F5 Is Misleading the Market – The Breach Is Nowhere Near Contained

6 months ago

F5 is accused of misleading clients, investors, and regulators about the containment of a significant breach.
The breach involved nation-state actors with over a year of unrestricted access to F5's core infrastructure, including source code and credentials.
F5's response is criticized for prioritizing optics over substantive forensic investigation and threat containment.
The company's reliance on third-party firms (IOActive and NCC Group) for code review is questioned for lacking the capability to handle nation-state level threats.
The breach has compromised F5's BIG-IP technology, posing risks to its customers, including federal agencies.
Legal exposure is anticipated, with potential class action lawsuits from affected clients.
F5's historical security posture is described as negligent, with systemic failures in IT governance and compliance.
The company's recommendations post-breach are deemed inadequate, focusing on minor updates rather than addressing core security issues.
CISA has issued an emergency directive, highlighting the severity of the breach, contrary to F5's downplayed narrative.
The report concludes that F5's products cannot be considered safe from sophisticated threats, with ongoing risks of undisclosed compromises.

Hasty Briefsbeta