solution that required highly performant, also on-prem, as well as in the public cloud.
That is the exact use case for our architecture. This happened to be a multi-million dollar win for the company, we were chosen specifically because of our hybrid multi-cloud architecture with unified security services, both on-prem and in the public cloud, giving them architectural flexibility and licensing simplicity. Many of our competitive displacements are multimodal. They buy it both on-prem and in the public cloud. What's exciting about this win, lots of expansion. These customers are looking to consolidate, they're choosing us as they go through that consolidation. The next trend I'll talk about is AI data-driven or excuse me, AI-driven demand. Not surprisingly, this is the biggest trend. As infrastructure build-outs, they're driving a material uplift in what we see every day, whether it's going to be direct use cases or non-direct use cases.
We have around 15,000 customers that we believe are in the zone for these types of use cases, representing over a $1.3 billion opportunity, again, from calendar year 2027 to calendar year 2030. Let me talk about a customer win in this example. We had a Big Four professional services and accounting firm that was looking and required a highly performant AI data delivery solution to front-end their S3 storage tier. We secured that win not only because we had the most performant solution, but also because we had the technology integrations and partnerships with both NVIDIA and NetApp. Where we have reference architectures for both. In today's climate, partner ecosystem integrations are critical, we find ourselves working with many, many partners in the space.
What's in front of us is we are now foundational to their AI rollouts. As they continue to scale out their applications, we will benefit as a result. In summary, with these three structural trends, F5 is incredibly well-positioned to capitalize on this opportunity. Digital sovereignty and resiliency requirements are not going away. It's only intensifying the growing requirement for our customers that are looking for both data custody and resiliency to meet the requirements that are imposed upon them. Our competitors' customers are looking for alternatives. Those competitors that I mentioned, the innovation velocity has not been there. They're looking for that. They're looking for flexibility in how they deploy. They want to be able to have the opportunity to go on-prem, off-prem. They want to have licensing postures that scale with their business.
Lastly, we are in the critical control point for AI workloads as ADC use cases expand and continue with the AI rollout. Thank you so much. I'll now introduce John Maddison, our Chief Marketing Officer, to review driving platform adoption. Thank you.
Good one. Thank you, Chad. Okay. John Maddison, CMO. I've been at F5 18 months. Before that, I was 10 years at a rather large network security company. Before that, 10 years at an endpoint company. I do my 10-year stints in each of these companies. What I thought when I was at the network security company was, when AI comes, what's going to be most effective? It's going to be application security. F5 not only has application security, but it also has application delivery, the opportunity to create a converged platform just like SASE. Before I go and talk about how our customers are adopting ADSP, I thought I'd go through why we need a platform for ADSP. Three main reasons: application structure, the infrastructure itself, where the applications are, the attackers, threat landscape.
In 2015, there was a rather major change across all three of these. Applications themselves became more microservices. Today, it's called Kubernetes. Applications started to migrate towards the cloud. The attackers became more sophisticated. Advanced persistent threats, nation-state actors were now attacking. Fast-forward to today, all three of those are changing even faster. Applications becoming inference. I think we've talked about hybrid multi-cloud quite a bit. That is here to stay. Of course, now we're using AI technology to attack front-end models. Just imagine the social engineering using agentic. Extremely powerful. What that means is the complexity. Our networking gear now has to understand tokens, not just packets. The attack surface is becoming very dynamic and very large. This complexity means you've got a lot of vendors, because most enterprises don't give up on each of these pillars.
They still have three-tier applications, data centers, microservices. There's a survey done by Forrester last year, one of the questions inside there was, why do you want to drive towards a platform approach? You can see some of the top reasons there. Automation, ease of integration, ease of use. The reason is, to try and make different vendors work together is extremely hard. Getting 10 vendors is hard. Imagine when you've got 60 vendors, trying to make them work together. The industry enterprises are driving towards platforms, and they've already been doing that. You may recognize some of these acronyms here. In our industry, we like the acronyms. EPP, Endpoint Protection Platform. Basically, endpoint protection, workload protection. We even roll in SIEM and SOAR these days there.
Secure Access Service Edge, SD-WAN, SSE, CASB, Cloud Native Application Protection Platform, workload protection, posture management, and of course, identity access management. Single sign-on, multi-factor, privileged access management. Most enterprises are working towards deploying these platforms going forward. F5, believe, is another platform called ADSP, focused on application delivery and security. Basically taking ADC, WAF, and AI security and bringing it together. This platform It's a bit different from SASE and EPP and CNAPP and identity, and all those platforms are really focused on employees. ADSP is the gateway to enterprise customers. Francois talked about this, it is the front door to customers and to agents going forward, making it extremely important to enterprises. Let's look at ADSP in a bit more detail. One of the foundational components is the application delivery controller, sometimes called load balancing, traffic management.
That definition's expanded a bit to include gateways and ingress controllers. It also includes security, such as WAF, SSL termination, which I'll come back to, and optionally, Zero Trust. The second component of ADSP is the Web Application and API Protection. That includes WAF, that includes API, bot, and DDoS. WAF is usually a SaaS implementation because the CISO wanted a single control point where applications move to the cloud, move to the data, and into the edge. Optionally, in that service, you'll have CDN, DNS, and multi-cloud networking. Now, as Chad said, our SaaS, our WAAP customers now exceed 1,600 customers. More interestingly, 50% of those customers have four to six services. So bot, API, and WAF. This is a great cross-sell opportunity for F5. Also, 90% of those customers have WAF.
We believe WAF is the virtual patching capability required now that frontier models are discovering vulnerabilities. In fact, 200 of those customers have already implemented AI-powered WAF, and 80% of those customers have implemented blocking on WAF. Sometimes customers don't like doing that. It affects sometimes the customer experience, but they're so worried now they're implementing WAF in a blocking mode. Of course, the third component is AI security. Very fast-growing, AI governance, discovery, testing, guardrails, and observability. Bringing us full circle to the ADSP platform, making sure you can deliver customers, eventually agents, to any application, including AI apps. Being able to apply a full security stack, again, whether it be AI security, network security, WAF security, being able to sit in the data path, hardware, software, different control points, and managing it through XOps for the network ops people, SecOps, FinOps.
How are we building this platform? Well, we have three main product families, BIG-IP, which is hardware and virtual edition. We have our distributed cloud services, which is SaaS, and NGINX, which is mainly software. Our roadmaps are gradually bringing these platforms together into one ADSP platform. When you look inside each of these product families, they have different use cases. Some of them are very specific to those product families, like firewalling and BIG-IP, bot protection in XC, and some are common. Here's an example of a very important common application across everything, web application firewall or virtual patching. Our goal is to bring that service, that capability, wherever the application is, again, whether it's sitting behind hardware, software, or cloud. This is a graph of our three product families, by customer. This is actually our top 1,000 customers, I think.
You can see if you go back to 2018, everyone was one product family, which was hardware. Today, 70% of our customers, top 1,000, have two deployment modes. In fact, 26% already have three deployment modes. That means SaaS, hardware, software, and cloud. Here's a couple of examples. Here is a leading financial services customer. Again, they started with hardware. They actually added WAF capability to the hardware. Then east-west virtual capability in the data center, also added NGINX for cloud-native capabilities, and then they added a SaaS console across that. Three deployment modes, 16 use cases. Here is a global commercial bank, again, starting with hardware, but pretty quickly decided to put some of the security capabilities in WAF and SaaS. Most recently, they added F5 Insight to provide management across everything. That's five deployment modes and 30 different use cases. Oops.
Every enterprise is dealing with complexity. They're all driving towards a platform approach, and our market is ADSP. We're seeing great adoption of our platform as we go forward. We'll continue to push that, cross-sell, and give the customers that capability. Thank you for listening in. Next is Kunal Anand, our Chief Product Officer, who's going to do a deep dive on AI. Thank you. Thanks, Kunal.
Hello, everybody. As John mentioned, my name is Kunal, and I'm our Chief Product Officer. My team and I are responsible for product vision, product strategy, and product execution at F5. The last couple of years, we've seen so much change with respect to AI. I think it's pretty clear that AI is rewriting the operating manual of applications. It's really creating a new wave of opportunity for F5. We sit as a company at the center of users, apps, APIs, agents, models, data, and infrastructure. As AI moves from pilots to production, that control becomes even more valuable. Over the next 15 to 20 minutes, I'm going to walk you through these new opportunities. What I want to start with is why AI is changing both halves of our business. AI is simultaneously expanding our delivery and security services.
On the delivery side, inference is not a normal application workload. It's changing traffic patterns. We see more desire for increased utilization and, of course, brand-new insertion points in places like AI factories. On the security side, the operating model has flipped. Attackers are now able to find and exploit vulnerabilities faster. We see an expanding surface area thanks to things like agents and APIs, and there's a greater need now for runtime protection. AI is raising the value for every routing decision, every security choice, and every throughput metric in the network. This has always been F5's turf. One thing I want to do is reframe how to think about an AI workload. In the real world, AI is not just a model. It's a rich and layered ecosystem. You have users and agents which drive traffic via intent.
Apps and APIs hold business logic, but they perform things like routing, and they have to make decisions. Models and inference are where the intelligence lives, but they demand security and governance at scale. You have data that underpins all of it, providing rich context and, of course, driving a lot of infrastructure load. The model may be the brain, but the ecosystem is the body. AI needs delivery, security, and control working together to make it usable in real enterprises. From this ecosystem view, clear opportunities are emerging for F5. First is AI data delivery. Customers are using object storage for AI workloads, and they demand programmability and high performance. The second is AI runtime security. Attacks are getting faster, they're getting more complex, and as applications become more dynamic, protection has to also be adaptive and at the runtime. Third, AI factory load balancing.
This is the most nascent opportunity, but the economics are compelling. These three opportunities have one common theme. F5 sits where delivery and security converge. Let's dive into the first opportunity, which is AI data delivery. AI is requiring so much data, not just for training, but also inference workloads. Customers need a combination of performance and control to get data to the right place at the right time. This is where F5 has a natural role to play. As customers modernize their data platforms and standardize on object storage, F5 is able to provide intelligent, high-throughput capabilities in front of their data tier. We give customers three things that their storage controllers simply don't. First, programmability. That's really important because we can manage Layer 7 traffic intelligently while allowing customers to craft advanced controls. The second is hardware scale.
We absorb traffic patterns and scale that storage controllers were never designed to handle. Third, vendor neutrality. We sit across the entire S3 ecosystem. We don't lock customers into a specific vendor or a specific architecture. All of these allow customers to remove data friction, which enables all sorts of AI workloads and capabilities in their environment. I want to show you the performance lift our customers are seeing from all of this. Across the network, the lift ranges anywhere from 95% in low latency SD-WAN environments, to up to 300% in high latency edge, multi-cloud, and SD-WAN environments. That range that I just shared with you matters because data doesn't just live in one place. It can live on-prem, it can live in a private cloud, across public clouds, or at different edges. It's important to note the way that we've engineered our underlying solutions.
They have been built and designed to inspect, route, and secure all this complex S3 object storage traffic while being vendor neutral. It's a really important point. That is data delivery. I want to now turn to what's going on with AI runtime security. When it comes to security, our customers have to secure two things at once. The first are traditional applications. These applications are now exposed to AI-accelerated attacks. The second are AI apps themselves. These are the new workloads that are AI-enhanced. They may be invoking a model, they may have a model embedded within them. What's happening across both, however, is also a natural extension of F5's existing protection of apps and APIs. Before I get into the opportunity directly, I just want to take a second to touch on the changing security operating model.
In this era, I think it's pretty clear that speed is now favoring the attacker. It's also meaning that runtime protection is becoming a non-negotiable. Today, attackers can now find, they can now exploit vulnerabilities faster than ever before, and they can do it with better precision than a human team. What that implies is that fixed and static defenses no longer hold. They just don't work in this era. Customers need security that can inspect traffic, that can look for anomalies, that can adapt, learn from those signals, and enforce policies in real-time. Today, we're already seeing all of this play out in customer adoption. John talked about it just a few moments ago, but we recently introduced an AI-powered Web Application Firewall, and the customer uptake has been awesome. We've already onboarded more than 200 enterprise customers in our first 70 days.
It's important to note that this Web Application Firewall was built entirely in-house, architected, designed, trained, fine-tuned, all within the walls of F5. Eighty percent of our customers have this Web Application Firewall already in a blocking mode, meaning we're taking action, and we're stopping CVEs or critical exploits from being taken advantage of in production. We've also seen our detection accuracy increase to 98%, whilst our false positive rate has decreased to just 1%. Security leaders are practical. They only invest and take on technology and capabilities when it lowers risk and just fundamentally works in the real world. We're seeing that with this adoption. Over time, we're going to extend AI across the entire security portfolio. We're really excited about that. In addition to AppSec, we also secure the full AI life cycle. Our customers are valuing our end-to-end model for securing AI workloads.
With AI Red Team, we run tests using agents and all sorts of attack signatures that we've built up, generating 10,000 attack signatures every single month now. We're able to go and find weaknesses in AI models and applications. Those findings then go into a solution we call F5 AI Remediate. We take those findings and automatically build guardrails, automatically build defenses out of those findings. What that means is that we can quickly go from a vulnerability or weakness that's discovered to a protection very quickly in production. That's a big deal. Our operators no longer have to be security experts. They no longer have to be an AI expert to put a signature into production to stop these types of attacks. There's AI Guardrails. AI Guardrails can protect AI models and AI-enhanced applications at runtime. We offer centralized enforcement, observability, and governance.
At the bottom of this slide, you'll see an independent test that was conducted by SecureIQLab. We scored 98.4% overall with F5 AI Guardrails, while being 99.3% effective against direct prompt injection and 99% effective against sensitive data leakage. These are great stats. The customer adoption is strong, and we're really excited to help customers protect these AI workloads, especially as inference scales all over. That's AI runtime security. Let's now cover AI factory load balancing. This is the most nascent of the three opportunities. However, it's the one that affects the economics of inference the most. As AI shifts from training to inference, AI economics, or what we call tokenomics, will become even more significant. AI factories are really conversion systems. Power, GPUs, and prompts go in, tokens, outcomes, and business value come out. That conversion process can be measured. It's generally referred to as tokenomics.
You'll see a bunch of properties listed here, things like total tokens generated, time to first token, cost per token, end-to-end latency, and tokens per watt. The word that you see repeated the most in there is token, because the unit of value in AI infrastructure is the token. The control point that improves tokenomics is the one that becomes strategically important over time. We're building this brand-new control point at F5, and I want to share the numbers with you. We now have third-party testing and early design partners who confirm that F5 can deliver better tokenomics. The independent testing results you see behind me are impressive. 40% higher total throughput, 61% faster time to first token, 34% improvement in full inference response time. We're not just delivering these performance optimizations. For those who are familiar with F5, we're providing core delivery and security functionality.
In addition to that, we've also created brand-new capabilities for AI factories. Things like intent-based routing, semantic caching, and much more. Our goal is to bring the power of the Application Delivery and Security Platform to the AI factory. The platform we're building that on is BIG-IP for DPUs. BIG-IP for DPUs is our bet on what AI infrastructure will need in the future. It's early days, and the milestones show what we've done so far. Starting with getting into NVIDIA's reference architecture, bringing on early design partners and engaging in those early POCs, performing independent testing, and of course, releasing software. I want to be clear-eyed about this. This is a nascent opportunity for F5. DPU adoption, from everything that we've observed, is lagging behind inference build-outs. The Neoclouds stacks are also different. They're polyglot, and they're still forming.
We're only now beginning to see the shift from training workloads to inference workloads. However, as inference scales, tokenomics that we've been discussing will be decided in the data path. We at F5 are ready for this, and we are early. That covers AI factory load balancing. I'd love to just zoom out for a moment. What I want to do is dimension all of these opportunities, share how they contribute to the business, identify where the momentum is, and close with an overall reflection. AI isn't a single market for F5. It's different demand motions, different maturity curves, different monetization models, and different product entry points. AI data delivery is our most mature. It's sold to large enterprise, government, and telco customers. It's majority hardware on premises. Adoption is strong today. There's AI runtime security.
It's the same customer base, software licensing across cloud, edge, and on premises. Momentum is real and growing. AI factory load balancing, which as I've already described, as our most nascent. The targets there are sovereign AI factories and Neoclouds. It starts as hardware with a software licensing opportunity on DPUs over time. Of course, there's the fourth motion, what you see all the way to the far right of the slide. It's one that often gets overlooked, indirect AI demand. As AI-driven workloads grow, they actually drive more F5 into the surrounding infrastructure. That demand is real, and it's already showing up.
One example of that is, as organizations embrace agents, those agents are making more calls to APIs and existing applications, thus driving a greater demand to put F5 technology and capabilities in front of those applications, in front of those APIs, not just for delivery, but also for security. I want to share some customer wins that we're seeing across these. These examples should give you a sense of the momentum that we're seeing across these three direct opportunities. For AI data delivery, this is a healthcare services customer that's deployed F5 in their AI-driven voice response platform. It's a $2 million deal. The second is AI runtime security. A global financial services customer deployed F5 to secure enterprise-wide generative AI adoption with high-fidelity threat detection. That was a $4 million deal. AI factory load balancing.
An energy and chemicals customer is using F5 to improve AI inference, to improve latency, and to stop overall timeouts in their ecosystem. That was a $1 million deal. Across all of the opportunities, it's really important to mention that this is not just one buyer, it's not just one vertical, it's not just one deployment pattern. It's important to mention that because AI is creating demand across all these opportunities simultaneously, which brings me back to the core thesis. AI doesn't reduce the need for application delivery or security. It raises the stakes for both. More autonomous systems, more AI-driven traffic, more surfaces to secure, more decisions in the data layer. Earlier I said the model is the brain and the ecosystem is the body. F5 is what makes the body safe, reliable, and efficient.
We deliver and secure traffic for any app, any API, and any agent in any environment. That is the F5 thesis at the AI era. Thank you so much.
Thank you, Kunal. Thank you very much. We're going to take a quick 10-minute break. Why don't we come back at 2:35 P.M., please? Thank you everybody. We're going to get started again. I'm really happy to introduce Lisa Citron. She is F5's SVP of our global partner ecosystem. Please welcome Lisa.
As Sam said, I have the honor of leading our global partner team. What does that mean? It means that I work with our hyperscaler partners, our reseller and distributors, and our global system integrators. I have the opportunity to help develop these routes to market and to work with our biggest and best customers in the process. I'm thrilled to be here today with one of our most important partners, WWT, World Wide Technology. WWT works with us across some of our biggest verticals, including banking and financial services, government, and telecommunications. I'd like to introduce Chris Konrad from WWT to join me up here.
All right.
Welcome, Chris.
Great to be here.
It's great to have you here.
Yeah.
Why don't you give everyone a preview of what your role at WWT is?
Yeah, no, happy to do that. Maybe before I do that, I can honestly tell you, I think you and I have had this conversation in the past, I don't think there's a more urgent, a more consequential, and a more opportunistic time than we're living in right now. Candidly, there's no better partner to be doing this with than F5. Thank you for the opportunity to be here.
Yeah. Thank you.
I'm the vice president of our global cyber business at World Wide Technology. For those who don't know WWT, we're a 36-year-old company, about $20 billion in top-line revenue, about 15,000 employees. The lines of business that we're in are all about help our customers solve the most complex challenges they're in, whether it's in AI or cloud or infrastructure and cyber. I'm responsible for our cybersecurity business, which is the fastest-growing business at Worldwide. It's a $5 billion contributor today, I'm responsible for all the teams that make that engine run.
That's awesome. How do you see AI changing the way you're working with customers? How is that security view coming to light? How is it affecting-
Yeah
how you work with customers?
I always fall back to a quote from Jen Easterly, former director of the Cybersecurity and Infrastructure Security Agency or CISA, who's now the president of the RSA Conference. She had a quote a few years ago that said, "AI is the biggest innovation of our lifetime. It could also be the biggest weapon of our lifetime." Where we are today, how true that really feels. We have been in AI now for a long time. This isn't our first rodeo, over 10 years. Involved in AI of over 100 data scientists at WWT supporting our go-to-market strategy. We've been NVIDIA's top partner of the year for eight years in a row. As we build out these AI infrastructures for our customers, AI security at times has been an afterthought.
For the last couple of years, it was like we're just trying to have a seat at the table to talk about AI security. Candidly, it is the number one topic that our customers want to hear about today.
It's a board-level initiative. When you think about some of the frontier models that are now being released, you heard François talk about it, Kunal talk about it's changing everything. What we did is we developed a framework inside of WWT called ARMR. It's the AI Readiness Model for Operational Resilience. Essentially that helps guide, it's a framework to help guide our customers in securing AI from chip to cloud.
It's just a really easy way for our customers as they start to build their AI factories and thinking about how do I secure it.
When we're talking to CIOs and CTOs and Chief Information Security Officers, that's the first question they're asking us is, "Okay, is this factory that I'm buying secure? How do I know it's secure?" They need a framework to be able to manage that and watch it.
Yeah. That must be a huge relief to them to be able to look to you.
Yeah. For sure.
For that framework.
For sure.
Underneath the C-level are the IT teams.
Sure
Who actually have to do the work. What are you seeing in the biggest challenges that they're facing today?
What do you think those challenges look like in the next 12 months?
Well, the word I used at the beginning of this was consequential.
When I look at IT teams today and what they have to deal with, they're facing an existential threat. When you think about what some of these frontier models are capable of doing, whether it's Anthropic or whether it's OpenAI or others that are coming out.
It is making us rethink how we're doing security. I've been in cyber nearly three decades, and when I take a look at everything that I've learned and understood about cyber, that's all changed.
It changed overnight. How do you do vulnerability management? How do you do patch management? All the basic fundamentals that sometimes it's so hard to do, and our customers sometimes struggle with that because they don't want to break something within their environment. I like to think is, do you want to live in uncontrolled chaos or do you want to live in uncontrolled compromise? Just really helping our customers rethink. We have done over 150 customer briefings just in the last month alone.
Wow
where people want to know, how do I deal with this? Are we on the right track? What's the strategy? What's the plan? How do we make this work?
Yeah. I think that those teams are really in that same ship that you just talked about where.
Yeah
They have been grounded in working in one specific way.
Sure
Now they're being forced, right?
Sure. They're trapped.
The attack surface is just wider.
We talked.
More complex. Absolutely. ADC has long been an essential part of the stack.
Yeah.
Right? Working across Layer 4 through 7.
How do you see ADC playing a role in the AI stack?
We heard a lot about it already today. It's fascinating watching the evolution of the ADC managing application traffic. Today, it sits right in the middle of AI.
Whether it's AI prompting, AI response, you talk about inference traffic, vector queries. Now it just needs to be an agent-agent communications. When you think about it now needs to be AI aware. It needs to be model aware, GPU aware. The work we've done inside of our Advanced Technology Center to test in these types of complex environments is really where the value and impact of our partnership comes together so we can put these reference architectures in front of our customers very early on.
say, "This is how it works in these environments." Yeah, it is a control point for sure. You cannot build a modern network without thinking about that ADC.
Yeah. It's been great to see how customers have come to the ATC and your AI proving ground, looking at the data delivery use case.
Obviously the runtime security use case.
Sure. Hot topic.
the growing interest in the AI factory conversation-
that is early. When you think about F5 specifically-
how do you see us fitting into this next era of delivery and security?
You've been around three decades.
Yes, we have.
You think about just all the major shifts in how organizations are developing their networks. Think about your roots from networking and load balancing, then to modern applications into the cloud, now you're sitting in front of AI.
For me is that every major architectural shift, F5's been involved in that, you've adapted to that. I don't think you can build a modern network architecture without thinking where F5 is going to play in that. It is so consequential.
Yeah. No, it's great to hear, it's great to have your partnership.
Sure
on that. Shifting to the AI factory conversation.
This is an area that NVIDIA will talk about you as a top partner there.
Sure.
It is a key thing that I know is a growing piece of your business.
Massive, yeah.
As everyone heard, we have a great piece of technology that is
starting in that growth vector right now
For sure.
that'll make AI factories more efficient.
We're in this world of tokens.
How do you see this journey that customers are on, especially as they move from training to inference there?
Yeah. I'll go back to something I said a minute ago. Every CIO, CTO, CISO that we're talking to are wanting to understand the factors that they're buying from any of the vendors, is this thing secure or not? How do I know that's secure? Go back to the conversation around ARMR and how that works. I will also say tokenomics is a real thing.
You heard Kunal talk about it just a few minutes ago. We host customer advisory board meetings, and the top two or three topics that they're talking about is tokenomics. They want to get a real-life total cost of ownership of how this is being applied. When you think about this from an AI security world, is you don't want to have an inference challenge in an incident.
We have to make sure we square that away. When I think of F5 in this particular category, candidly, you are the toll booth for tokens.
Yeah. That front door, right?
Yeah, you are that front door, and you're going to continue to be. It makes a major difference when it gets architected and done the right way up front.
Yeah. That's what we're seeing from those conversations with customers, looking for that, not only the security, but how do they drive the efficiency in the usage of that tremendous infrastructure.
Sure
They just invested in. Wrapping it up, I'll go to something that's near and dear to my heart. Which is, what are the factors that you see or believe that makes F5 a good partner to work with?
I think in any good relationship, it all starts with trust.
We have a longstanding partnership, and we trust each other. We have trust at the executive leadership level and all the way down into the field.
It has to start right there. The other thing that we can do, and it's part of our culture and our core values that we both share, is to be able to have difficult conversations.
Yeah.
There are some challenges we may have in the field. You and I and others, we can have that conversation. That is just so fundamental. Not everybody has that.
Yeah.
The other part that I hold near and dear to my heart is that you listen. When we talk about product design or what's working in the field, what do you see? What's not working? What do you think about what products work well from an integration standpoint? We live in a multi-OEM world.
Our customers have two and three of everything. How do we work together in this system? That's what I really value. Not everybody does that as well as what F5 does. I appreciate that.
No. We appreciate WWT, and I certainly appreciate you being here with us today.
My pleasure.
The longtime partnership we have. Thank you so much.
All right. Thanks.
Yeah. I'd like to hand off to Tom Fountain, our Chief Operating Officer, and he's going to talk about delivering services. Thank you, Tom.
Thank you, Lisa, and particular thanks to Chris for sharing a little bit about F5's role in this emerging AI stack. I'm Tom Fountain. I'm Chief Operating Officer at F5. I've been with the company for eight years now. I think when I look back, I am perhaps most pleased at the foresight we had around the role of hybrid and multi-cloud. I'm especially gratified to see the momentum and even acceleration that we're now seeing in our business as a result of the strategy we laid out a few years ago, and our very deliberate execution against it. I wanted to share with you today a little bit about the services business. F5's services business really complements our product portfolio with services that allow us to both monetize our offerings, and promote adoption and consumption of our solutions.
This creates a virtuous cycle that I think is a pretty key part to our differentiation. We support the Application Delivery and Security Platform through a comprehensive portfolio of value-add services. These services represent approximately half of F5's total revenue. The world-class service offerings that we deliver span three broad capabilities. First is around support services. This provides around-the-clock access to engineering experts who support our broad customer base in addressing over 170,000 customer cases a year. These engineering professionals assist customers not only in their moments of greatest need, but they also create a lot of new knowledge that increasingly feeds our AI technologies. Support services also includes F5's security incident response team. This provides customers immediate access to an elite team of cybersecurity professionals that help customers use our solutions in responding to cyber crises.
Second, with the rapid growth of our software and SaaS subscription business offerings, we've aggressively built the new customer success capability. These professionals work closely with customers throughout their ownership journey to get the most from the F5 products. Finally, professional services executes 1,300-plus customer engagements annually to provide full-time designated and dedicated engineers in customer environments, execute against defined SOWs that architect, implement, and operate F5 products on behalf of our customers, and train customers on the use of all of these solutions. These services are really purpose-built for customers operating the most demanding IT environments. That's across enterprise, government, and service provider. We serve over 80% of the Fortune 500 and are trusted by all of the top 10 companies in each of the verticals across banking, retail, automotive, and insurance.
The services that we deliver are mission-critical to organizations that are themselves often delivering essential services. From early engagements of architecting our customers' environments to services designed to ensure customers get the most from our solutions, services is a critical part to every phase of the customer's ownership journey. Chad, John, and Kunal each spoke about the actions we're taking to further accelerate our growth. Services addresses a vital need in each of these areas that they described by providing white glove, human-led assistance. We construct and tune service offerings to complement each of these growth levers, including ensuring availability and trust of mission-critical workloads, supporting our commercial offerings through adoption and expansion motions, and providing domain experts who work side by side with our customers. Let me offer one specific example to illustrate the value of services.
We launched our Distributed Cloud SaaS platform in 2022, and that first full year after launch, customers needed an average of 92 days from the start of their subscription to the time they first passed traffic on Distributed Cloud. Over the course of the last several years, we've systematically improved our onboarding instructions, developed detailed playbooks across different technologies and use cases, expanded our global team of onboarding engineers, and built out our managed services offerings for customers seeking to outsource operations entirely. We have focused on helping customers achieve their business objectives and rapidly extract value from Distributed Cloud. As a result, customers today complete initial adoption in an average of only 21 days. This means customers benefit from our solutions faster. It also, in turn, means that we increase our renewal rates and improve opportunities for expansion.
This is but one example of the type of motion we develop with services to accelerate product revenue. We've embedded this approach to driving both services revenue and product usage into our operational playbook. Our services measures include ensuring a high initial attach rate and then maintaining high renewal rates leading to long service duration. In addition, because of the strong symbiotic relationship between product and services, we've also built operational rigor around adoption measures focused on initial onboarding and usage of products throughout the subscription life, and expansion measures that focus on motions to promote consumption beyond the initial contracted value. I'll highlight an example measure in each of these areas. First, our initial attach rate has remained steady in the high 90%. This shows customers see value in our services portfolio. Second, our services obligation average age is steady at approximately 4.5 years.
This average age demonstrates the durable nature of the services revenue streams. We also see healthy operational results from our product-oriented measures. I spoke just a moment ago about the improvements to initial adoption for Distributed Cloud. Over the course of the last several years, we also improved adoption of our multi-year subscriptions. Here we show the average time to reach 80% utilization on these multi-year contracts. In our 2020 investor event, I celebrated progress in reducing the time to full utilization from 22 months down to seven months. Through continued focus, we improved that further to five months in FY 2023 and reduced it now to only three months in FY 2025. Again, customers realize value from these contract vehicles faster and establish a foundation for future expansion. And as a consequence, we've also seen robust expansion for these multi-year contracts at a 25%-26%, annual level.
Services delivers impactful results to both services operating segments and product usage. To enable these results, we've been on a journey for the last several years to digitally transform services. Leveraging technology improves customer experience and expands margins. For example, in customer support over the last few years, we deployed a new case management system and focused heavily on knowledge management to build a proprietary data set that makes our employees and customers more productive. In customer success, we focused on automation. We introduced low-touch and digital-touch customer success motions to extend our reach to even more customers. Both of these are examples where digital transformation improved the business. But finally, and most importantly though, we've also been aggressively building AI into our workflows.
We've built a process to identify candidate new use cases, conduct proof of concept testing, and then build and deploy new AI solutions in a consistent and repeatable manner. As of today, we've initiated over 70 AI projects and services across all stages, of which 23 of those projects have now graduated into production deployments. These production AI use cases have already had a significant impact on service delivery. I'll share a few examples in just a moment. Together, though, these digital transformation efforts allow us to improve the customer experience, focus more resources on earning customer trust as a strategic advisor, and deliver this value at lower cost. As I mentioned, our extensive use of AI, particularly generative AI, is already having a profound impact on the services we deliver. We benefit from using AI in many of the expected ways.
For example, our professional services engineers have seen a 53% reduction in time spent generating code. More significantly, though, we are embedding AI deeply into the individual workflows within services. Our internal AI-powered Case Hero solution helps support engineers resolve issues faster. Already, 85% of our cases benefit from AI. Certain AI capabilities are extended to end customers. Our MyF5 guided support, for example, increased case deflections on our website by 3x, reducing the overall case submission rate by 15 percentage points. In manufacturing, we're applying AI for visual verification on our assembly line. While AI could hallucinate, it doesn't blink. AI vision replaced human verification and improved our manufacturing test yield by 16%. What is perhaps most telling, though, is the positive impact these changes have on customers and how customers view F5.
Services has long been a differentiator for F5 relative to competitors. The actions we've taken over the last few years to digitally transform and improve service quality is paying off in the improvement of CSAT from an already strong 9.2 to an absolutely exceptional 9.6. We enjoy a strong virtuous cycle between product and services. Post initial sale, our white glove services provides a durable source of revenue and margin. Delighting customers through these white glove services ensures customers get the value they expect. In turn, customers grow their product usage of F5, which again unlocks even more service opportunities. Overall, we offer a comprehensive portfolio of services across the entire customer journey. Our deep expertise in app delivery and security differentiates F5.
We have delivered strong operating metrics, both traditional services measures such as initial attach and contract duration, and we are accelerating product sales through adoption and expansion. I will now hand it to Cooper Werner, our F5 CFO, to speak to our sustainable revenue and earnings growth.
Thank you, Tom. My name is Cooper Werner. As Tom said, I'm the CFO at F5. I've been in this role, this is my second year, but I've actually been with F5 for nearly 25 years, if you can believe that. It's been kind of fun just watching the presentations today. A little bit of a walk back in time with the history, because I've lived a lot of that history. I think what excites me most is what we're seeing with the velocity around innovation, the number of new use cases, the new products we're rolling out to market. In my time at F5, I've never seen this pace of innovation, and I think the timing is really good right now with where the market's going and the addressable opportunity we have in front of us.
Just a very exciting time to be at F5. I feel privileged to be in this role as CFO, and I'm privileged today to be able to share how we see this strategy manifesting in our financial results over the next few years. First, I just want to thank everybody for investing the time with us today to walk through our strategy. It's been great connecting with many of you over the past few years. I'm going to go ahead and get going, translating how these opportunities will translate into our financial model and drive accelerating revenue and growth over the next few years.
First, just to kind of ground the discussion, and we've kind of gone through this already, so I'll keep it high level, but I thought it would be helpful before we get into the financial results, just to kind of revisit the core building blocks behind our strategy, which really position us for an accelerating growth opportunity. We're already seeing this in our results. You see we're off to a very strong start to FY 2026. A lot of these drivers are already manifesting in the business. Really, the hybrid multi-cloud reality that customers are seeing today, that's the vision that we laid out years ago. We've been very intentional about building a portfolio and a business model to support this architecture. That set of choices has proven pivotal to the growth opportunity that now sits in front of us.
Our continued innovation over the years and our commercial model and deployment model flexibility that we've provided for customers has positioned us to capitalize on our leadership in ADCs, where we're seeing growing demand across new use cases and new insertion points. Customers are embracing the full breadth of our portfolio through the platform adoption opportunity that John walked us through earlier, and that's really driving continued strong expansion across our business. Then, of course, perhaps most exciting is the AI opportunity, which has already become a significant opportunity for us, and we're starting to see that impact show up in our revenue growth today, but we're really just kind of getting into this opportunity.
just to kind of set up the discussion of our outlook, I thought it would be helpful just to do a quick review of our financial execution over the past few years, I'll dive into the business model inflection that we see over the next few years. As we've discussed over the past few years, we committed to delivering double-digit earnings growth, we shared that we could deliver these results through a combination of mid-single-digit revenue growth and continued operating margin expansion. We've delivered 6% average revenue growth over this timeframe, the last 6 years, 2020 to 2025. Of course, this growth has been accelerating the past several quarters with a double-digit revenue growth outcome in FY 2025 and a continued strong start to the first half of FY 2026.
Over this time, we've been running this business with financial discipline. We've been driving healthy operating margin improvement and bringing our operating margins up from the 30% range in 2020 to our current 34%-35% range that we've guided to for FY 2026. This has all translated to a double-digit EPS growth rate over this timeframe, which remains the North Star of our financial model. Alongside our earnings results, we've also been very disciplined stewards of our balance sheet. We've generated very strong cash flow over the years, nearly $4 billion over the last 6 years, we've returned well over half of our cash generation to shareholders through a consistent share repurchase program. We've repurchased $2.5 billion of shares over the last 6 years, which is 63% of our free cash flow, well above the 50% threshold that we've committed to.
We've spent some time today walking through the markets that we address, our positioning with our portfolio, and our strategy to continue driving the innovation and simplicity that customers require to deliver and secure their apps and APIs. Now I want to talk about how this translates to a more exciting revenue growth opportunity moving forward. I'm going to start with our systems business. We're seeing today multiple tailwinds for our systems business as shifting dynamics in application architectures are driving new performance requirements for securing and delivering apps. First, we're seeing a very strong refresh plus cycle. In my time at F5, this is the strongest refresh cycle we've ever seen. We expect the strength of this refresh to extend well into FY 2027. We're also seeing capacity expansions tied to workload growth from AI-enabled applications.
François already walked us through how traffic growth has been accelerating, driven by AI. Kunal gave some more details as to how that translates to new needs for infrastructure build-out for customers, we're seeing that in the form of capacity expansions in addition to data sovereignty and resilience requirements. We're seeing new use cases, particularly around AI data delivery. Again, it's relatively early, but it's starting to contribute to meaningful results, we're seeing additional competitive takeouts. The velocity around competitive takeouts has been going up. The net of these tailwinds is our updated view that our systems business will sustainably grow in the mid-single-digit range over this timeframe. That's a material change from how we had laid out our outlook for systems business if you go back to the 2020-ish timeframe.
I wanted to dive in a little bit deeper as to some of the new growth signals that we are seeing that are underpinning that update to our outlook on the systems business. First, let's spend a little more time on the refresh plus motion. First, as customers are going through their refresh motion, we are looking at the replace rates. We think about the ratio of new appliances that customers install in their environment to replace legacy appliances that they are retiring from their environment. That ratio of replace to retire has been higher across this refresh. The second dynamic we are seeing is when they are making that replacement, the appliances that they are adding to replace legacy appliances, they are moving up the stack in terms of performance. That is driving a higher price point and higher ASPs. That is also driving growth within this refresh plus motion.
The other phenomenon that we are seeing, unlike in prior cycles, is that a lot of times customers, when they are going through this replacement motion, they are adding capacity at that time. Really what they are doing is they are trying to address this inflection in traffic that they are seeing and also plan in advance of additional anticipated growth with their traffic. All of these three elements are why we are seeing such a strong refresh cycle in this period. I will acknowledge that there is, of course, a cyclical element to any refresh motion as customers are going through this replacement of the legacy appliances. There is going to be periods from the refresh of exceptional growth, such as we are seeing today, and there will be periods where that growth is slower following on the back end of these refresh cycles.
It is the growth signals we are seeing during that refresh that we feel are most critical as we look out over longer periods of time and what this overall growth opportunity could be. Okay, that is the refresh. Let's talk about other sources of growth that we are seeing in the systems business. One is capacity expansion that is outside of that refresh. Not all customers at any point in time are going through a refresh, but they are still subject to the same demands to support growth that they are seeing in their applications, particularly driven by some of this AI-embedded capabilities in their apps. A lot of customers are continuing to add capacity, whether they are going through a refresh or not. We are also seeing digital sovereignty that we talked about, resilience. Those motions are starting to drive new capacity increases.
Further downstream, PQC, we expect to be a driver of additional capacity. The third project, I touched on it earlier, but inflection in new projects. Again, AI data delivery is driving a lot of new opportunity for F5, competitive takeouts. Chad Whalen talked a lot about the dynamics behind that, but we are seeing an acceleration in customers that are coming from other vendors in the space that are coming to F5, largely because of the commitment we have made to hybrid multi-cloud architectures. Okay, that was a look at systems. Now let's spend a little bit of time on software. Software has been the biggest growth category for F5 over the past few years, and we believe that it is going to be a consistent and sustainable double-digit growth category in our revenue stream going forward.
I'll break down the two key categories behind that growth, starting with our term subscription business. This is BIG-IP and NGINX delivered in the form of term subscriptions. We've talked a lot over the years about these multi-year agreements with this flexible consumption program that we designed for customers that's been so successful for F5. That's a category where we have really good visibility as to how customers are using our products. We have a view as to the growth that we would expect moving forward just based on their utilization rates. We've had very strong renewal rates, very consistent renewal rates, and we've had really good expansion over the course of the duration of these subscriptions. We've got really good visibility to this category that's been consistently growing at a strong double-digit rate.
We believe that we'll continue to see very strong double-digit growth from this category moving forward. The second category is our SaaS and managed services business. This is a category we've talked about over the last couple of years that we've been going through a bit of a transition with some legacy offerings that we've been retiring, and that served as a bit of a headwind to growth as that software revenue has come out of our business models. We've retired those offerings. We're complete with that transition. Going forward, it will be a headwind, or sorry, a tailwind to our growth because the underlying growth we're seeing from Distributed Cloud, which makes up the majority of this category, has been very strong, and we no longer are going to see a deprecation of revenue related to retired offerings.
The combination of growth from the term subscription business that's consistently been so strong and now a new growth opportunity within our SaaS and managed service business, in addition to some new use cases, particularly around AI runtime security and the continued expansion we're seeing across our platform. Those all position us to see very strong growth going forward from software. The last category I'm going to touch on with our revenue base is our services revenue. This makes up about half of our revenue today. Tom talked a lot about some of the underlying dynamics that we're seeing, but the two kind of data points that I'll point to that underpin our outlook for services revenue start with the very high attach rates and consistent attach rates we've had attaching services to our products that we sell into the marketplace.
This really reflects the value that customers place on our software support and our maintenance services. Then hand in hand with that, the installed base that we attach those services to is growing now that we're seeing services revenue move into a new growth trajectory. Over time, as that install base continues to grow and we continue to have very high attach rates, that should drive an inflection in our service revenue growth rate. Now, of course, services always has a bit of a lagging correlation to product revenue because product revenue is recognized upfront. You sell the services alongside the product revenue. That gets recognized over time. Today we're seeing a low single-digit growth rate from our services business.
With the continued strong growth we're seeing on product and the high attach rates of services, that's going to start to manifest in our service growth rates with an acceleration to mid-single digits over time. We've covered the revenue base and its components. Now I'm going to jump into our operating model, and I'm going to start with our gross margins. If you look back over time, you can see that we've been effective in driving our gross margins up from the FY 2023 to FY 2025 time frame. We've talked about some of the dynamics in the marketplace around cost and components that have really increased pretty dramatically, particularly for memory and SSDs. I talked about this on our last earnings call, and it's a pretty well-understood dynamic across the landscape. We did a really good job.
I should credit our manufacturing team for getting in front of some of the supply chain challenges that they saw coming. Going back to FY 2025, they saw some signals that this was going to start to become more of an issue across the industry, and they acted very aggressively in securing components, largely to make sure that we are meeting high ends of potential revenue opportunities across our systems business. Another consequence of acting early is that we secured a lot of components at lower cost points before prices really started to accelerate. As a result, we've been able to kind of navigate these cost pressures to date because we've been building in these lower cost components into our products that we've been shipping. We're now at that point where some of these higher costs are going to start flowing into the model.
I talked about that on the last earnings call, but we expect the initial impact to be really in Q4, and that'll persist through a lot of FY 2027. We do expect things to start to stabilize around cost later in the year in FY 2027. As a result, our gross margins will stabilize. Long term, we expect gross margins to rebound to historical levels. That's kind of the dynamic that we're looking at for FY 2027. Meanwhile, we maintain discipline driving efficiency across our cost base through internal use of AI to increase operational efficiency and increase sales efficiency from our land and expand motion. This enables us to reduce operating expenses as a percentage of revenue and fund innovation and go-to-market investments to secure long-term revenue growth opportunities.
As such, as gross margins stabilize and we continue driving productivity gains, our operating margins are expected to increase to the mid to upper 30s range over time. Now what I'm going to do is summarize how these trends translate into an updated overall financial outlook to deliver strong earnings on an improving revenue growth opportunity over time. I've walked through the components of our revenue opportunity, and I'm going to tie it together now with the overall revenue outlook. First, François already kind of flashed this, but we're guiding to a total revenue outlook of upper single-digit growth through FY 2029. While we're not guiding beyond FY 2029, we believe we're well-positioned to further accelerate our overall revenue growth rate in the long term beyond FY 2029.
This opportunity is created by the continued strong product revenue growth and the accelerating service revenue outlook over this period. Specifically, we expect product revenue to grow double digits throughout this time frame. We expect services growth rate to increase over time based on the strength of those product sales and accounting for the lagging correlation between service growth against product revenue due to the ratable revenue recognition with services revenue. This all equates to a strong revenue growth exit trajectory. We also see significant upside growth opportunities as AI use cases continue to mature and PQC readiness becomes forefront in our customers' planning activities. Turning to our operating model. In concert with the revenue growth acceleration I just discussed, we expect a short-term reduction to gross margins in FY 2027, followed by an improving outlook back to historical levels by FY 2029.
We continue to drive operational efficiency, enabling additional investments in the long-term growth opportunities, while at the same time reducing operating expense as a percent of revenue to the mid to upper 40s levels through FY 2029. The net result of our accelerated revenue growth and continued operating efficiency is a financial model that we expect to deliver improving operating margins at the mid to upper 30s levels by FY 2029 and sustainable double-digit EPS growth. Finally, we have a very strong balance sheet and cash position. We've demonstrated over the years a very disciplined approach in regards to capital allocation. Our strategy remains committed to identifying and capitalizing on growth opportunities through both organic and inorganic initiatives while rewarding our investors with a strong share purchase program.
Organic investments in product innovation and sales capacity and internal AI enablement enable us to continue this velocity that I talked about earlier with our roadmap. At the same time, we're also exploring inorganic opportunities, which largely would be focused around security and AI. We continue to expect to use at least 50% of our free cash flow for share purchases, which we've exceeded for each of the last four years. Of course, we're off to a pretty fast start in FY 2026. That concludes the overview of our financial model. I'd like to thank you all again for investing your time with us today. I'm going to hand it off to François for some closing remarks. Then we'll bring the rest of the presenters up in front to go through Q&A.
Thank you. All right. Thank you. Just before we move to Q&A, wanted to recap the takeaways of today. I shared with you that we are seeing a shift in the industry to hybrid multi-cloud architectures. This is a shift that we had anticipated several years ago. We had been talking about this shift as early as 2018, 2019, when conventional wisdom was that everything would just go into the public cloud. It's happening now. We are benefiting from this shift. We're capitalizing on these trends. We are building on our market leadership in ADCs, continuing to see growing demand in ADCs, but our incumbency, our market leadership, our differentiation relative to our competitors, is allowing us to gain share in ADC. Chad talked about that today and how we're making that happen in the marketplace. Beyond that, we are driving platform adoption.
We have multiple capabilities in delivery and security. We have converged these capabilities in delivery and security into a single platform. It is the one platform, the only platform, in the industry, in the world of delivery and security, that works across hardware, software, and software as a service, and gives customers the ability to consume our technology in CapEx or OpEx or subscription or consumption, in whichever model they want to consume. That flexibility is an incredible differentiator in the market, and it's complexity that we absorb in our business model to give simplicity to our customers, we are going to continue to be rewarded by that. AI is, of course, a very exciting new trend.
We already have a number of direct AI use cases that we're benefiting from, and we're also benefiting indirectly from general increase of traffic related to AI, which is growing demand for ADCs. With that, I'm going to invite the presenters to join me here for being able to answer any questions you may have. Thank you. Thank you, Jill. Here's your mic. Okay. We will be able to take questions from the room. There will be two mics circulating for anybody who wants to get us started with a question.
Hi. I guess I'll start here.
Yeah.
Hi. George Notter from Wolfe Research. Thanks for the presentation. I guess I was just kind of curious about how aggressively you want to monetize this business. It seems like you guys are really in the center of some really important changes going on inside enterprises and applications and APIs and agentic, and yet, you're kind of raising pricing, I think, on a cadence of single digits early in the year. I mean, your competitors, I think are driving much more significant price increases. I know there's a share game you're trying to play, but it seems like there's an opportunity to monetize more aggressively. I guess along those lines, I was looking at some of the deal sizes you put up on the screen.
I think there was $1 million and $2 million and $4 million deals. Yet here you are, you're in such a critical spot inside these networks. Shouldn't your deal sizes be bigger? Any thoughts there would be great. Thanks.
Hey, George. Thank you for the question. I'll start with that. I think the deal size that you saw was illustrating specific use cases that are emerging and of significant interest for us. We obviously do deals that are in the multiple tens of millions, as well in our markets. In terms of monetization- Look, we have a very important philosophy that we stick to. F5, as you know, we're celebrating our 30-year anniversary this year, and we have been for 30 years serving enterprise customers, government entities, telcos, across all verticals. We've done that, built a very strong franchise by building strong relationships with our customers over a period of time. We believe in building long-term value for F5 shareholders starts with having very strong relationship with customers.
Part of that is having practices that are sustainable over time, both for our customers and for us. That is why we have leveraged our incumbency to continue to monetize our relationship with customers, but we've done so and will continue to do so in a way that is sustainable. A good example of that, by the way, is we have been taking share from competitors in our market who have different philosophies and different behaviors around pricing, and we continue to win franchise after franchise that will pay off for us over the long term. We will continue to be disciplined in realization, but also measured in the way we approach that with our customers. Yep. Lower, please, right here. Yeah.
Thank you very much. Simon Leopold with Raymond James. I want to come back to the mix between the systems growth and the software growth, in that it does appear that with the demands, it would make sense that maybe more customers should be attracted to systems for the performance that's required for AI, yet you're forecasting double-digit growth coming back on the software side. It sort of feels like, I think you've made a case for why systems are more attractive than we used to think. I'm a little bit puzzled as to why we wouldn't see an offset from your software business.
Cooper, you want to start with that?
There's a couple of dynamics in place here. A lot of our portfolio is software only. We talked about Distributed Cloud, for example, where we're seeing very strong growth. AI runtime security. Just the expansion we're seeing across the platform has really been manifesting in our software opportunity. We're just seeing the trends of how customers have been deploying the technology, both in the hardware and the software form factor. The trend we're seeing is a really strong expansion trend, and that really kind of underpins that software outlook. I think when we take a step back, what we're really looking at is the growth in applications and application traffic and the solutions that we sell to support both the delivery and security of these applications.
That's the hybrid multi-cloud bet that we made seven, eight years ago, was that customers were going to need to have the flexibility to adjust as new dynamics came into the arena. That's what we've been seeing, right? That's where the strength on the hardware side of the business is coming, and it may prove that hardware is stronger than we've guided, just based on how these dynamics continue to evolve. I think the critical thing is that we've had so much success because we have intentionally provided that choice for our customers, and that's really paying off right now. Right now, with the balance of strong growth across both. Yeah, over time, especially as AI use cases continue to accelerate, there may be an opportunity for stronger growth on the hardware side than what we're outlining today.
We'll go to Tim. Yeah.
Hi. Thank you. Tim Long at Barclays. Cooper, for you, curious a little bit about disclosure here. You guys gave little snippets last quarter on kind of what you know is AI contribution in the numbers.
Yeah.
I'm just curious if you've done any more work on, you said there's a lot of tangential type of business. Just curious if there's any updates there. Then going forward, I'm just curious how, obviously, a lot going on with AI, and it matters for you guys in the industry. Are you envisioning over time just seeing like security, like maybe once a year you'll give us some numbers? I know there was a time where the first few years when you started the cloud offerings, we got some numbers, and then we didn't get some numbers. Maybe if you can just let us, I know we're at early stages.
Yeah
It's tough to define now, anything you can kind of update us on where we are currently and your vision of how we'll see more regular data on these important new drivers for the company. Thank you.
Yeah, I'm happy to. We've talked today about three distinct, direct AI use cases and then also the opportunity we're seeing driven by AI application traffic. We gave a $50 million update on the direct use cases that we've seen over the first half of the year, and really that was our effort to kind of give an update as kind of as to how things are trending within those use cases. It is a subset of the overall AI revenue that we're seeing today, and we expect that the growth is potentially going to be just as strong for the indirect use cases. Now, we can't track that revenue discretely because it's still BIG-IP being sold in a new, as part of expansion in this infrastructure. Customers are buying to support all of their workload growth. It may be largely driven by AI traffic.
There could be other dynamics in place. What we can do is track the growth we're seeing outside of refresh motions in the form of expansion, and we are able to attribute that the majority of that is coming from AI-driven expansion. That's just some background. Over time, we're not going to update our direct use case revenue consistently, but we will try to give more context as that business continues to manifest. We also expect additional use cases will start to emerge over time as well.
Hi, Kunal. Let's give it to Kunal. Yeah.
Hi. On AI, I have a few questions. Who's the customer? Within the existing customer, is it the same buyer or is it a different buyer? What's the pricing model of AI modules? Meaning, is it more like hardware pricing modules, or does it change more like in NGINX, or does it go based on volume? If you can talk about kind of the way to monetize AI.
Yes. Kunal, I'll take that one. We've talked about three use cases in AI, the answer to your questions is different depending on the use cases. You're starting with the one that's most mature, which is AI data delivery. The target customers for that are large enterprises, typically. The buyer in that organization, it varies by organization.
Sometimes it's an AI team that's been set up to build the AI infrastructure. They own the AI data pipeline, and they're building all that infrastructure. We get to that buyer through the F5 buyer, which is typically a NetOps buyer. Sometimes the buyer in the organization is the NetOps buyer. This is a go-to-market motion that already has scale inside of F5, where our teams and our partners understand the buyers, understand the use case, and we're seeing strong traction. Most of the revenues we've done in AI in these use cases has come from that motion. AI security is more nascent. The buyer is typically a SecOps CISO persona. The consumption model is largely software for AI native security to secure AI models. It goes into our large enterprise customers, whether it's government entities, enterprise across all verticals.
The ones who are doing that today are those who are more sophisticated, have already deployed AI models, and are already worried about guardrails in front of these models. It's typically large financial services, technology companies that are doing that. The third use case is very different. This is AI factory load balancing. It's improving traffic efficiency, tokenomics, as Kunal shared, inside of AI factories. The buyers there, it's not today 1,000 of enterprises. It's concentrated into a few players who are doing sovereign AI and some Neoclouds. That would be just a few tens of companies that could take that in. The buyers there are the people building the infrastructure and in charge of optimizing that.
That use case is more nascent, both because of where we are in the cycle of getting through the reference architecture and getting our products GA and getting the product tested, et cetera, and also because the market is not yet mature. Most of the players there have been focused on GPU as a service, meaning just renting GPU capacity, and have not yet been focused on selling tokens and monetizing tokens. It's when you are focused on monetizing tokens in an inference use case, that token efficiency matters tremendously, and F5 has a very important role to play. Those are the three routes to market and the customers we're targeting.
Each one of those has a different pricing model. The first one is mainly high-performance hardware ports. Second one is scanners, depending how much traffic's between the model. The third one is software on DPUs.
Yeah. Samik? Yeah.
Hi. Samik from JPMorgan.
Yeah.
François, you're outlining that you're being a bit more mindful about pricing to offset some of these costs, whereas the rest of the industry isn't being the same way, where a lot of the other infrastructure is seeing strong price increases. What we're generally picking up is a lot of enterprises are now exploring public cloud more for the initial AI use cases versus building something that's more on-prem. How do we think about that shift or any delays on that front? How do you capture the sort of value still if enterprises are leveraging more public cloud in the meantime, just given the overall inflationary impact we are seeing in building infrastructure? That's maybe one.
If I can just quickly follow up, you're talking about a big increase in traffic with AI, but probably what stood out is in terms of AI data delivery and the TAM you're outlining there is only about $1 billion for AI factories and AI data delivery, which seems pretty small for the kind of traffic growth that you're outlining. Is there an underlying assumption there of how many enterprises or what portion of enterprises are investing in 2030 to drive that TAM estimate?
Okay. Thank you, Samik. I'll start with the second part of your question. Then I'll come back to public cloud versus on-prem. Kunal may want to add on that in a moment. On data delivery, yes, you are right. When we show this TAM, we're saying this is going to grow to $1 billion. By the way, these are forecasts from, I forgot which analyst firm is forecasting that. Actually, our belief is that it could be larger than that. That is a very narrow use case of ADC. If you look at that $1 billion relative to the ADC market, it's a pretty substantial inflection in the ADC market. AI security, the TAM that we're showing is not narrow. It includes a number of security capabilities. That's why we think it's going to be a multi-billion dollar TAM very quickly.
It's true that today, we have a lot of concentration in our AI revenues. The smallest market opportunity and the ones that are larger, we are not yet having a significant contribution. I think that's going to evolve over time. In terms of enterprises and where they're building their AI infrastructure. What we have seen is a lot of enterprises are initially, because of the cost of GPUs and the speed with which GPUs are evolving, we have seen a lot of enterprise initially say, "I'm not going to invest in my own GPU infrastructure. I'm going to wait for this to mature because I can't depreciate assets at this speed. Whilst I'm doing that, I'm going to rent GPU infrastructure in the cloud.
I fully intend to control my AI infrastructure end to end. At some point, I will have that in my own infrastructure." I think we will see an element of that evolution. We're already seeing, by the way, what we are seeing is a lot of companies realizing their proprietary data is more valuable than it's ever been. They want that to be close to their AI models. We've seen companies repatriate data from the cloud just because they're collecting way more data from their customers, from their products. Their bills are exploding. They want to have the data on-prem because it's lower cost. I think we'll see a mix of both. I do see also the inflationary nature of everything now, server storage, et cetera, potentially pushing customers to the cloud.
We've seen the reverse movement in a lot of our customers. Kunal, do you have a perspective on that?
Yeah. We're seeing some really interesting behaviors with the enterprises that we serve. We don't typically see our enterprises move everything to one location. Specifically when it comes to the cloud, what we are seeing them do is take specific training workloads. Very few companies, though, are training by themselves. They're doing a lot of fine-tuning, so they're leveraging a lot of open models and then doing fine-tuning runs in the cloud. That's a pretty common practice to what François is describing. They may not have the GPUs on-prem to fulfill a pretty large training run with all their data. Then they may come back on-prem after the model is built, where they don't necessarily need to run a very large model. The phrase LLMs or the term LLMs sometimes gets overused. I think in reality, there's a pretty big spectrum here between SLMs and LLMs.
Most organizations, when they're doing the training and fine-tuning, they're living on the SLM side of things. In many cases, some of the models that are being built by enterprises don't necessarily need GPUs to run. They can run on CPUs or they can run on a smaller scale setup with GPUs. That said, where we are able to help organizations is the transport of that data. In some of these cases where we've been able to help folks around the context of data delivery, is they may have source data that's living in one environment that they need to feed into another environment where the GPUs are.
In that particular case, they'll use BIG-IP at the source or at the destination to ultimately feed that data, control the flow of that information, and feed that in, whether it's to an object store or ultimately feeding that into a cluster where GPUs are.
Yeah.
Good afternoon. Thank you for the question. It's Mike Ng from Goldman Sachs. I just wanted to ask about the multi-year software revenue outlook. In the slides, it seemed to suggest that there was an acceleration in fiscal 2028 and fiscal 2029. Is that the case? What's driving that? Second, I was just wondering if you could talk a little bit about some of the things that inform your visibility, whether that be the timing of term contracts or a greater mix towards SaaS or an expectation of agents driving software demand. Just any color there would be helpful. Thank you.
I'll start. Historically, if you've been tracking our software business, it's been a strong growth business, but there have been some kind of ebbs and flows on that growth rate, and a lot of that is the cyclical nature of some of these renewals. As that base continues to grow, the cyclical amplitude starts to get more normalized, right? To your point, we do have very good visibility as to what that base looks like today, not just in terms of what we've sold, but also what the current adoption rate is within these contracts. We're seeing that expansion rate continue to go up. As we're adding new offerings, that gives customers more opportunities to consolidate additional features into this platform. That all gives us good visibility.
The SaaS business becoming a growth business, and also, by the way, that one is a much more consistent growth rate business because it's ratable by nature. The runtime security is the third category of growth that we see that is also software. I think over time, what you're going to see is we're probably going to be a while before we're away from the quarterly variability in the growth rates. From an annual basis, we believe that we're going to have pretty consistently double-digit plus growth rates in our software business.
Mm-hmm. Is there an acceleration in the back part of this?
We're not going to guide within the timeframe. The base that is coming up for renewal in the back half is very healthy. Of course, there's still a lot of work to do to continue to drive expansion within that base.
Yep.
Okay.
Jeff Hopson from Needham. Thanks for the question. With the growth in AI agents, I'm curious, it seems like API security is the most obvious or near term to see impact of that. Is the monetization side the sheer growth of calls or is it different features that companies are asking for? Just kind of curious what the actual monetization looks like.
John?
Yeah, sure.
Do you want to take that?
Yeah. Right now, it really depends where the APIs are flowing. A lot of our API services right now are sitting on our distributed cloud, XC, and we've seen really good growth in the last 12 months of the API services. As we go forward, they're also looking for APIs in the data center and in the cloud, and so we're rolling out that API services across our BIG-IP. We just introduced BIG-IP API discovery, for example. Then for API services, you've got discovery, you've got protection and security. It's kind of a multi-vector. It's in the cloud, it's in SaaS, it's in data centers, and then it's different API services as you roll them out. In the next six to nine months, we should have all of that across all our control points and all our product families.
I'll look to add a little bit more on that. With respect to APIs, I think there's definitely going to be more API consumption because of agents. It's a structured form of input and output, which works great with AI models. What we see right now is a lot of interest around discovering these APIs. Part one usually is find all the APIs, and that's for multiple reasons. One, if you know where the APIs are, they can become useful for these agents upstream. The second bit of it is also security. APIs are still one of the leading factors around data exfiltration today. It isn't just for agents, but also for security. It serves a dual purpose of why people would want to continue and go down that discovery path. Data exfiltration is typically a problem there.
In terms of features and functionality around discovery, it can include things like sensitive data leakage, data classification, things like that at that point. Then, of course, you get to the runtime around API, which involves pretty heavily, for us, security. That's a pretty important factor, again, not just because of data leakage, but also what you can do downstream with that. The thing about agents and what we're all kind of learning in this new normal is multi-turn and reasoning. You add all those things up and the ability to fan out to multiple APIs. You can get a lot of information from everywhere. You can take action in lots of different places. Organizations are looking for that sort of centralized governance across APIs, wherever they may be. It could be on-prem, could be in the cloud.
That's the other thing that's pretty interesting in this new normal is these agents are hybrid and multi-cloud by design, right? They're meant to fetch data locally, maybe pass that on to a model which could live in a cloud or could live on-prem and ultimately work with them. But typically, it's happening through APIs. Again, discovery is one aspect of it, data classification is another, broad security is another, and then of course, insights around just generally what's going on with that API traffic.
If you saw the McKinsey attack, agentic attack, that was a shadow APIs to begin with, and it's a SQL injection. It was a stop with API discovery and protection and a WAF.
Lauren? Yeah.
Woo Jin Ho from Bloomberg Intelligence. Thanks for hosting this meeting. Couple of questions, first of all. You had a couple of vectors of growth, TAM of 15 to 28. That implies a 13% growth. On top of that, you've got the $11 billion AI kicker. You also gave us the data center growth of 7%, and you've been growing at a two times that rate. Why a high single-digit guidance relative to the TAM and the growth vectors that you provided? Then secondly, you had mentioned the GPU-as-a-service segment as a potential opportunity for tokenomics and tokenomics delivery. What gives you confidence that that is a potential market, especially given that the public cloud guys build their own virtual ADCs in-house and load balancers in-house? That took away share from you guys over that period of 2015 to 2022.
No, thank you. Well, actually, I'll start with the second part of the question. In terms of the GPU, the opportunity for F5 to help people who build AI infrastructure get more efficiency, get more tokens out of the factories. The target market for that is not the very large hyperscalers that indeed, as you said, have built their own stack and will not rely on third-party software to go do that. There is a class of customers that will likely do that. Time will tell, but it's more the Neoclouds, not the big U.S. hyperscalers, Microsoft, Google, Amazon, et cetera. Neoclouds will likely do that. People building sovereign AI, some of whom are already F5 customers outside of the U.S., it's typically telecom companies have taken on the mandate to build sovereign AI or large organizations.
They are candidates to leverage our technology to improve the efficiency. Eventually, large enterprises who build significant GPU infrastructure will also want to have better token efficiency because as you know, token costs are exploding for everybody, and tokenomics is going to matter enormously as enterprises do more inferencing. These three classes of customers, Neoclouds, sovereign AI, and enterprises, are the customers ultimately that we will go after, not the hyperscalers. To the first part of your question around our guidance given the growth in addressable market. Look, I would say when you look at our guidance, you have to balance that we see substantial opportunities, and we're giving long-term guidance here.
On the one hand, if you look at what we've baked into our guidance, we have baked the things that either have already been proven. Well, that have actually both been proven and for which we've had enough runtime to know that it's sustainable. It's things like hybrid multi-cloud deployments, continued adoption of our platform, that's a part of it. Growing demand of ADCs because the general demand we see and the general growth in traffic, those are elements we have built in. There are things that are upside opportunities that are not, frankly, in our guidance. We talked about PQC, I think, in my presentation. PQC could have a substantial effect on demand for ADC for F5 in the horizon that we're discussing. We didn't bake that in our guidance. We didn't bake enormous success in the works with NVIDIA on DPUs, because these things are nascent.
There's a lot of uncertainty around how things will materialize, so that's not in. In AI security, that is also nascent. We don't have enough runtime to bake a lot of that in, so we have very modest assumptions around that today. There is upside, but at the same time, we're giving long-term guidance, and we have to be mindful. The world changes very quickly. The last time we gave long-term guidance in 2020, we went through COVID, we went through a massive supply chain crisis, we went through a big enterprise pullback. In the last couple of years, we've seen a lot of geopolitical uncertainty, and all of that has driven volatility in our growth and in our numbers. We are also mindful of that because macro can present a risk over the next two, three years.
We've balanced those elements to build a guidance that we think is prudent. If you look at our track record over the last couple of years, we've been really focused on giving guidance that we can meet and exceed, and our goal is to do the same thing. Tim, for return appearance.
Thank you. Yeah, maybe for, I'm not sure who, but I wanted to touch on the systems business. I think you talked a little bit about this. One of the vectors was market share gains, but I'm just curious to your views. Obviously, someone talked about pricing dynamics. You had a big competitor that went private equity, so that's always helpful for the incumbents and the bigger leaders. Maybe when you think about that mid-single or high single-digit systems hardware number, could you just give us a little insight? You can only gain so much share. How much do you see as category growth? Obviously, a lot of these new AI use cases are a positive in there.
maybe if you could just decouple how much of this is actually share gain and when do you start bumping up against a ceiling there, and it has to really be more industry growth that's going to drive the performance in the systems hardware.
Cooper can start.
Yeah.
Vice and Chad, do you want to add on whether we see a ceiling on the competitive install base?
Yeah. I think that the majority of the growth is coming from workload growth, new use cases, just a lot of the dynamics we outlined that are really kind of expanding what we're doing for our customer base. then augmenting that is, or supplementing that is the continued kind of acceleration of a takeout opportunity. we've had very strong success with competitive takeout motions over the last few years. there is some of that already in our baseline, and we think that that continues to expand over time. we do think it's a large opportunity, and it's a long-tail opportunity. I mean, a lot of these competitive bases are locked into multi-year type agreements, and so there's a lot of planning activity that we already have insight.
We're working with some of these companies that are looking to plan to migrate to F5 at the end of these terms. It's also akin to a land-and-expand motion. Typically, we get in with these customers, we do the design work with them, and they roll us out into an initial segment of their environment. Over time, there's the opportunity for us to continue to take out the rest of the infrastructure. We think it's a nice element to the growth opportunity, and we think it's a long-term growth opportunity.
Chad, do you want to-
Yeah. I think that's a really good capture.
Typically, when we get these competitive displacements, it's for a first part of the franchise, right? An entity of the franchise. The expansion beyond that is significant. We see quite a bit of runway left from a planning perspective, multiple years across competitors that we lined out, along with what Cooper was saying. We have to sequence this against what they're doing for their obligations, right? Nobody wants to pay for duplicative solutions. All of these things have been sequenced over time, and as they come up, we compete for them and find our success that way.
Yes.
Thanks. Simon from Raymond James again. Considering the patterns we've seen on your free cash flow and your buybacks, what has been the board's consideration and discussion about introducing a dividend? Has it come up? Obviously, you haven't done so, but just wondering whether or not it's something that's been discussed and where the company stands on that.
Yeah. It's funny, we were just having a conversation about this. If you look at the impact from a dividend versus a buyback, at least with F5 where we've been growing our market over time, I think the impact for shareholders is much more attractive with the share repurchase program. You get better leverage with an effectively executed share repurchase program. We also like that there is flexibility. It gives us more flexibility over time as we think about use of cash. We've been very committed to that 50% threshold, but that is really where we feel is the most effective way to return cash to shareholders is through a share repurchase program.
Question, but I am relaying a question.
From Meta Marshall, who is unfortunately traveling today, can't be with us in person.
She's asked, "How do you size the data sovereignty opportunity in EMEA? how do you see that developing outside EMEA?
You want to
Chad? You want to start?
No, go ahead.
Well, let me start with the part about sizing.
Yeah. The part about how we see it developing outside of EMEA. Chad mentioned there's some regulation that has happened in Europe. GDPR is one, DORA is another.
Yes.
MiFID II is another one. That has really forced all entities of national relevance in these countries, whether it's government entities or telcos or in the financial services, to really drive this autonomy, this resilience, move things back on-prem or have true resilience between cloud and on-prem environment. In EMEA, that's happening. In Asia, we actually are starting to see more of it. In EMEA, we've seen it over the last nine months. We've now start to see that developing more in Asia. Not in all countries in Asia, but in certain countries in Asia Pacific, Australia being one of them. Japan, and other countries, India, where we see more of that digital sovereignty playing, and we think that's likely to accelerate over the next 12 months. In terms of sizing the opportunity over time.
Yeah. I went ahead and I discussed that in my presentation today. Again, I would say this is not EMEA specific, right? We're seeing this in APAC. You mentioned what's happening in Singapore, India, Japan, and others. This is an overall trend in the industry, period. In terms of sizing it, we believe the collective opportunity is hundreds of millions. I think it was $600 million of incremental opportunity in the time period from calendar year 2027 through 2030. We're seeing the early adoption that started in EMEA, but that is translating beyond that. I think one of the meta points of this isn't digital sovereignty, right? In isolation. It's really about resiliency. Customers have to have custody of their data. It doesn't matter where they reside. They have to have custody of their data.
a lot of things, when you look at the geopolitical situation, what's taking place with the conflict in Ukraine, that has changed the dynamics overnight in different parts of the world about what they're going to be doing with their assets and how they're addressing those assets. for us, the meta point is really resilience, and we're seeing that the world over. Of course, it's easy to point to the governance that's taking place in EMEA, and now the onset of new governance in APCJ.
Mm-hmm. Thank you, Chad. We'll take one last question.
Thanks. George Notter again. I think you guys said last quarter that roughly half of the hardware install base is still iSeries or maybe a little larger. Are you surprised that it's still this big at this point? I think you're only a few quarters away from going into software support. Also, like with Mythos and all the security stuff going on in the world, it seems like customers will be more hesitant to continue to run these systems. I think, Cooper, you mentioned the refresh would continue into 2027, but any updated thoughts there? Thanks.
Why don't we break that in two? Cooper, if you want to talk about the install base, and maybe Kunal, you can say a word about the implications of Mythos for what we see customers doing in terms of runtime security and ADC.
You're right. We have two product families that we're going into software support. The chassis-based product family, VIPRION, where we've hit end of software support. The majority of customers that were migrating onto newer offerings have already taken those measures, but there's always been a long tail of the refresh motion, even beyond end-of-software support dates. We'll still see that with VIPRION. iSeries is still more than half of that opportunity has yet to be refreshed still. We're about, I think, three quarters out from that end of software support date. We're definitely seeing that motion pick up and accelerate, and that's why we said we expect this opportunity to be very strong through FY 2027. I do think that there will be customers that wait until after that date. There always are.
It's really just a balance of where customers perceive they have risk and what their risk tolerance is. The bigger story that we're seeing really is the growth that we're seeing alongside the refresh with the expansion opportunity. I think that's where we're most excited is when we're through this refresh opportunity, that base, that then we can sell continued expansion against and set up for the next refresh when we introduce the next generation. That's going to be a larger opportunity for us.
Thank you.
On the larger point on Mythos, we at F5 are using a combination of advanced research and preview models to ensure that we can identify and remediate vulnerabilities inside our code base. We take security super seriously as an organization. This is a program that we've been executing on for some time in terms of leveraging AI to find problems and fix those issues. We're going to continue to support our customers that have our software and hardware platforms and those combinations that are under support. It's important for us that we obviously do that for them, and it's important for the industry to protect critical infrastructure. Now, the other side of this as an opportunity that is emerging in the Mythos moment is security. Application security is so important for organizations.
what we didn't spend too much time talking about with AI-powered WAF was we are seeing the attackers leverage extremely sophisticated techniques, mostly generated from AI today, to try and get around defense systems. the point I mentioned earlier around static defenses not being able to hold anymore is really true. there is a really interesting opportunity ahead of making our security software AI-powered for these organizations. they would want to have a capability that can defend against these novel types of attacks that are out there. today, AI-powered WAF. We recently introduced API security, API discovery for our BIG-IP customers as well, because we have seen the rise of agents. We've started to see that type of traffic show up in organizations.
we want to make sure that we are positioning these platforms with the ability to take on that traffic, disposition it, and secure all of it.
Thank you, Kunal. Suzanne?
We are ready to wrap up, François. I don't know if you want to say a few closing remarks or if you'd like me to.
I would like you to.
Wonderful. Thank you so much, everybody, for joining us. We really appreciate it. The slides and the webcast will be available on the website shortly. For those of you that don't have to rush off that are here with us in person, we'd love it if you'd join us in the reception area for some refreshments. Thanks so much.