Table of Contents

As filed with the Securities and Exchange Commission on March 3, 2014.

Registration No. 333-193717

 

 

 

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

 

 

 

AMENDMENT NO. 1

TO

FORM S-1

REGISTRATION STATEMENT

UNDER

THE SECURITIES ACT OF 1933

 

 

 

FIREEYE, INC.

(Exact name of registrant as specified in its charter)

 

 

 

Delaware		3577		20-1548921
(State or other jurisdiction of incorporation or organization)		(Primary Standard Industrial Classification Code Number)		(I.R.S. Employer Identification Number)

 

1440 McCarthy Blvd.

Milpitas, CA 95035

(408) 321-6300

(Address, including zip code, and telephone number, including area code, of registrant’s principal executive offices)

 

 

 

David G. DeWalt

Chief Executive Officer

FireEye, Inc.

1440 McCarthy Blvd.

Milpitas, CA 95035

(408) 321-6300

(Name, address, including zip code, and telephone number, including area code, of agent for service)

 

 

 

Copies to:

 

Aaron J. Alter Jon C. Avina Wilson Sonsini Goodrich & Rosati Professional Corporation 650 Page Mill Road Palo Alto, CA 94304 (650) 493-9300		Alexa King Richard Meamber FireEye, Inc. 1440 McCarthy Blvd. Milpitas, CA 95035 (408) 321-6300		Eric C. Jensen David Peinsipp Andrew S. Williamson Cooley LLP 3175 Hanover Street Palo Alto, CA 94304-1130 (650) 843-5000

 

Approximate date of commencement of proposed sale to the public: As soon as practicable after this registration statement becomes effective.

 

If any of the securities being registered on this Form are to be offered on a delayed or continuous basis pursuant to Rule 415 under the Securities Act, check the following box:  ¨

 

If this Form is filed to register additional securities for an offering pursuant to Rule 462(b) under the Securities Act, please check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering.  ¨

 

If this Form is a post-effective amendment filed pursuant to Rule 462(c) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering.  ¨

 

If this Form is a post-effective amendment filed pursuant to Rule 462(d) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering.  ¨

 

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, or a smaller reporting company. See the definitions of “large accelerated filer,” “accelerated filer” and “smaller reporting company” in Rule 12b-2 of the Exchange Act. (Check one):

 

Large accelerated filer		¨		Accelerated filer		¨
Non-accelerated filer		x  (Do not check if a smaller reporting company)		Smaller reporting company		¨

 

 

 

CALCULATION OF REGISTRATION FEE

 

Title of Each Class of Securities to be Registered		Amount to be Registered(1)		Proposed Maximum Offering Price Per Share(2)		Proposed Maximum Aggregate Offering Price(1)(2)		Amount of Registration Fee(3)
Common Stock, $0.0001 par value per share		16,100,000		$85.81		$1,381,541,000		$177,943

(1)

Includes the additional shares that the underwriters have the option to purchase to cover over-allotments, if any.

(2)

Estimated solely for the purpose of computing the amount of the registration fee pursuant to Rule 457(c) under the Securities Act of 1933, as amended, based on the average of the high and low sales prices of the Registrant’s Common Stock as reported on The NASDAQ Global Select Market on February 27, 2014.

(3)

The Registrant previously paid $90,160 of the registration fee in connection with the initial filing of this registration statement.

 

The Registrant hereby amends this registration statement on such date or dates as may be necessary to delay its effective date until the Registrant shall file a further amendment which specifically states that this registration statement shall thereafter become effective in accordance with Section 8(a) of the Securities Act of 1933 or until the registration statement shall become effective on such date as the Securities and Exchange Commission, acting pursuant to said Section 8(a), may determine.

 

 

 

---

Table of Contents

The information in this prospectus is not complete and may be changed. We and the selling stockholders may not sell these securities until the registration statement filed with the Securities and Exchange Commission is effective. This prospectus is not an offer to sell these securities and we and the selling stockholders are not soliciting offers to buy these securities in any jurisdiction where the offer or sale is not permitted.

 

PROSPECTUS (Subject to Completion)

Issued March 3, 2014

 

14,000,000 Shares

 

 

COMMON STOCK

 

 

 

FireEye, Inc. is offering 5,582,215 shares of its common stock. Certain stockholders of FireEye, Inc. identified in this prospectus are offering an additional 8,417,785 shares. We will not receive any of the proceeds from the sale of the shares being sold by the selling stockholders.

 

 

 

Our common stock is listed on The NASDAQ Global Select Market under the symbol “FEYE.” On February 28, 2014, the last reported sale price of our common stock on The NASDAQ Global Select Market was $85.64 per share.

 

 

 

We are an “emerging growth company” under the U.S. federal securities laws and are subject to reduced public company reporting requirements. Investing in our common stock involves risks. See “Risk Factors” beginning on page 15.

 

 

 

PRICE $         A SHARE

 

 

 

		Price to Public		Underwriting Discounts and Commissions(1)		Proceeds to FireEye		Proceeds to Selling Stockholders
Per Share		$		$		$		$
Total		$		$		$		$

(1)

See “Underwriters” beginning on page 175 for additional information regarding underwriting compensation.

 

The underwriters have the option to purchase up to 2,100,000 additional shares from us at the public offering price less the underwriting discount to cover over-allotments.

 

The Securities and Exchange Commission and any state securities regulators have not approved or disapproved of these securities, or determined if this prospectus is truthful or complete. Any representation to the contrary is a criminal offense.

 

The underwriters expect to deliver the shares of common stock to purchasers on                     , 2014.

 

 

 

MORGAN STANLEY		BARCLAYS		J.P. MORGAN			GOLDMAN, SACHS & CO.

	UBS INVESTMENT BANK			DEUTSCHE BANK SECURITIES		CITIGROUP

PACIFIC CREST SECURITIES		NOMURA

 

                    , 2014

---

Table of Contents

---

Table of Contents

---

Table of Contents

TABLE OF CONTENTS

 

 

 

 

You should rely only on the information contained in this prospectus or contained in any free writing prospectus filed with the Securities and Exchange Commission. Neither we, the selling stockholders nor any of the underwriters have authorized anyone to provide any information or make any representations other than those contained in this prospectus or in any free writing prospectus filed with the Securities and Exchange Commission. We take no responsibility for, and can provide no assurance as to the reliability of, any other information that others may give you. We are offering to sell, and seeking offers to buy, shares of common stock only in jurisdictions where offers and sales are permitted. The information contained in this prospectus is accurate only as of the date of this prospectus, regardless of the time of delivery of this prospectus or of any sale of the common stock. Our business, financial condition, results of operations and prospects may have changed since such date.

 

For investors outside of the United States: Neither we, the selling stockholders nor any of the underwriters have done anything that would permit this offering or possession or distribution of this prospectus in any jurisdiction where action for that purpose is required, other than in the United States. You are required to inform yourselves about, and to observe any restrictions relating to, this offering and the distribution of this prospectus outside of the United States.

---

Table of Contents

 

1

---

Table of Contents

 

2

---

Table of Contents

 

3

---

Table of Contents

 

4

---

Table of Contents

 

5

---

Table of Contents

 

6

---

Table of Contents

 

7

---

Table of Contents

 

8

---

Table of Contents

 

9

---

Table of Contents

 

10

---

Table of Contents

 

11

---

Table of Contents

 

12

---

Table of Contents

 

13

---

Table of Contents

 

14

---

Table of Contents

RISK FACTORS

 

Investing in our common stock involves a high degree of risk. You should carefully consider the risks and uncertainties described below, together with all of the other information in this prospectus, including our consolidated financial statements and related notes, before investing in our common stock. If any of the following risks are realized, in whole or in part, our business, financial condition, results of operations and prospects could be materially and adversely affected. In that event, the price of our common stock could decline, and you could lose part or all of your investment.

 

Risks Related to Our Business and Our Industry

 

If the IT security market does not continue to adopt our virtual machine-based security platform, our sales will not grow as quickly as anticipated, or at all, and our business, results of operations and financial condition would be harmed.

 

We are seeking to disrupt the IT security market with our virtual machine-based security platform. Our platform interoperates with but does not replace most signature-based IT security products. Enterprises and governments that use signature-based security products, such as firewalls, intrusion prevention systems, or IPS, anti-virus, or AV, and Web and messaging gateways, for their IT security may be hesitant to purchase our virtual machine-based security platform if they believe that signature-based products are more cost effective, provide substantially the same functionality as our platform or provide a level of IT security that is sufficient to meet their needs. Currently, most enterprises and governments have not allocated a fixed portion of their budgets to protect against next-generation advanced cyber attacks. As a result, to expand our customer base, we need to convince potential customers to allocate a portion of their discretionary budgets to purchase our platform. However, even if we are successful in doing so, any future deterioration in general economic conditions may cause our customers to cut their overall IT spending, and such cuts may fall disproportionately on products and services like ours, for which no fixed budgetary allocation has been made. If we do not succeed in convincing customers that our platform should be an integral part of their overall approach to IT security and that a fixed portion of their annual IT budgets should be allocated to our platform, our sales will not grow as quickly as anticipated, or at all, which would have an adverse impact on our business, results of operations and financial condition.

 

Even if there is significant demand for virtual machine-based security solutions like ours, if our competitors include functionality that is, or is perceived to be, better than or equivalent to that of our platform in signature-based or other products that are already generally accepted as necessary components of an organization’s IT security architecture, we may have difficulty increasing the market penetration of our platform. Furthermore, even if the functionality offered by other IT security providers is different and more limited than the functionality of our platform, organizations may elect to accept such limited functionality in lieu of adding products from additional vendors like us.

 

If enterprises and governments do not continue to adopt our virtual machine-based security platform for any of the reasons discussed above, our sales would not grow as quickly as anticipated, or at all, and our business, results of operations and financial condition would be harmed.

 

Recent and future acquisitions and investments could disrupt our business and harm our financial condition and operating results.

 

Our success will depend, in part, on our ability to expand our platform and grow our business in response to changing technologies, customer demands and competitive pressures. In some circumstances, we may decide to do so through the acquisition of complementary businesses and technologies rather than through internal development, including, for example, our recent acquisition of Mandiant Corporation, or Mandiant, a provider of advanced endpoint security products and security incident response management solutions. The identification of

 

15

---

Table of Contents

suitable acquisition candidates can be difficult, time-consuming and costly, and we may not be able to successfully complete acquisitions that we target in the future. The risks we face in connection with acquisitions, including our recent acquisition of Mandiant, include:

 

•

diversion of management time and focus from operating our business to addressing acquisition integration challenges;

 

•

coordination of research and development and sales and marketing functions;

 

•

integration of product and service offerings;

 

•

retention of key employees from the acquired company;

 

•

changes in relationships with strategic partners as a result of product acquisitions or strategic positioning resulting from the acquisition;

 

•

cultural challenges associated with integrating employees from the acquired company into our organization;

 

•

integration of the acquired company’s accounting, management information, human resources and other administrative systems;

 

•

the need to implement or improve controls, procedures, and policies at a business that prior to the acquisition may have lacked sufficiently effective controls, procedures and policies;

 

•

financial reporting, revenue recognition or other financial or control deficiencies of the acquired company that we don’t adequately address and that cause our reported results to be incorrect;

 

•

liability for activities of the acquired company before the acquisition, including intellectual property infringement claims, violations of laws, commercial disputes, tax liabilities and other known and unknown liabilities;

 

•

unanticipated write-offs or charges; and

 

•

litigation or other claims in connection with the acquired company, including claims from terminated employees, customers, former stockholders or other third parties.

 

Our failure to address these risks or other problems encountered in connection with our past or future acquisitions and investments could cause us to fail to realize the anticipated benefits of these acquisitions or investments, cause us to incur unanticipated liabilities, and harm our business generally. For example, we only recently completed our acquisition of Mandiant, and substantially all of the acquisition integration risks remain. Future acquisitions could also result in dilutive issuances of equity securities. For example, we recently issued approximately 16.9 million shares of common stock and assumed options to purchase approximately 4.6 million shares of our common stock in connection with our acquisition of Mandiant. There is also a risk that future acquisitions will result in the incurrence of debt, contingent liabilities, amortization expenses, incremental operating expenses or the write-off of goodwill, any of which could harm our financial condition or operating results.

 

Our limited operating history makes it difficult to evaluate our current business and prospects and may increase the risk that we will not be successful.

 

We were founded in 2004, and our first commercially successful product was our Web Threat Prevention appliance, which we first shipped in 2008. We expanded our platform in 2011, 2012 and 2013 to include our Email Threat Prevention appliance, File Threat Prevention appliance and our latest Web Threat Prevention appliance, the NX 10000, respectively. In December 2013, we expanded our platform through the addition of Mandiant’s endpoint threat detection, response and remediation products; advanced threat intelligence capabilities; and incident response and security consulting services. The majority of our revenue growth began in 2010. Our limited operating history and our recent acquisition of Mandiant make it difficult to evaluate our current business and prospects and plan for and model our future growth. We have encountered and will continue to encounter risks and uncertainties frequently encountered by rapidly growing companies in developing markets.

 

16

---

Table of Contents

If our assumptions regarding these risks and uncertainties are incorrect or change in response to changes in the IT security market, our results of operations and financial results could differ materially from our plans and forecasts. Although we have experienced rapid growth for the past several years, there is no assurance that such growth will continue. Any success we may experience in the future will depend in large part on our ability to, among other things:

 

•

maintain and expand our customer base and the ways in which customers use our products and services;

 

•

expand revenue from existing customers through increased or broader use of our products and services within their organizations;

 

•

convince customers to allocate a fixed portion of their annual IT budgets to our products and services;

 

•

improve the performance and capabilities of our platform through research and development;

 

•

effectively expand our business domestically and internationally, which will require that we rapidly expand our sales force and service professionals and fill key management positions, particularly internationally; and

 

•

successfully compete with other companies that currently provide, or may in the future provide, solutions like ours that protect against next-generation advanced cyber attacks.

 

If we are unable to achieve our key objectives, including the objectives listed above, our business and results of operations will be adversely affected and the fair market value of our common stock could decline.

 

If we do not effectively expand and train our direct sales force, we may be unable to add new customers or increase sales to our existing customers, and our business will be adversely affected.

 

We continue to be substantially dependent on our direct sales force to obtain new customers and increase sales with existing customers. There is significant competition for sales personnel with the skills and technical knowledge that we require. Our ability to achieve significant revenue growth will depend, in large part, on our success in recruiting, training and retaining sufficient numbers of sales personnel to support our growth, particularly in international markets. New hires require significant training and may take significant time before they achieve full productivity. Our recent hires and planned hires may not become productive as quickly as we expect, and we may be unable to hire or retain sufficient numbers of qualified individuals in the markets where we do business or plan to do business. In addition, because we continue to grow rapidly, a large percentage of our sales force is new to our company. If we are unable to hire and train a sufficient number of effective sales personnel, or the sales personnel we hire are not successful in obtaining new customers or increasing sales to our existing customer base, our business will be adversely affected.

 

If we fail to effectively manage our growth, our business, financial condition and results of operations would be harmed.

 

Our headcount increased from more than 175 employees as of December 31, 2011 to over 1,600 employees as of December 31, 2013. We expect our headcount to continue to grow rapidly. In addition, our number of end-customers increased from more than 425 to more than 1,900 over the same period. This rapid growth has placed significant demands on our management and our operational and financial infrastructure. To improve our infrastructure, we have recently implemented a new enterprise resource planning system, including revenue recognition and management software, and we plan to implement additional systems. There is no assurance that we will be able to successfully scale improvements to our enterprise resource planning system or other systems and processes in a manner that keeps pace with our growth or that such systems will be effective in preventing or detecting errors, omissions or fraud.

 

As part of our efforts to improve our internal systems, processes and controls, we have licensed technology from third parties. The support services available for such third-party technology is outside of our control and may be negatively affected by consolidation in the software industry. In addition, if we do not receive adequate

 

17

---

Table of Contents

support for the software underlying our systems, processes and controls, our ability to provide products and services to our customers in a timely manner may be impaired, which may cause us to lose customers, limit us to smaller deployments of our platform or increase our technical support costs.

 

To manage this growth effectively, we must continue to improve our operational, financial and management systems and controls by, among other things:

 

•

effectively attracting, training and integrating a large number of new employees, particularly members of our sales and management teams;

 

•

further improving our key business applications, processes and IT infrastructure, including our data centers, to support our business needs;

 

•

enhancing our information and communication systems to ensure that our employees and offices around the world are well coordinated and can effectively communicate with each other and our growing base of channel partners and customers;

 

•

improving our internal control over financial reporting and disclosure controls and procedures to ensure timely and accurate reporting of our operational and financial results; and

 

•

appropriately documenting our IT systems and business processes.

 

These and other improvements in our systems and controls will require significant capital expenditures and the allocation of valuable management and employee resources. If we fail to implement these improvements effectively, our ability to manage our expected growth, ensure uninterrupted operation of key business systems and comply with the rules and regulations applicable to public reporting companies would be impaired, and our business, financial condition and results of operations would be harmed.

 

Fluctuating economic conditions make it difficult to predict revenue for a particular period, and a shortfall in revenue may harm our operating results.

 

Our revenue depends significantly on general economic conditions and the demand for products in the IT security market. Economic weakness, customer financial difficulties, and constrained spending on IT security may result in decreased revenue and earnings. Such factors could make it difficult to accurately forecast our sales and operating results and could negatively affect our ability to provide accurate forecasts to our contract manufacturers and manage our contract manufacturer relationships and other expenses. In addition, concerns regarding the impact of the U.S. federal sequestration on the IT budgets of various agencies of the U.S. government, as well as continued budgetary challenges in the United States and Europe and geopolitical turmoil in many parts of the world have and may continue to put pressure on global economic conditions and overall spending on IT security. Currently, most enterprises and governments have not allocated a fixed portion of their budgets to protect against next-generation advanced cyber attacks. If we do not succeed in convincing customers that our platform should be an integral part of their overall approach to IT security and that a fixed portion of their annual IT budgets should be allocated to our platform, general reductions in IT spending by our customers are likely to have a disproportionate impact on our business, results of operations and financial condition. General economic weakness may also lead to longer collection cycles for payments due from our customers, an increase in customer bad debt, restructuring initiatives and associated expenses, and impairment of investments. Furthermore, the continued weakness and uncertainty in worldwide credit markets, including the sovereign debt situation in certain countries in the European Union, may adversely impact the ability of our customers to adequately fund their expected capital expenditures, which could lead to delays or cancellations of planned purchases of our platform.

 

Uncertainty about future economic conditions also makes it difficult to forecast operating results and to make decisions about future investments. Future or continued economic weakness for us or our customers, failure of our customers and markets to recover from such weakness, customer financial difficulties, and reductions in spending on IT security could have a material adverse effect on demand for our platform and consequently on our business, financial condition and results of operations.

 

18

---

Table of Contents

Our results of operations are likely to vary significantly from period to period, which could cause the trading price of our common stock to decline.

 

Our results of operations have varied significantly from period to period, and we expect that our results of operations will continue to vary as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including:

 

•

our ability to attract and retain new customers;

 

•

the budgeting cycles, seasonal buying patterns and purchasing practices of customers;

 

•

the timing of shipments of our products and length of our sales cycles;

 

•

changes in customer or reseller requirements or market needs;

 

•

changes in the growth rate of the IT security market, particularly the market for threat protection solutions like ours that target next-generation advanced cyber attacks;

 

•

the timing and success of new product and service introductions by us or our competitors or any other change in the competitive landscape of the IT security market, including consolidation among our customers or competitors;

 

•

the level of awareness of IT security threats, particularly advanced cyber attacks, and the market adoption of our platform;

 

•

deferral of orders from customers in anticipation of new products or product enhancements announced by us or our competitors;

 

•

our ability to successfully expand our business domestically and internationally;

 

•

reductions in customer renewal rates for our subscriptions;

 

•

decisions by organizations to purchase IT security solutions from larger, more established security vendors or from their primary IT equipment vendors;

 

•

changes in our pricing policies or those of our competitors;

 

•

any disruption in, or termination of, our relationship with channel partners;

 

•

decreases in our customers’ subscription renewal rates;

 

•

our inability to fulfill our customers’ orders due to supply chain delays or events that impact our manufacturers or their suppliers;

 

•

insolvency or credit difficulties confronting our customers, affecting their ability to purchase or pay for our products, subscriptions and services, or confronting our key suppliers, particularly our sole source suppliers, which could disrupt our supply chain;

 

•

the cost and potential outcomes of existing and future litigation;

 

•

seasonality in our business;

 

•

general economic conditions, both domestic and in our foreign markets;

 

•

future accounting pronouncements or changes in our accounting policies or practices;

 

•

the amount and timing of operating costs and capital expenditures related to the expansion of our business;

 

•

a change in our mix of products, subscriptions and services; and

 

•

increases or decreases in our expenses caused by fluctuations in foreign currency exchange rates.

 

19

---

Table of Contents

Any of the above factors, individually or in the aggregate, may result in significant fluctuations in our financial and other operating results from period to period. As a result of this variability, our historical results of operations should not be relied upon as an indication of future performance. Moreover, this variability and unpredictability could result in our failure to meet our operating plan or the expectations of investors or analysts for any period. If we fail to meet such expectations for these or other reasons, the market price of our common stock could fall substantially, and we could face costly lawsuits, including securities class action suits.

 

We have had operating losses each year since our inception, and may not achieve or maintain profitability in the future.

 

We have incurred operating losses each year since 2004, including net losses of $16.8 million, $35.8 million and $120.6 million in 2011, 2012 and 2013, respectively. We expect our operating expenses to increase in the future as we expand our sales and marketing efforts and continue to invest in research and development of our technologies. These efforts may be more costly than we expect, and we may not be able to increase our revenue to offset our increased operating expenses. Our revenue growth may slow or our revenue may decline for a number of other reasons, including reduced demand for our platform, increased competition, a decrease in the growth or size of the IT security market, particularly the market for solutions that target the next generation of advanced cyber attacks, or any failure to capitalize on growth opportunities. Any failure to increase our revenue as we grow our business could prevent us from achieving or maintaining profitability. If we are unable to meet these risks and challenges as we encounter them, our business, financial condition and results of operations may suffer.

 

We expect our revenue growth rate to decline, and as our costs increase, we may not be able to generate sufficient revenue to achieve and maintain profitability over the long term.

 

From the year ended December 31, 2010 to the year ended December 31, 2013, our revenue grew from $11.8 million to $161.6 million, which represents a compounded annual growth rate of approximately 139%. We expect that, to the extent our revenue increases to higher levels, our revenue growth rate will decline, and we may not be able to generate sufficient revenue to achieve or maintain profitability. We also expect our costs to increase in future periods, which could negatively affect our future operating results if our revenue does not increase. In particular, we expect to continue to expend substantial financial and other resources on:

 

•

research and development related to our platform, including investments in our research and development team;

 

•

sales and marketing, including a significant expansion of our sales organization, particularly in international markets;

 

•

international expansion of our business;

 

•

expansion of our professional services organization; and

 

•

general administration expenses, including legal and accounting expenses related to being a public company.

 

These investments may not result in increased revenue or growth in our business. If we are unable to increase our revenue at a rate sufficient to offset the expected increase in our costs, our business, financial position and results of operations will be harmed, and we may not be able to achieve or maintain profitability over the long term.

 

Seasonality may cause fluctuations in our revenue.

 

We believe there are significant seasonal factors that may cause us to record higher revenue in some quarters compared with others. We believe this variability is largely due to our customers’ budgetary and spending patterns, as many customers spend the unused portions of their discretionary budgets prior to the end of

 

20

---

Table of Contents

their fiscal years. For example, we have historically recorded our highest level of revenue in our fourth quarter, which we believe corresponds to the fourth quarter of a majority of our customers. Similarly, we have historically recorded our second-highest level of revenue in our third quarter, which corresponds to the fourth quarter of U.S. federal agencies and other customers in the U.S. federal government. In addition, our rapid growth rate over the last couple years may have made seasonal fluctuations more difficult to detect. If our rate of growth slows over time, seasonal or cyclical variations in our operations may become more pronounced, and our business, results of operations and financial position may be adversely affected.

 

We face intense competition and could lose market share to our competitors, which could adversely affect our business, financial condition and results of operations.

 

The market for security products and services is intensely competitive and characterized by rapid changes in technology, customer requirements, industry standards and frequent new product introductions and improvements. We anticipate continued challenges from current competitors, which in many cases are more established and enjoy greater resources than us, as well as by new entrants into the industry. If we are unable to anticipate or effectively react to these competitive challenges, our competitive position could weaken, and we could experience a decline in our growth rate or revenue that could adversely affect our business and results of operations.

 

Our competitors and potential competitors include large networking vendors such as Cisco Systems, Inc. and Juniper Networks, Inc. that may emulate or integrate virtual-machine features similar to ours into their own products; large companies such as Intel, IBM, and HP that have acquired large IT security specialist vendors in recent years and have the technical and financial resources and broad customer bases needed to bring competitive solutions to the market; independent IT security vendors such as Sourcefire (which was recently acquired by Cisco Systems, Inc.) and Palo Alto Networks that offer products that claim to perform similar functions to our platform; small and large companies that offer point solutions that compete with some of the features present in our platform; and other providers of incident response services. Other IT providers offer, and may continue to introduce, security features that compete with our platform, either in stand-alone security products or as additional features in their network infrastructure products. Many of our existing competitors have, and some of our potential competitors could have, substantial competitive advantages such as:

 

•

greater name recognition, longer operating histories and larger customer bases;

 

•

larger sales and marketing budgets and resources;

 

•

broader distribution and established relationships with channel and distribution partners and customers;

 

•

greater customer support resources;

 

•

greater resources to make acquisitions;

 

•

lower labor and research and development costs;

 

•

larger and more mature intellectual property portfolios; and

 

•

substantially greater financial, technical and other resources.

 

In addition, some of our larger competitors have substantially broader product offerings and may be able to leverage their relationships with distribution partners and customers based on other products or incorporate functionality into existing products to gain business in a manner that discourages users from purchasing our products, subscriptions and services, including by selling at zero or negative margins, product bundling or offering closed technology platforms. Potential customers may also prefer to purchase from their existing suppliers rather than a new supplier regardless of product performance or features. As a result, even if the features of our platform are superior, customers may not purchase our products. In addition, new innovative start-up companies, and larger companies that are making significant investments in research and development, may invent similar or superior products and technologies that compete with our platform. Our current and potential

 

21

---

Table of Contents

competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their resources. If we are unable to compete successfully, or if competing successfully requires us to take costly actions in response to the actions of our competitors, our business, financial condition and results of operations could be adversely affected.

 

Our sales cycles can be long and unpredictable, and our sales efforts require considerable time and expense. As a result, our sales and revenue are difficult to predict and may vary substantially from period to period, which may cause our results of operations to fluctuate significantly.

 

Our results of operations may fluctuate, in part, because of the resource intensive nature of our sales efforts, the length and variability of our sales cycle and the short-term difficulty in adjusting our operating expenses. Our results of operations depend in part on sales to large organizations. The length of our sales cycle, from proof of concept to delivery of and payment for our platform, is typically three to nine months but can be more than a year. To the extent our competitors develop products that our prospective customers view as equivalent to ours, our average sales cycle may increase. Because the length of time required to close a sale varies substantially from customer to customer, it is difficult to predict exactly when, or even if, we will make a sale with a potential customer. As a result, large individual sales have, in some cases, occurred in quarters subsequent to those we anticipated, or have not occurred at all. The loss or delay of one or more large transactions in a quarter could impact our results of operations for that quarter and any future quarters for which revenue from that transaction is delayed. As a result of these factors, it is difficult for us to forecast our revenue accurately in any quarter. Because a substantial portion of our expenses are relatively fixed in the short term, our results of operations will suffer if our revenue falls below our or analysts’ expectations in a particular quarter, which could cause the price of our common stock to decline.

 

Reliance on shipments at the end of each quarter could cause our revenue for the applicable period to fall below expected levels.

 

As a result of customer buying patterns and the efforts of our sales force and channel partners to meet or exceed their sales objectives, we have historically received a substantial portion of sales orders and generated a substantial portion of revenue during the last few weeks of each quarter. A significant interruption in our IT systems, which manage critical functions such as order processing, revenue recognition, financial forecasts, inventory and supply chain management, and trade compliance reviews, could result in delayed order fulfillment and decreased revenue for that quarter. If expected revenue at the end of any quarter is delayed for any reason, including the failure of anticipated purchase orders to materialize, our logistics or channel partners’ inability to ship products prior to quarter-end to fulfill purchase orders received near the end of the quarter, our failure to manage inventory to meet demand, our inability to release new products on schedule, any failure of our systems related to order review and processing, or any delays in shipments based on trade compliance requirements, our revenue for that quarter could fall below our expectations and the estimates of market analysts, which could adversely impact our business and results of operations and cause a decline in the trading price of our common stock.

 

If we do not accurately anticipate and respond promptly to changes in our customers’ technologies, business plans or security needs, our competitive position and prospects could be harmed.

 

Many of our customers operate in markets characterized by rapidly changing technologies and business plans, which require them to add numerous network access points and adapt to increasingly complex IT networks, incorporating a variety of hardware, software applications, operating systems and networking protocols. As their technologies and business plans grow more complex, we expect these customers to face new and increasingly sophisticated methods of attack. We face significant challenges in ensuring that our platform effectively identifies and responds to these advanced and evolving attacks without disrupting our customers’ network performance. As a result of the continued rapid innovations in the technology industry, including the rapid growth of smart phones, tablets and other devices and the trend of “bring your own device” in enterprises, we expect the networks of our customers to continue to change rapidly and become more complex.

 

22

---

Table of Contents

We have identified a number of new products and enhancements to our platform that we believe are important to our continued success in the IT security market. For example, in September 2013, we announced the introduction of our latest Web Threat Prevention appliance, the NX 10000, and in December 2013, we released our new SaaS-based Mobile Threat Prevention solution and our solution for small and midsize businesses. There can be no assurance that we will be successful in developing and marketing, on a timely basis, such new products or enhancements or that our new products or enhancements will adequately address the changing needs of the marketplace. In addition, some of our new products and enhancements may require us to develop new hardware architectures that involve complex, expensive and time-consuming research and development processes. Although the market expects rapid introduction of new products and enhancements to respond to new threats, the development of these products and enhancements is difficult and the timetable for commercial release and availability is uncertain, as there can be significant time lags between initial beta releases and the commercial availability of new products and enhancements. We may experience unanticipated delays in the availability of new products and enhancements to our platform and fail to meet customer expectations with respect to the timing of such availability. If we do not quickly respond to the rapidly changing and rigorous needs of our customers by developing, releasing and making available on a timely basis new products and enhancements to our platform that can adequately respond to advanced threats and our customers’ needs, our competitive position and business prospects will be harmed. Furthermore, from time to time, we or our competitors may announce new products with capabilities or technologies that could have the potential to replace or shorten the life cycles of our existing products. There can be no assurance that announcements of new products will not cause customers to defer purchasing our existing products.

 

Additionally, the process of developing new technology is expensive, complex and uncertain. The success of new products and enhancements depends on several factors, including appropriate component costs, timely completion and introduction, differentiation of new products and enhancements from those of our competitors, and market acceptance. To maintain our competitive position, we must continue to commit significant resources to developing new products or enhancements to our platform before knowing whether these investments will be cost-effective or achieve the intended results. There can be no assurance that we will successfully identify new product opportunities, develop and bring new products or enhancements to market in a timely manner, or achieve market acceptance of our platform, or that products and technologies developed by others will not render our platform obsolete or noncompetitive. If we expend significant resources on researching and developing products or enhancements to our platform and such products or enhancements are not successful, our business, financial position and results of operations may be adversely affected.

 

Disruptions or other business interruptions that affect the availability of our Dynamic Threat Intelligence, or DTI, cloud could adversely impact our customer relationships as well as our overall business.

 

When a customer purchases one or more of our threat prevention appliances, it must also purchase a subscription to our DTI cloud for a term of either one or three years. Our DTI cloud enables global sharing of threat intelligence uploaded by any of our customers’ cloud-connected FireEye appliances. Our data center and networks may experience technical failures and downtime, may fail to distribute appropriate updates, or may fail to meet the increased requirements of a growing customer base, any of which could temporarily or permanently expose our customers’ networks, leaving their networks unprotected against the latest security threats. Our customers depend on the continuous availability of our DTI cloud. Our DTI cloud is vulnerable to damage or interruption from a variety of sources, including damage or interruption caused by fire, earthquake, power loss, telecommunications or computer systems failure, cyber attack, human error, terrorist acts and war. There may also be system or network interruptions if new or upgraded systems are defective or not installed properly. Moreover, interruptions in our subscription updates could result in a failure of our DTI cloud to effectively update customers’ hardware products and thereby leave our customers more vulnerable to attacks. Interruptions or failures in our service delivery could cause customers to terminate their subscriptions with us, could adversely affect our renewal rates, and could harm our ability to attract new customers. Our business would also be harmed if our customers believe that our DTI cloud is unreliable.

 

23

---

Table of Contents

If we are unable to sell additional products, subscriptions and services, as well as renewals of our subscriptions and services, to our customers, our future revenue and operating results will be harmed.

 

Our future success depends, in part, on our ability to expand the deployment of our platform with existing customers by selling them additional products, subscriptions and services. This may require increasingly sophisticated and costly sales efforts and may not result in additional sales. In addition, the rate at which our customers purchase additional products, subscriptions and services depends on a number of factors, including the perceived need for additional IT security as well as general economic conditions. If our efforts to sell additional products, subscriptions and services to our customers are not successful, our business may suffer.

 

Further, existing customers that purchase our platform have no contractual obligation to renew their subscriptions and support and maintenance services after the initial contract period, and given our limited operating history, we may not be able to accurately predict our renewal rates. Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including the level of their satisfaction with our platform, our customer support, customer budgets and the pricing of our platform compared with the products and services offered by our competitors. If our customers renew their subscriptions, they may renew for shorter contract lengths or on other terms that are less economically beneficial to us. We cannot assure you that our customers will renew their subscriptions, and if our customers do not renew their subscriptions or renew on less favorable terms, our revenue may grow more slowly than expected, if at all.

 

We also depend on our installed customer base for future support and maintenance revenue. We offer our support and maintenance agreements for terms that generally range between one and five years. If customers choose not to renew their support and maintenance agreements or seek to renegotiate the terms of their support and maintenance agreements prior to renewing such agreements, our revenue may decline.

 

If we are unable to increase sales of our platform to large organizations while mitigating the risks associated with serving such customers, our business, financial position and results of operations may suffer.

 

Our growth strategy is dependent, in part, upon increasing sales of our platform to large enterprises and governments. Sales to large customers involve risks that may not be present (or that are present to a lesser extent) with sales to smaller entities. These risks include:

 

•

increased purchasing power and leverage held by large customers in negotiating contractual arrangements with us;

 

•

more stringent or costly requirements imposed upon us in our support service contracts with such customers, including stricter support response times and penalties for any failure to meet support requirements;

 

•

more complicated implementation processes;

 

•

longer sales cycles and the associated risk that substantial time and resources may be spent on a potential customer that ultimately elects not to purchase our platform or purchases less than we hoped;

 

•

closer relationships with, and dependence upon, large technology companies who offer competitive products; and

 

•

more pressure for discounts and write-offs.

 

In addition, because security breaches with respect to larger, high-profile enterprises are likely to be heavily publicized, there is increased reputational risk associated with serving such customers. If we are unable to increase sales of our platform to large enterprise and government customers while mitigating the risks associated with serving such customers, our business, financial position and results of operations may suffer.

 

24

---

Table of Contents

Our current research and development efforts may not produce successful products or enhancements to our platform that result in significant revenue, cost savings or other benefits in the near future, if at all.

 

We must continue to dedicate significant financial and other resources to our research and development efforts if we are to maintain our competitive position. However, developing products and enhancements to our platform is expensive and time consuming, and there is no assurance that such activities will result in significant new marketable products or enhancements to our platform, design improvements, cost savings, revenue or other expected benefits. If we spend significant resources on research and development and are unable to generate an adequate return on our investment, our business and results of operations may be materially and adversely affected.

 

Real or perceived defects, errors or vulnerabilities in our platform or the failure of our platform to block malware or prevent a security breach could harm our reputation and adversely impact our business, financial position and results of operations.

 

Because our platform is complex, it has contained and may contain design or manufacturing defects or errors that are not detected until after its deployment by our customers. For example, in the past, we expended time and resources addressing certain manufacturing defects that negatively impacted the ability of certain appliances used in our platform to withstand normal transit. Defects in the functionality of our platform may result in vulnerability to security attacks, cause it to fail to secure networks or temporarily interrupt the networking traffic of our customers. In addition, because the techniques used by computer hackers to access or sabotage networks change frequently and generally are not recognized until launched against a target, there is a risk that an advanced attack could emerge that our platform is unable to detect or prevent. Moreover, as our platform is adopted by an increasing number of enterprises and governments, it is possible that the individuals and organizations behind advanced malware attacks will begin to focus on finding ways to defeat our platform. If this happens, our networks, products, subscriptions and services could be targeted by attacks specifically designed to disrupt our business and undermine the perception that our platform is capable of providing superior IT security, which, in turn, could have a serious impact on our reputation as a provider of virtual machine-based security solutions.

 

If any of our customers becomes infected with malware after adopting our platform, even if our platform has blocked the theft of any of such customer’s data, such customer could nevertheless be disappointed with our platform. Furthermore, if any enterprises or governments that are publicly known to use our platform are the subject of an advanced cyber attack that becomes publicized, our other current or potential customers may look to our competitors for alternatives to our platform. Real or perceived security breaches of our customers’ networks could cause disruption or damage to their networks or other negative consequences and could result in negative publicity to us, damage to our reputation, declining sales, increased expenses and customer relations issues. Furthermore, our platform may fail to detect or prevent malware, viruses, worms or similar threats for any number of reasons, including our failure to enhance and expand our platform to reflect industry trends, new technologies and new operating environments, the complexity of the environment of our clients and the sophistication of malware, viruses and other threats. To the extent potential customers or industry analysts believe that the occurrence of such a failure is a flaw or indicates that our products do not provide significant value, our reputation and business could be harmed. Failure to keep pace with technological changes in the IT security industry and changes in the threat landscape could adversely affect our ability to protect against security breaches and could cause us to lose customers.

 

Any real or perceived defects, errors or vulnerabilities in our platform, or any other failure of our platform to detect an advanced threat, could result in:

 

•

a loss of existing or potential customers or channel partners;

 

•

delayed or lost revenue;

 

•

a delay in attaining, or the failure to attain, market acceptance;

 

25

---

Table of Contents

•

the expenditure of significant financial and product development resources in efforts to analyze, correct, eliminate, or work around errors or defects, to address and eliminate vulnerabilities, or to identify and ramp up production with alternative third-party manufacturers;

 

•

an increase in warranty claims, or an increase in the cost of servicing warranty claims, either of which would adversely affect our gross margins;

 

•

harm to our reputation or brand; and

 

•

litigation, regulatory inquiries, or investigations that may be costly and further harm our reputation.

 

We may be unable to protect our intellectual property adequately, which could harm our business, financial condition and results of operations.

 

We believe that our intellectual property is an essential asset of our business. We rely on a combination of patent, copyright, trademark and trade secret laws, as well as confidentiality procedures and contractual provisions, to establish and protect our intellectual property rights in the United States and abroad. The efforts we have taken to protect our intellectual property may not be sufficient or effective, and our trademarks, copyrights and patents may be held invalid or unenforceable. Any U.S. or other patents issued to us may not be sufficiently broad to protect our proprietary technologies, and given the costs of obtaining patent protection, we may choose not to seek patent protection for certain of our proprietary technologies. We may not be effective in policing unauthorized use of our intellectual property, and even if we do detect violations, litigation may be necessary to enforce our intellectual property rights. Any enforcement efforts we undertake, including litigation, could be time-consuming and expensive, could divert management’s attention and may result in a court determining that our intellectual property rights are unenforceable. If we are not successful in cost-effectively protecting our intellectual property rights, our business, financial condition and results of operations could be harmed.

 

Claims by others that we infringe their proprietary technology or other rights could harm our business.

 

Technology companies frequently enter into litigation based on allegations of patent infringement or other violations of intellectual property rights. In addition, patent holding companies seek to monetize patents they have purchased or otherwise obtained. As we face increasing competition and gain an increasingly higher profile, the possibility of intellectual property rights claims against us grows. From time to time, third parties have asserted, and we expect that third parties will continue to assert, claims of infringement of intellectual property rights against us. For example, we are currently a party to suits by both a practicing and non-practicing entity alleging, among other things, patent infringement, each of which are in the early stages of litigation. Third parties may in the future also assert claims against our customers or channel partners, whom our standard license and other agreements obligate us to indemnify against claims that our products infringe the intellectual property rights of third parties. While we intend to increase the size of our patent portfolio, many of our competitors and others may now and in the future have significantly larger and more mature patent portfolios than we have. In addition, future litigation may involve patent holding companies or other patent owners who have no relevant product offerings or revenue and against whom our own patents may therefore provide little or no deterrence or protection. Any claim of intellectual property infringement by a third party, even a claim without merit, could cause us to incur substantial costs defending against such claim, could distract our management from our business and could require us to cease use of such intellectual property. Furthermore, because of the substantial amount of discovery required in connection with intellectual property litigation, there is a risk that some of our confidential information could be compromised by the discovery process.

 

Although third parties may offer a license to their technology or other intellectual property, the terms of any offered license may not be acceptable, and the failure to obtain a license or the costs associated with any license could cause our business, financial condition and results of operations to be materially and adversely affected. In addition, some licenses may be non-exclusive, and therefore our competitors may have access to the same technology licensed to us. If a third party does not offer us a license to its technology or other intellectual property on reasonable terms, or at all, we could be enjoined from continued use of such intellectual property. As

 

26

---

Table of Contents

a result, we may be required to develop alternative, non-infringing technology, which could require significant time (during which we could be unable to continue to offer our affected products, subscriptions or services), effort, and expense and may ultimately not be successful. Furthermore, a successful claimant could secure a judgment or we may agree to a settlement that prevents us from distributing certain products, providing certain subscriptions or performing certain services or that requires us to pay substantial damages, royalties or other fees. Any of these events could harm our business, financial condition and results of operations.

 

We incorporate technology from third parties into our products, and our inability to obtain or maintain rights to the technology could harm our business.

 

We incorporate technology from third parties into our products. We cannot be certain that our suppliers and licensors are not infringing the intellectual property rights of third parties or that the suppliers and licensors have sufficient rights to the technology in all jurisdictions in which we may sell our products. Some of our agreements with our suppliers and licensors may be terminated for convenience by them. If we are unable to obtain or maintain rights to any of this technology because of intellectual property infringement claims brought by third parties against our suppliers and licensors or against us, or if we are unable to continue to obtain such technology or enter into new agreements on commercially reasonable terms, our ability to develop and sell products, subscriptions and services containing such technology could be severely limited, and our business could be harmed. Additionally, if we are unable to obtain necessary technology from third parties, including certain sole suppliers, we may be forced to acquire or develop alternative technology, which may require significant time, cost and effort and may be of lower quality or performance standards. This would limit and delay our ability to offer new or competitive products and increase our costs of production. If alternative technology cannot be obtained or developed, we may not be able to offer certain functionality as part of our products, subscriptions and services. As a result, our margins, market share and results of operations could be significantly harmed.

 

Our products and subscriptions contain third-party open source software components, and failure to comply with the terms of the underlying open source software licenses could restrict our ability to sell our products and subscriptions.

 

Our products and subscriptions contain software modules licensed to us by third-party authors under “open source” licenses. The use and distribution of open source software may entail greater risks than the use of third-party commercial software, as open source licensors generally do not provide warranties or other contractual protections regarding infringement claims or the quality of the code. Some open source licenses contain requirements that we make available source code for modifications or derivative works we create based upon the type of open source software we use. If we combine our proprietary software with open source software in a certain manner, we could, under certain open source licenses, be required to release the source code of our proprietary software to the public. This would allow our competitors to create similar products with lower development effort and time and ultimately could result in a loss of sales for us.

 

Although we monitor our use of open source software to avoid subjecting our products and subscriptions to conditions, the terms of many open source licenses have not been interpreted by U.S. courts, and there is a risk that these licenses could be construed in ways that could impose unanticipated conditions or restrictions on our ability to commercialize products and subscriptions incorporating such software. Moreover, we cannot assure you that our processes for controlling our use of open source software in our products and subscriptions will be effective. From time to time, we may face claims from third parties asserting ownership of, or demanding release of, the open source software or derivative works that we developed using such software (which could include our proprietary source code), or otherwise seeking to enforce the terms of the applicable open source license. These claims could result in litigation. If we are held to have breached the terms of an open source software license, we could be required to seek licenses from third parties to continue offering our products on terms that are not economically feasible, to re-engineer our products, to discontinue the sale of our products if re-engineering could not be accomplished on a timely or cost-effective basis, or to make generally available, in source code form, our proprietary code, any of which could adversely affect our business, results of operations and financial condition.

 

27

---

Table of Contents

We rely on our management team and other key employees and will need additional personnel to grow our business, and the loss of one or more key employees or our inability to attract and retain qualified personnel could harm our business.

 

Our future success is substantially dependent on our ability to attract, retain and motivate the members of our management team and other key employees throughout our organization, including key employees obtained through our recent acquisition of Mandiant. Competition for highly skilled personnel is intense, especially in the San Francisco Bay Area and the Washington D.C. Area, where we have a substantial presence and need for highly skilled personnel. We may not be successful in attracting qualified personnel to fulfill our current or future needs. Our competitors may be successful in recruiting and hiring members of our management team or other key employees, and it may be difficult for us to find suitable replacements on a timely basis, on competitive terms, or at all. Also, to the extent we hire employees from mature public companies with significant financial resources, we may be subject to allegations that such employees have been improperly solicited, or that they have divulged proprietary or other confidential information or that their former employers own such employees’ inventions or other work product.

 

In addition, we believe that it is important to establish and maintain a corporate culture that facilitates the maintenance and transfer of institutional knowledge within our organization and also fosters innovation, teamwork, a passion for customers and a focus on execution. Our Chief Executive Officer, our Chief Operating Officer and certain other key members of our management and finance teams have only been working together for a relatively short period of time. If we are not successful in integrating these key employees into our organization, such failure could delay or hinder our product development efforts and the achievement of our strategic objectives, which could adversely affect our business, financial condition and results of operations.

 

Our employees, including our executive officers, work for us on an “at-will” basis, which means they may terminate their employment with us at any time. We do not maintain key person life insurance policies on any of our key employees. If one or more of our key employees resigns or otherwise ceases to provide us with their service, our business could be harmed.

 

If we are unable to maintain successful relationships with our channel partners and technology alliance partners, or if our channel partners or technology alliance partners fail to perform, our ability to market, sell and distribute our platform will be limited, and our business, financial position and results of operations will be harmed.

 

In addition to our direct sales force, we rely on our indirect channel partners to sell and support our platform. We derive a substantial portion of our revenue from sales of our products through our indirect channel, and we expect that sales through channel partners will continue to be a significant percentage of our revenue. We also partner with our technology alliance partners to design go-to-market strategies that combine our platform with products or services provided by our technology alliance partners.

 

Our agreements with our channel partners and our technology alliance partners are generally non-exclusive, meaning our partners may offer customers products from several different companies, including products that compete with ours. If our channel partners do not effectively market and sell our platform, choose to use greater efforts to market and sell their own products or those of our competitors, or fail to meet the needs of our customers, our ability to grow our business and sell our platform may be adversely affected. Our channel partners and technology alliance partners may cease marketing our platform with limited or no notice and with little or no penalty, and new channel partners require extensive training and may take several months or more to achieve productivity. The loss of a substantial number of our channel partners, our possible inability to replace them, or the failure to recruit additional channel partners could materially and adversely affect our results of operations. In addition, sales by channel partners are more likely than direct sales to involve collectability concerns, particularly in developing markets. Our channel partner structure could also subject us to lawsuits or reputational harm if, for example, a channel partner misrepresents the functionality of our platform to customers or violates applicable laws or our corporate policies.

 

28

---

Table of Contents

Our ability to achieve revenue growth in the future will depend in part on our success in maintaining successful relationships with our channel partners, and to train our channel partners to independently sell and deploy our platform. If we are unable to maintain our relationships with these channel partners or otherwise develop and expand our indirect sales channel, or if our channel partners fail to perform, our business, financial position and results of operations could be adversely affected.

 

Because we depend on a limited number of manufacturers to build the appliances used in our platform, we are susceptible to manufacturing delays and pricing fluctuations that could prevent us from shipping customer orders on time, or on a cost-effective basis, which may result in the loss of sales and customers.

 

We depend on a limited number of third-party manufacturers, primarily Flextronics Telecom Systems, Ltd., as sole source manufacturers for our appliances used in our platform. Our reliance on a limited number of third-party manufacturers reduces our control over the manufacturing process and exposes us to risks, including reduced control over quality assurance, product costs, and product supply and timing. Any manufacturing disruption by these third-party manufacturers could severely impair our ability to fulfill orders on time. If we are unable to manage our relationships with these third-party manufacturers effectively, or if these manufacturers suffer delays or disruptions for any reason, experience increased manufacturing lead-times, capacity constraints or quality control problems in their manufacturing operations, or fail to meet our future requirements for timely delivery, our ability to ship products to our customers would be severely impaired, and our business and results of operations would be harmed.

 

In addition, we may be deemed to manufacture or contract to manufacture products that contain certain minerals that have been designated as “conflict minerals” under the Dodd-Frank Wall Street Reform and Consumer Protection Act. As a result, in future periods, we may be required to diligence the origin of such minerals and disclose and report whether or not such minerals originated in the Democratic Republic of the Congo or adjoining countries. The implementation of these new requirements could adversely affect the sourcing, availability, and pricing of minerals used in the manufacture of our products. In addition, we may incur additional costs to comply with the disclosure requirements, including costs related to determining the source of any of the relevant minerals and metals used in our products.

 

Our third-party manufacturers typically fulfill our supply requirements on the basis of individual orders. We are subject to a risk of supply shortages and changes in pricing terms because we do not have long-term contracts with our third-party manufacturers that guarantee capacity, the continuation of particular pricing terms or the extension of credit limits. Our contract with our primary manufacturer permits it to terminate such contract at its convenience, subject to prior notice requirements. Any production interruptions for any reason, such as a natural disaster, epidemic, capacity shortages, or quality problems at one of our manufacturing partners would negatively affect sales of our products and adversely impact our business and results of operations.

 

We rely on revenue from subscriptions and service contracts, and because we recognize revenue from subscriptions and service contracts over the term of the relevant subscription or service period, downturns or upturns in sales are not immediately reflected in full in our results of operations.

 

Subscription and services revenue accounts for a significant portion of our total revenue, comprising 26%, 37% and 45% of total revenue for 2011, 2012 and 2013, respectively. Sales of new or renewal subscription and service contracts may decline or fluctuate as a result of a number of factors, including customers’ level of satisfaction with our products and subscriptions, the prices of our products and subscriptions, the prices of products and subscriptions offered by our competitors or reductions in our customers’ spending levels. If our sales of new or renewal subscription and service contracts decline, our revenue and revenue growth may decline and adversely affect our business. In addition, we recognize subscription and service revenue ratably over the term of the relevant service period, which is generally between one to five years. As a result, much of the subscription and service revenue we report each quarter is derived from subscription and service contracts that we sold in prior quarters. Consequently, a decline in new or renewed subscription or service contracts in any one

 

29

---

Table of Contents

quarter will not be fully reflected in revenue in that quarter but will negatively affect our revenue in future quarters. Accordingly, the effect of significant downturns in new or renewed sales of our subscriptions or services is not reflected in full in our results of operations until future periods. Also, it is difficult for us to rapidly increase our subscription revenue through additional sales in any period, as revenue from new and renewal subscription contracts must be recognized ratably over the applicable service period. Furthermore, any increases in the average term of subscriptions contracts would result in revenue for those subscription contracts being recognized over longer periods of time.

 

U.S. federal, state and local government sales are subject to a number of challenges and risks that may adversely impact our business.

 

Sales to U.S. federal, state, and local governmental agencies have in the past accounted for, and may in the future account for, a significant portion of our revenue. Sales to such government entities are subject to the following risks:

 

•

selling to governmental agencies can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that such efforts will generate a sale;

 

•

government certification requirements applicable to our products may change and in doing so restrict our ability to sell into the U.S. federal government sector until we have attained the revised certification;

 

•

government demand and payment for our products and services may be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our products and services;

 

•

we sell our platform to governmental agencies through our indirect channel partners, and these agencies may have statutory, contractual or other legal rights to terminate contracts with our distributors and resellers for convenience or due to a default, and any such termination may adversely impact our future results of operations;

 

•

governments routinely investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our platform, which would adversely impact our revenue and results of operations, or institute fines or civil or criminal liability if the audit uncovers improper or illegal activities; and

 

•

governments may require certain products to be manufactured in the United States and other relatively high-cost manufacturing locations, and we may not manufacture all products in locations that meet these requirements, affecting our ability to sell these products to governmental agencies.

 

Our ability to maintain customer satisfaction depends in part on the quality of our professional service organization and technical and other support services, including the quality of the support provided on our behalf by certain channel partners. Failure to maintain high-quality customer support could have a material adverse effect on our business, financial condition and results of operations.

 

Once our platform is deployed within our customers’ networks, our customers depend on our technical and other support services, as well as the support of our channel partners, to resolve any issues relating to the implementation and maintenance of our platform. If we or our channel partners do not effectively assist our customers in deploying our platform, succeed in helping our customers quickly resolve post-deployment issues, or provide effective ongoing support, our ability to sell additional products, subscriptions or services as part of our platform to existing customers would be adversely affected and our reputation with potential customers could be damaged. Many larger organizations have more complex networks and require higher levels of support than smaller customers. If we fail to meet the requirements of our larger customers, it may be more difficult to execute on our strategy of upselling and cross selling with these customers. Additionally, if our channel partners do not

 

30

---

Table of Contents

effectively provide support to the satisfaction of our customers, we may be required to provide this level of support to those customers, which would require us to hire additional personnel and to invest in additional resources. We are also in the process of expanding our professional services organization. It can take significant time and resources to recruit, hire, and train qualified technical support and professional services employees. We may not be able to hire such resources fast enough to keep up with demand, particularly when the sales of our platform exceed our internal forecasts. To the extent that we or our channel partners are unsuccessful in hiring, training, and retaining adequate support resources, our ability and the ability of our channel partners to provide adequate and timely support to our customers will be negatively impacted, and our customers’ satisfaction with our platform will be adversely affected. Additionally, to the extent that we need to rely on our sales engineers to provide post-sales support while we are ramping our professional services organization, our sales productivity will be negatively impacted, which would harm our results of operations.

 

The sales prices of our products, subscriptions and services may decrease, which may reduce our gross profits and adversely impact our financial results.

 

The sales prices for our products, subscriptions and services may decline for a variety of reasons, including competitive pricing pressures, discounts, a change in our mix of products and subscriptions, anticipation of the introduction of new products or subscriptions, or promotional programs. Competition continues to increase in the market segments in which we participate, and we expect competition to further increase in the future, thereby leading to increased pricing pressures. Larger competitors with more diverse product and service offerings may reduce the price of products or subscriptions that compete with ours or may bundle them with other products and subscriptions. Additionally, although we price our products and subscriptions worldwide in U.S. dollars, currency fluctuations in certain countries and regions may negatively impact actual prices that partners and customers are willing to pay in those countries and regions. Furthermore, we anticipate that the sales prices and gross profits for our products will decrease over product life cycles. We cannot assure you that we will be successful in developing and introducing new offerings with enhanced functionality on a timely basis, or that our new product and subscription offerings, if introduced, will enable us to maintain our prices and gross profits at levels that will allow us to maintain positive gross margins and achieve profitability.

 

Managing the supply of our products and their components is complex. Insufficient supply and inventory may result in lost sales opportunities or delayed revenue, while excess inventory may harm our gross margins.

 

Our third-party manufacturers procure components and build our products based on our forecasts, and we generally do not hold inventory for a prolonged period of time. These forecasts are based on estimates of future demand for our products, which are in turn based on historical trends and analyses from our sales and marketing organizations, adjusted for overall market conditions. In order to reduce manufacturing lead times and plan for adequate component supply, from time to time we may issue forecasts for components and products that are non-cancelable and non-returnable.

 

Our inventory management systems and related supply chain visibility tools may be inadequate to enable us to make accurate forecasts and effectively manage the supply of our products and product components. Supply management remains an area of increasing focus as we balance the need to maintain supply levels that are sufficient to ensure competitive lead times against the risk of obsolescence because of rapidly changing technology and customer requirements. If we ultimately determine that we have excess supply, we may have to reduce our prices and write-down inventory, which in turn could result in lower gross margins. Alternatively, insufficient supply levels may lead to shortages that result in delayed revenue or loss of sales opportunities altogether as potential customers turn to competitors’ products that may be readily available. Additionally, any increases in the time required to manufacture or ship our products could result in supply shortfalls. If we are unable to effectively manage our supply and inventory, our results of operations could be adversely affected.

 

31

---

Table of Contents

Because some of the key components in our products come from limited sources of supply, we are susceptible to supply shortages or supply changes, which could disrupt or delay our scheduled product deliveries to our customers and may result in the loss of sales and customers.

 

Our platform relies on key components, including a motherboard and chassis, which our third-party manufacturers purchase on our behalf from a sole source provider. The manufacturing operations of some of our component suppliers are geographically concentrated in Asia, which makes our supply chain vulnerable to regional disruptions. A localized health risk affecting employees at these facilities, such as the spread of a pandemic influenza, could impair the total volume of components that we are able to obtain, which could result in substantial harm to our results of operations. Similarly, a fire, flood, earthquake, tsunami or other disaster, condition or event such as political instability, civil unrest or a power outage that adversely affects any of these component suppliers’ facilities could significantly affect our ability to obtain the components needed for our products, which could result in a substantial loss of sales and revenue and a substantial harm to our results of operations.

 

We do not have volume purchase contracts with any of our component suppliers, and they could cease selling to us at any time. In addition, our component suppliers change their selling prices frequently in response to market trends, including industry-wide increases in demand, and because we do not have contracts with these suppliers, we are susceptible to price fluctuations related to raw materials and components. If we are unable to pass component price increases along to our customers or maintain stable pricing, our gross margins and results of operations could be negatively impacted. If we are unable to obtain a sufficient quantity of these components in a timely manner for any reason, sales of our products could be delayed or halted or we could be forced to expedite shipment of such components or our products at dramatically increased costs, which would negatively impact our revenue and gross margins. Additionally, poor quality in any of the sole-sourced components in our products could result in lost sales or lost sales opportunities. If the quality of the components does not meet our or our customers’ requirements, if we are unable to obtain components from our existing suppliers on commercially reasonable terms, or if any of our sole source providers cease to remain in business or continue to manufacture such components, we could be forced to redesign our products and qualify new components from alternate suppliers. The resulting stoppage or delay in selling our products and the expense of redesigning our products could result in lost sales opportunities and damage to customer relationships, which would adversely affect our business and results of operations.

 

Our failure to adequately protect personal information could have a material adverse effect on our business.

 

A wide variety of provincial, state, national, and international laws and regulations apply to the collection, use, retention, protection, disclosure, transfer and other processing of personal data. These data protection and privacy-related laws and regulations are evolving and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. Our failure to comply with applicable laws and regulations, or to protect such data, could result in enforcement action against us, including fines, imprisonment of company officials and public censure, claims for damages by customers and other affected individuals, damage to our reputation and loss of goodwill (both in relation to existing customers and prospective customers), any of which could have a material adverse effect on our operations, financial performance and business. Evolving and changing definitions of personal data and personal information within the European Union, the United States, and elsewhere, especially relating to classification of IP addresses, machine identification, location data and other information, may limit or inhibit our ability to operate or expand our business, including limiting technology alliance partners that may involve the sharing of data. Even the perception of privacy concerns, whether or not valid, may harm our reputation and inhibit adoption of our products by current and future customers.

 

If the general level of advanced cyber attacks declines, or is perceived by our current or potential customers to have declined, our business could be harmed.

 

Our business is substantially dependent on enterprises and governments recognizing that advanced cyber attacks are pervasive and are not effectively prevented by legacy security solutions. High visibility attacks on prominent enterprises and governments have increased market awareness of the problem of advanced cyber

 

32

---

Table of Contents

attacks and help to provide an impetus for enterprises and governments to devote resources to protecting against advanced cyber attacks, such as testing our platform, purchasing it, and broadly deploying it within their organizations. If advanced cyber attacks were to decline, or enterprises or governments perceived that the general level of advanced cyber attacks have declined, our ability to attract new customers and expand our offerings within existing customers could be materially and adversely affected. A reduction in the threat landscape could increase our sales cycles and harm our business, results of operations and financial condition.

 

Our technology alliance partnerships expose us to a range of business risks and uncertainties that could have a material adverse impact on our business and financial results.

 

We have entered, and intend to continue to enter, into technology alliance partnerships with third parties to support our future growth plans. Such relationships include technology licensing, joint technology development and integration, research cooperation, co-marketing activities and sell-through arrangements. We face a number of risks relating to our technology alliance partnerships that could prevent us from realizing the desired benefits from such partnerships on a timely basis or at all, which, in turn, could have a negative impact on our business and financial results.

 

Technology alliance partnerships require significant coordination between the parties involved, particularly if a partner requires that we integrate its products with our products. This could involve a significant commitment of time and resources by our technical staff and their counterparts within our technology alliance partner. The integration of products from different companies may be more difficult than we anticipate, and the risk of integration difficulties, incompatible products and undetected programming errors or defects may be higher than the risks normally associated with the introduction of new products. It may also be more difficult to market and sell products developed through technology alliance partnerships than it would be to market and sell products that we develop on our own. Sales and marketing personnel may require special training, as the new products may be more complex than our other products.

 

We invest significant time, money and resources to establish and maintain relationships with our technology alliance partners, but we have no assurance that any particular relationship will continue for any specific period of time. Generally, our agreements with these technology alliance partners are terminable without cause with no or minimal notice or penalties. If we lose a significant technology alliance partner, we could lose the benefit of our investment of time, money and resources in the relationship. In addition, we could be required to incur significant expenses to develop a new strategic alliance or to determine and implement an alternative plan to pursue the opportunity that we targeted with the former partner.

 

If our estimates or judgments relating to our critical accounting policies are based on assumptions that change or prove to be incorrect, our results of operations could fall below the expectations of securities analysts and investors, resulting in a decline in our stock price.

 

The preparation of financial statements in conformity with generally accepted accounting principles, or GAAP, requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” the results of which form the basis for making judgments about the carrying values of assets, liabilities, equity, revenue and expenses that are not readily apparent from other sources. Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in our stock price. Significant assumptions and estimates used in preparing our consolidated financial statements include those related to assets, liabilities, revenue, expenses and related disclosures.

 

33

---

Table of Contents

We are exposed to the credit risk of some of our distributors and resellers and to credit exposure in weakened markets, which could result in material losses.

 

Most of our sales are on an open credit basis. Although we have programs in place that are designed to monitor and mitigate these risks, we cannot assure you these programs will be effective in reducing our credit risks, especially as we expand our business internationally. If we are unable to adequately control these risks, our business, results of operations and financial condition could be harmed.

 

Our failure to raise additional capital or generate the significant capital necessary to expand our operations and invest in new products could reduce our ability to compete and could harm our business.

 

We intend to continue to make investments to support our business growth and may require additional funds to respond to business challenges, including the need to develop new products and enhancements to our platform, improve our operating infrastructure or acquire complementary businesses and technologies. Accordingly, we may need to engage in equity or debt financings to secure additional funds. If we raise additional equity financing, our stockholders may experience significant dilution of their ownership interests and the per share value of our common stock could decline. Furthermore, if we engage in debt financing, the holders of debt would have priority over the holders of common stock, and we may be required to accept terms that restrict our ability to incur additional indebtedness. We may also be required to take other actions that would otherwise be in the interests of the debt holders and force us to maintain specified liquidity or other ratios, any of which could harm our business, results of operations, and financial condition. If we need additional capital and cannot raise it on acceptable terms, we may not be able to, among other things:

 

•

develop or enhance our products and subscriptions;

 

•

continue to expand our sales and marketing and research and development organizations;

 

•

acquire complementary technologies, products or businesses;

 

•

expand operations, in the United States or internationally;

 

•

hire, train and retain employees; or

 

•

respond to competitive pressures or unanticipated working capital requirements.

 

Our failure to do any of these things could harm our business, financial condition and results of operations.

 

If our products do not effectively interoperate with our customers’ IT infrastructure, installations could be delayed or cancelled, which would harm our business.

 

Our products must effectively interoperate with our customers’ existing or future IT infrastructure, which often has different specifications, utilizes multiple protocol standards, deploys products from multiple vendors, and contains multiple generations of products that have been added over time. As a result, when problems occur in a network, it may be difficult to identify the sources of these problems. If we find errors in the existing software or defects in the hardware used in our customers’ infrastructure or problematic network configurations or settings, we may have to modify our software or hardware so that our products will interoperate with our customers’ infrastructure. In such cases, our products may be unable to provide significant performance improvements for applications deployed in our customers’ infrastructure. These issues could cause longer installation times for our products and could cause order cancellations, either of which would adversely affect our business, results of operations and financial condition. In addition, government and other customers may require our products to comply with certain security or other certifications and standards. If our products are late in achieving or fail to achieve compliance with these certifications and standards, or our competitors achieve compliance with these certifications and standards, we may be disqualified from selling our products to such customers, or may otherwise be at a competitive disadvantage, either of which would harm our business, results of operations, and financial condition.

 

34

---

Table of Contents

Failure to comply with governmental laws and regulations could harm our business.

 

Our business is subject to regulation by various U.S. federal, state, local and foreign governments. In certain jurisdictions, these regulatory requirements may be more stringent than those in the United States. Noncompliance with applicable regulations or requirements could subject us to investigations, sanctions, mandatory product recalls, enforcement actions, disgorgement of profits, fines, damages, civil and criminal penalties, injunctions or other collateral consequences. If any governmental sanctions are imposed, or if we do not prevail in any possible civil or criminal litigation, our business, results of operations, and financial condition could be materially adversely affected. In addition, responding to any action will likely result in a significant diversion of management’s attention and resources and an increase in professional fees. Enforcement actions and sanctions could harm our business, results of operations and financial condition.

 

We generate a significant amount of revenue from sales to resellers, distributors and customers outside of the United States, and we are therefore subject to a number of risks associated with international sales and operations.

 

We have a limited history of marketing, selling, and supporting our platform internationally. As a result, we must hire and train experienced personnel to staff and manage our foreign operations. To the extent that we experience difficulties in recruiting, training, managing, and retaining international employees, particularly managers and other members of our international sales team, we may experience difficulties in sales productivity in foreign markets. We also enter into strategic distributor and reseller relationships with companies in certain international markets where we do not have a local presence. If we are not able to maintain successful strategic distributor relationships with our international channel partners or recruit additional channel partners, our future success in these international markets could be limited. Business practices in the international markets that we serve may differ from those in the United States and may require us to include non-standard terms in customer contracts, such as extended payment or warranty terms. To the extent that we enter into customer contracts in the future that include non-standard terms related to payment, warranties, or performance obligations, our results of operations may be adversely impacted.

 

Additionally, our international sales and operations are subject to a number of risks, including the following:

 

•

greater difficulty in enforcing contracts and managing collections, as well as longer collection periods;

 

•

higher costs of doing business internationally, including costs incurred in establishing and maintaining office space and equipment for our international operations;

 

•

fluctuations in exchange rates between the U.S. dollar and foreign currencies in markets where we do business;

 

•

management communication and integration problems resulting from cultural and geographic dispersion;

 

•

risks associated with trade restrictions and foreign legal requirements, including any importation, certification, and localization of our platform that may be required in foreign countries;

 

•

greater risk of unexpected changes in regulatory practices, tariffs, and tax laws and treaties;

 

•

compliance with anti-bribery laws, including, without limitation, compliance with the U.S. Foreign Corrupt Practices Act of 1977, as amended, the U.S. Travel Act and the UK Bribery Act 2010, violations of which could lead to significant fines, penalties and collateral consequences for our company;

 

•

heightened risk of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of, or irregularities in, financial statements;

 

•

the uncertainty of protection for intellectual property rights in some countries;

 

35

---

Table of Contents

•

general economic and political conditions in these foreign markets;

 

•

foreign exchange controls that might prevent us from repatriating cash earned outside the United States;

 

•

political and economic instability in some countries; and

 

•

double taxation of our international earnings and potentially adverse tax consequences due to changes in the tax laws of the United States or the foreign jurisdictions in which we operate.

 

These and other factors could harm our ability to generate future international revenue and, consequently, materially impact our business, results of operations and financial condition.

 

We are exposed to fluctuations in currency exchange rates, which could negatively affect our financial condition and results of operations.

 

Our sales contracts are denominated in U.S. dollars, and therefore our revenue is not subject to foreign currency risk. However, a strengthening of the U.S. dollar could increase the real cost of our products, subscriptions and services to our customers outside of the United States, which could adversely affect our financial condition and results of operations. In addition, we are incurring an increasing portion of our operating expenses outside the United States. These expenses are denominated in foreign currencies and are subject to fluctuations due to changes in foreign currency exchange rates. We do not currently hedge against the risks associated with currency fluctuations but may do so in the future.

 

We are subject to governmental export and import controls that could subject us to liability or impair our ability to compete in international markets.

 

Our products are subject to U.S. export controls, specifically the Export Administration Regulations and economic sanctions enforced by the Office of Foreign Assets Control. We incorporate standard encryption algorithms into our products, which, along with the underlying technology, may be exported outside of the U.S. only with the required export authorizations, including by license, license exception or other appropriate government authorizations, which may require the filing of an encryption registration and classification request. Furthermore, U.S. export control laws and economic sanctions prohibit the shipment of certain products and services to countries, governments, and persons targeted by U.S. sanctions. While we have taken precautions to prevent our products and services from being exported in violation of these laws, in certain instances in the past we shipped our encryption products prior to obtaining the required export authorizations and/or submitting the required requests, including a classification request and request for an encryption registration number, resulting in an inadvertent violation of U.S. export control laws. As a result, in February 2013, we filed a Voluntary Self Disclosure with the U.S. Department of Commerce’s Bureau of Industry and Security, or BIS, concerning these potential violations. In June 2013, BIS notified us that it had completed its review of this matter and closed its review with the issuance of a warning letter. No monetary penalties were assessed. Even though we take precautions to ensure that our channel partners comply with all relevant regulations, any failure by our channel partners to comply with such regulations could have negative consequences, including reputational harm, government investigations and penalties.

 

In addition, various countries regulate the import of certain encryption technology, including through import permit and license requirements, and have enacted laws that could limit our ability to distribute our products or could limit our customers’ ability to implement our products in those countries. Changes in our products or changes in export and import regulations may create delays in the introduction of our products into international markets, prevent our customers with international operations from deploying our products globally or, in some cases, prevent the export or import of our products to certain countries, governments or persons altogether. Any change in export or import regulations, economic sanctions or related legislation, shift in the enforcement or scope of existing regulations, or change in the countries, governments, persons or technologies targeted by such

 

36

---

Table of Contents

regulations, could result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers with international operations. Any decreased use of our products or limitation on our ability to export or sell our products would likely adversely affect our business, financial condition and results of operations.

 

Our business is subject to the risks of earthquakes, fire, power outages, floods and other catastrophic events, and to interruption by man-made problems such as terrorism.

 

A significant natural disaster, such as an earthquake, a fire, a flood, or significant power outage could have a material adverse impact on our business, results of operations, and financial condition. Our corporate headquarters and servers hosting our cloud services are located in California, a region known for seismic activity. In addition, natural disasters could affect our supply chain, manufacturing vendors, or logistics providers’ ability to provide materials and perform services such as manufacturing products or assisting with shipments on a timely basis. In the event that our or our service providers’ information technology systems or manufacturing or logistics abilities are hindered by any of the events discussed above, shipments could be delayed, resulting in missed financial targets, such as revenue and shipment targets, for a particular quarter. In addition, acts of terrorism and other geo-political unrest could cause disruptions in our business or the business of our supply chain, manufacturers, logistics providers, partners, or customers or the economy as a whole. Any disruption in the business of our supply chain, manufacturers, logistics providers, partners or end-customers that impacts sales at the end of a fiscal quarter could have a significant adverse impact on our financial results. All of the aforementioned risks may be further increased if the disaster recovery plans for us and our suppliers prove to be inadequate. To the extent that any of the above should result in delays or cancellations of customer orders, or the delay in the manufacture, deployment or shipment of our products, our business, financial condition and results of operations would be adversely affected.

 

If we fail to comply with environmental requirements, our business, financial condition, results of operations and reputation could be adversely affected.

 

We are subject to various environmental laws and regulations including laws governing the hazardous material content of our products and laws relating to the collection and recycling of electrical and electronic equipment. Examples of these laws and regulations include the European Union, or EU, Restrictions on the Use of certain Hazardous Substances in Electronic Equipment Directive and the EU Waste Electrical and Electronic Equipment Directive as well as the implementing legislation of the EU member states. Similar laws and regulations have been passed or are pending in China, South Korea and Japan and may be enacted in other regions, including in the United States, and we are, or may in the future be, subject to these laws and regulations.

 

Our failure to comply with past, present, and future laws could result in reduced sales of our products, substantial product inventory write-offs, reputational damage, penalties, and other sanctions, any of which could harm our business and financial condition. We also expect that our products will be affected by new environmental laws and regulations on an ongoing basis. To date, our expenditures for environmental compliance have not had a material impact on our results of operations or cash flows, and although we cannot predict the future impact of such laws or regulations, they will likely result in additional costs and may increase penalties associated with violations or require us to change the content of our products or how they are manufactured, which could have a material adverse effect on our business, results of operations and financial condition.

 

The enactment of legislation implementing changes in the U.S. taxation of international business activities or the adoption of other tax reform policies could materially impact our financial position and results of operations.

 

Recent changes to U.S. tax laws, including limitations on the ability of taxpayers to claim and utilize foreign tax credits and the deferral of certain tax deductions until earnings outside of the United States are repatriated to the United States, as well as changes to U.S. tax laws that may be enacted in the future, could impact the tax

 

37

---

Table of Contents

treatment of our foreign earnings. Due to expansion of our international business activities, any changes in the U.S. taxation of such activities may increase our worldwide effective tax rate and adversely affect our financial condition and operating results.

 

If we do not achieve increased tax benefits as a result of our new corporate structure, our operating results and financial condition may be negatively impacted.

 

We generally conduct our international operations through wholly-owned subsidiaries and report our taxable income in various jurisdictions worldwide based upon our business operations in those jurisdictions. We recently completed the reorganization of our corporate structure and intercompany relationships to more closely align our corporate organization with the expansion of our international business activities. Although we anticipate achieving a reduction in our overall effective tax rate in the future as a result of this new corporate structure, we may not realize any benefits. Our intercompany relationships are subject to complex transfer pricing regulations administered by taxing authorities in various jurisdictions. The relevant taxing authorities may disagree with our determinations as to the income and expenses attributable to specific jurisdictions. If such a disagreement were to occur, and our position were not sustained, we could be required to pay additional taxes, interest and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows and lower overall profitability of our operations. In addition, if the intended tax treatment of our new corporate structure is not accepted by the applicable taxing authorities, changes in tax law negatively impact the structure or we do not operate our business consistent with the structure and applicable tax laws and regulations, we may fail to achieve any tax advantages as a result of the new corporate structure, and our future operating results and financial condition may be negatively impacted.

 

We could be subject to additional tax liabilities.

 

We are subject to U.S. federal, state, local and sales taxes in the United States and foreign income taxes, withholding taxes and transaction taxes in numerous foreign jurisdictions. Significant judgment is required in evaluating our tax positions and our worldwide provision for taxes. During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination is uncertain. In addition, our tax obligations and effective tax rates could be adversely affected by changes in the relevant tax, accounting and other laws, regulations, principles and interpretations, including those relating to income tax nexus, by recognizing tax losses or lower than anticipated earnings in jurisdictions where we have lower statutory rates and higher than anticipated earnings in jurisdictions where we have higher statutory rates, by changes in foreign currency exchange rates, or by changes in the valuation of our deferred tax assets and liabilities. We may be audited in various jurisdictions, and such jurisdictions may assess additional taxes, sales taxes and value-added taxes against us. Although we believe our tax estimates are reasonable, the final determination of any tax audits or litigation could be materially different from our historical tax provisions and accruals, which could have a material adverse effect on our operating results or cash flows in the period or periods for which a determination is made.

 

Our ability to use our net operating losses to offset future taxable income may be subject to certain limitations.

 

In general, under Section 382 of the Internal Revenue Code of 1986, as amended, or the Code, a corporation that undergoes an “ownership change” is subject to limitations on its ability to utilize its pre-change net operating losses, or NOLs, to offset future taxable income. Our existing NOLs may be subject to limitations arising from previous ownership changes. Future changes in our stock ownership, some of which are outside of our control, could result in an ownership change under Section 382 of the Code and adversely affect our ability to utilize our NOLs in the future. Furthermore, our ability to utilize NOLs of companies that we may acquire in the future may be subject to limitations. There is also a risk that due to regulatory changes, such as suspensions on the use of NOLs, or other unforeseen reasons, our existing NOLs could expire or otherwise be unavailable to offset future income tax liabilities. For these reasons, we may not be able to utilize a material portion of the NOLs reflected on our balance sheet, even if we attain profitability.

 

38

---

Table of Contents

Risks Related to this Offering and Ownership of Our Common Stock

 

We may fail to meet our publicly announced guidance or other expectations about our business and future operating results, which would cause our stock price to decline.

 

We have provided and may continue to provide guidance about our business and future operating results. In developing this guidance, our management must make certain assumptions and judgments about our future performance. Our business results may vary significantly from such guidance due to a number of factors, many of which are outside of our control and which could adversely affect our operations and operating results. Furthermore, if our publicly announced guidance of future operating results fails to meet expectations of securities analysts, investors or other interested parties, the price of our common stock would decline.

 

The price of our common stock has been and may continue to be volatile, and the value of your investment could decline.

 

The trading price of our common stock has been volatile since our initial public offering and is likely to continue to be volatile. Since the date of our initial public offering, the closing price of our common stock has ranged from $33.36 to $43.69 through December 31, 2013, and the last reported sale price on February 28, 2014 was $85.64. The trading price of our common stock may fluctuate widely in response to various factors, some of which are beyond our control. These factors include:

 

•

announcements of new products, services or technologies, commercial relationships, acquisitions or other events by us or our competitors;

 

•

changes in how customers perceive the effectiveness of our platform in protecting against advanced cyber attacks or other reputational harm;

 

•

publicity concerning cyber attacks in general or high profile cyber attacks against specific organizations;

 

•

price and volume fluctuations in the overall stock market from time to time;

 

•

significant volatility in the market price and trading volume of technology companies in general and of companies in the IT security industry in particular;

 

•

fluctuations in the trading volume of our shares or the size of our public float;

 

•

actual or anticipated changes or fluctuations in our results of operations;

 

•

whether our results of operations and, in particular, our revenue growth rates meet the expectations of securities analysts or investors;

 

•

actual or anticipated changes in the expectations of investors or securities analysts, whether as a result of our forward-looking statements, our failure to meet such expectations or otherwise;

 

•

litigation involving us, our industry, or both;

 

•

regulatory developments in the United States, foreign countries or both;

 

•

general economic conditions and trends;

 

•

major catastrophic events;

 

•

sales of large blocks of our common stock; or

 

•

departures of key personnel.

 

In addition, if the market for technology stocks or the stock market in general experiences a loss of investor confidence, the trading price of our common stock could decline for reasons unrelated to our business, results of operations or financial condition. The trading price of our common stock might also decline in reaction to events

 

39

---

Table of Contents

that affect other companies in our industry even if these events do not directly affect us. In the past, following periods of volatility in the market price of a company’s securities, securities class action litigation has often been brought against that company. If our stock price is volatile, we may become the target of securities litigation. Securities litigation could result in substantial costs and divert our management’s attention and resources from our business. This could have a material adverse effect on our business, results of operations and financial condition.

 

Sales of substantial amounts of our common stock in the public markets, or the perception that such sales might occur, could reduce the price that our common stock might otherwise attain and may dilute your voting power and your ownership interest in us.

 

Sales of a substantial number of shares of our common stock in the public market after this offering, or the perception that such sales could occur, could adversely affect the market price of our common stock and may make it more difficult for you to sell your common stock at a time and price that you deem appropriate. Based on the total number of outstanding shares of our common stock as of December 31, 2013, upon completion of this offering, we will have 144,136,573 shares of common stock outstanding, assuming no exercise of our outstanding options or vesting of our outstanding restricted stock units after December 31, 2013, other than 796,846 shares to be sold in this offering by certain selling stockholders upon the exercise of vested stock options and the vesting of restricted stock units.

 

Upon completion of this offering, all 17,450,000 shares of common stock sold in our initial public offering and all 5,582,215 shares of common stock sold in this offering by us and any shares sold upon the exercise of the underwriters’ over-allotment option will be freely tradable in the public market without restriction or further registration under the Securities Act, unless these shares are held by “affiliates,” as that term is defined in Rule 144 under the Securities Act. In addition, Morgan Stanley & Co. LLC and Goldman, Sachs & Co., representatives of the underwriters for our initial public offering, have consented to the release of the lock-up restrictions with respect to 8,417,785 shares of common stock to be sold in this offering by the selling stockholders, including certain of our directors, executive officers and employees, who executed lock-up agreements with the underwriters that are scheduled to expire on March 19, 2014. The release will take effect on the pricing of this offering.

 

As a result of the lock-up agreements described in “Shares Eligible for Future Sale” and “Underwriters,” the remaining shares of our common stock will be available for sale in the public market at various times as follows, subject to the provisions of Rules 144 and 701 under the Securities Act and, where applicable, compliance with our insider trading policy:

 

•

14,664,639 shares will be eligible for sale in the public market on March 19, 2014 upon the expiration of lock-up agreements entered into in connection with our initial public offering;

 

•

95,610,568 shares will be eligible for sale in the public market upon the expiration of the lock-up agreements entered into in connection with this offering, assuming the prior effectiveness of the resale registration statement for former stockholders of Mandiant (as described under “Shares Eligible for Future Sale—Resale Rights for Former Stockholders of Mandiant”); and

 

•

1,927 shares will be eligible for sale in the public market on June 30, 2014.

 

The remaining restricted securities will continue to be held in escrow subject to the terms and conditions of the merger agreement governing our acquisition of Mandiant.

 

In addition, holders of up to approximately 84,310,480 shares of our common stock, or 58.5% of our total outstanding common stock, based on shares outstanding as of December 31, 2013, will be entitled to rights with respect to registration of these shares under the Securities Act pursuant to an investors’ rights agreement. If these holders of our common stock, by exercising their registration rights, sell a large number of shares, they could

 

40

---

Table of Contents

adversely affect the market price for our common stock. If we file a registration statement for the purpose of selling additional shares of common stock to raise capital and are required to include shares held by these holders pursuant to the exercise of their registration rights, our ability to raise capital may be impaired. Furthermore, all of our executive officers and certain of our directors have adopted, and other directors may in the future adopt, written plans, known as “Rule 10b5-1 Plans,” under which they have contracted, or may in the future contract, with a broker to sell shares of our common stock on a periodic basis to diversify their assets and investments. Sales of substantial amounts of our common stock in the public markets following the release of the lock-ups or otherwise, including, but not limited to, sales made by our executive officers and directors pursuant to Rule 10b5-1 Plans, or the perception that these sales could occur, could cause the market price of our common stock to decline.

 

The issuance of additional stock in connection with financings, acquisitions, investments, our stock incentive plans or otherwise will dilute all other stockholders.

 

Our amended and restated certificate of incorporation authorizes us to issue up to 1,000,000,000 shares of common stock and up to 100,000,000 shares of preferred stock with such rights and preferences as may be determined by our board of directors. Subject to compliance with applicable rules and regulations, we may issue shares of common stock or securities convertible into our common stock from time to time in connection with a financing, acquisition, investment, our stock incentive plans or otherwise. For example, we recently issued approximately 16.9 million shares of common stock and assumed options to purchase approximately 4.6 million shares of our common stock in connection with our acquisition of Mandiant. Any future issuances could result in substantial dilution to our existing stockholders and cause the trading price of our common stock to decline.

 

Insiders have substantial control over us, which could limit your ability to influence the outcome of key transactions, including a change of control.

 

Our directors, executive officers and each of our stockholders who, as of January 31, 2014, owned greater than 5% of our outstanding common stock will beneficially own approximately 64.5% of the total outstanding shares of our common stock after the completion of this offering. As a result, these stockholders, if acting together, will be able to influence or control matters requiring approval by our stockholders, including the election of directors and the approval of mergers, acquisitions or other extraordinary transactions. They may also have interests that differ from yours and may vote in a way with which you disagree and which may be adverse to your interests. This concentration of ownership may have the effect of delaying, preventing or deterring a change of control of our company, could deprive our stockholders of an opportunity to receive a premium for their common stock as part of a sale of our company and might ultimately affect the market price of our common stock.

 

We have broad discretion in the use of the net proceeds that we receive in this offering.

 

Our management will have broad discretion over the specific use of the net proceeds that we receive in this offering and might not be able to obtain a significant return, if any, on investment of these net proceeds. Investors in this offering will need to rely upon the judgment of our management with respect to the use of proceeds. If we do not use the net proceeds that we receive in this offering effectively, our business, results of operations and financial condition could be harmed.

 

We do not intend to pay dividends for the foreseeable future.

 

We have never declared or paid any dividends on our common stock. We intend to retain any earnings to finance the operation and expansion of our business, and we do not anticipate paying any cash dividends in the future. As a result, you may only receive a return on your investment in our common stock if the market price of our common stock increases.

 

41

---

Table of Contents

The requirements of being a public company may strain our resources, divert management’s attention and affect our ability to attract and retain qualified board members.

 

As a public company, we are subject to the reporting requirements of the Securities Exchange Act of 1934, as amended, or the Exchange Act, the listing requirements of the NASDAQ Stock Market and other applicable securities rules and regulations. Compliance with these rules and regulations has increased and will continue to increase our legal and financial compliance costs, has made and will continue to make some activities more difficult, time-consuming or costly, and has increased and will continue to increase demand on our systems and resources. Among other things, the Exchange Act requires that we file annual, quarterly and current reports with respect to our business and results of operations and maintain effective disclosure controls and procedures and internal control over financial reporting. In order to maintain and, if required, improve our disclosure controls and procedures and internal control over financial reporting to meet this standard, significant resources and management oversight may be required. As a result, management’s attention may be diverted from other business concerns, which could harm our business and results of operations. Although we have already hired additional employees to comply with these requirements, we may need to hire even more employees in the future, which will increase our costs and expenses.

 

In addition, changing laws, regulations and standards relating to corporate governance and public disclosure are creating uncertainty for public companies, increasing legal and financial compliance costs, and making some activities more time consuming. These laws, regulations and standards are subject to varying interpretations, in many cases due to their lack of specificity, and as a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies. This could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices. We intend to invest resources to comply with evolving laws, regulations, and standards, and this investment will increase our general and administrative expense and a diversion of management’s time and attention from revenue-generating activities to compliance activities. If our efforts to comply with new laws, regulations, and standards are unsuccessful, regulatory authorities may initiate legal proceedings against us and our business may be harmed.

 

We also expect that being a public company and these new rules and regulations will make it more expensive for us to obtain and maintain director and officer liability insurance, and in the future, we may be required to accept reduced coverage or incur substantially higher costs to obtain coverage. These factors could also make it more difficult for us to attract and retain qualified executive officers and members of our board of directors, particularly to serve on our audit committee and compensation committee.

 

In addition, as a result of our disclosure obligations as a public company, we have reduced strategic flexibility and are under pressure to focus on short-term results, which may adversely impact our ability to achieve long-term profitability.

 

We are an “emerging growth company,” and we cannot be certain if the reduced disclosure requirements applicable to emerging growth companies will make our common stock less attractive to investors.

 

For so long as we remain an “emerging growth company,” as defined in the Jumpstart Our Business Startups Act, or the JOBS Act, we may take advantage of certain exemptions from various requirements that are applicable to public companies that are not “emerging growth companies,” including not being required to comply with the independent auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act, reduced disclosure obligations regarding executive compensation in our periodic reports and proxy statements, and exemptions from the requirements of holding a nonbinding advisory vote on executive compensation and stockholder approval of any golden parachute payments not previously approved. We will remain an “emerging growth company” until the earliest of (i) the last day of the fiscal year following the fifth anniversary of the completion of our IPO, (ii) the last day of the first fiscal year in which our annual gross revenue is $1 billion or more, (iii) the date on which we have, during the previous rolling three-year period, issued more than $1 billion in non-convertible debt securities or (iv) the date on which we are deemed to be a “large accelerated filer” as

 

42

---

Table of Contents

defined in the Exchange Act. We cannot predict if investors will find our common stock less attractive because we may rely on these exemptions. If some investors find our common stock less attractive as a result, there may be a less active trading market for our common stock, and our stock price may be more volatile and may decline.

 

As a public company, we are obligated to implement and maintain proper and effective internal control over financial reporting. We may not complete our analysis of our internal control over financial reporting in a timely manner, or these internal controls may not be determined to be effective, which may adversely affect investor confidence in our company and, as a result, the value of our common stock.

 

As a public company, we are required, pursuant to the Exchange Act, to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting for the fiscal year ending December 31, 2014. This assessment will need to include disclosure of any material weaknesses identified by our management in our internal control over financial reporting.

 

We are currently evaluating our internal controls, identifying and remediating deficiencies in those internal controls and documenting the results of our evaluation, testing and remediation. We may not be able to complete our evaluation, testing and any required remediation in a timely fashion. During the evaluation and testing process, if we identify one or more material weaknesses in our internal control over financial reporting that we are unable to remediate before the end of the same fiscal year in which the material weakness is identified, we will be unable to assert that our internal controls are effective. If we are unable to assert that our internal control over financial reporting is effective, or if our auditors, when required, are unable to attest to management’s report on the effectiveness of our internal controls, we could lose investor confidence in the accuracy and completeness of our financial reports, which would cause the price of our common stock to decline.

 

As a public company, we are required to disclose material changes made in our internal control and procedures on a quarterly basis. Once we are no longer an “emerging growth company,” as defined in the JOBS Act, our independent registered public accounting firm will be required to formally attest to the effectiveness of our internal control over financial reporting pursuant to Section 404 of the Sarbanes-Oxley Act. To comply with the requirements of being a public company, we may need to undertake various actions, such as implementing new internal controls and procedures and hiring accounting or internal audit staff.

 

If securities or industry analysts do not publish research or reports about our business, or publish inaccurate or unfavorable research reports about our business, our share price and trading volume could decline.

 

The trading market for our common stock, to some extent, depends on the research and reports that securities or industry analysts publish about us or our business. We do not have any control over these analysts. If one or more of the analysts who cover us should downgrade our shares or change their opinion of our shares, industry sector or products, our share price would likely decline. If one or more of these analysts ceases coverage of our company or fails to regularly publish reports on us, we could lose visibility in the financial markets, which could cause our share price or trading volume to decline.

 

Our charter documents and Delaware law could discourage takeover attempts and lead to management entrenchment.

 

Our amended and restated certificate of incorporation and amended and restated bylaws contain provisions that could delay or prevent a change in control of our company. These provisions could also make it difficult for stockholders to elect directors who are not nominated by the current members of our board of directors or take other corporate actions, including effecting changes in our management. These provisions include:

 

•

a classified board of directors with three-year staggered terms, which could delay the ability of stockholders to change the membership of a majority of our board of directors;

 

43

---

Table of Contents

•

the ability of our board of directors to issue shares of preferred stock and to determine the price and other terms of those shares, including preferences and voting rights, without stockholder approval, which could be used to significantly dilute the ownership of a hostile acquiror;

 

•

the exclusive right of our board of directors to elect a director to fill a vacancy created by the expansion of our board of directors or the resignation, death or removal of a director, which prevents stockholders from being able to fill vacancies on our board of directors;

 

•

a prohibition on stockholder action by written consent, which forces stockholder action to be taken at an annual or special meeting of our stockholders;

 

•

the requirement that a special meeting of stockholders may be called only by our board of directors, the chairperson of our board of directors, our chief executive officer or our president (in the absence of a chief executive officer), which could delay the ability of our stockholders to force consideration of a proposal or to take action, including the removal of directors;

 

•

the requirement for the affirmative vote of holders of at least 66 2/3% of the voting power of all of the then outstanding shares of the voting stock, voting together as a single class, to amend the provisions of our amended and restated certificate of incorporation relating to the management of our business (including our classified board structure) or certain provisions of our amended and restated bylaws, which may inhibit the ability of an acquiror to effect such amendments to facilitate an unsolicited takeover attempt;

 

•

the ability of our board of directors to amend the bylaws, which may allow our board of directors to take additional actions to prevent an unsolicited takeover and inhibit the ability of an acquiror to amend the bylaws to facilitate an unsolicited takeover attempt; and

 

•

advance notice procedures with which stockholders must comply to nominate candidates to our board of directors or to propose matters to be acted upon at a stockholders’ meeting, which may discourage or deter a potential acquiror from conducting a solicitation of proxies to elect the acquiror’s own slate of directors or otherwise attempting to obtain control of us.

 

In addition, as a Delaware corporation, we are subject to Section 203 of the Delaware General Corporation Law, which may prohibit large stockholders, in particular those owning 15% or more of our outstanding voting stock, from merging or combining with us for a specified period of time.

 

44

---

Table of Contents

SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS

 

This prospectus, including the sections entitled “Prospectus Summary,” “Risk Factors,” “Use of Proceeds,” “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” and “Business” contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended. The words “believe,” “may,” “will,” “potentially,” “estimate,” “continue,” “anticipate,” “intend,” “could,” “would,” “project,” “plan,” “expect,” the negative and plural forms of these words and similar expressions that convey uncertainty of future events or outcomes are intended to identify forward-looking statements. These forward-looking statements include, but are not limited to, statements concerning the following:

 

•

the evolution of the threat landscape facing our customers and prospects;

 

•

our ability to educate the market regarding the advantages of our virtual machine-based security solution;

 

•

our ability to maintain an adequate rate of revenue growth;

 

•

our future financial and operating results;

 

•

our business plan and our ability to effectively manage our growth and associated investments;

 

•

beliefs and objectives for future operations;

 

•

our ability to expand our leadership position in advanced network security;

 

•

our ability to attract and retain customers;

 

•

our ability to further penetrate our existing customer base;

 

•

our expectations concerning renewal rates for subscriptions and services by existing customers;

 

•

our ability to maintain our competitive technological advantages against new entrants in our industry;

 

•

our ability to timely and effectively scale and adapt our existing technology;

 

•

our ability to innovate new products and bring them to market in a timely manner;

 

•

our ability to maintain, protect, and enhance our brand and intellectual property;

 

•

our ability to expand internationally;

 

•

the reorganization of our corporate structure and intercompany relationships and our ability to improve our overall effective tax rate;

 

•

the effects of increased competition in our market and our ability to compete effectively;

 

•

cost of revenue, including changes in costs associated with production, manufacturing and customer support;

 

•

operating expenses, including changes in research and development, sales and marketing, and general and administrative expenses;

 

•

anticipated income tax rates;

 

•

sufficiency of cash to meet cash needs for at least the next 12 months;

 

•

our ability to maintain our good standing with the United States and international governments and capture new contracts;

 

•

costs associated with defending intellectual property infringement and other claims, such as those claims discussed in “Business—Legal Proceedings”;

 

•

our expectations concerning relationships with third parties, including channel partners and logistics providers;

 

45

---

Table of Contents

•

the release of new products, including FireEye Mobile Threat Prevention, our recently released SaaS-based mobile platform;

 

•

economic and industry trends or trend analysis;

 

•

the attraction and retention of qualified employees and key personnel;

 

•

future acquisitions of or investments in complementary companies, products, subscriptions or technologies; and

 

•

the effects of seasonal trends on our results of operations.

 

These forward-looking statements are subject to a number of risks, uncertainties, and assumptions, including those described in “Risk Factors” and elsewhere in this prospectus. Moreover, we operate in a very competitive and rapidly changing environment, and new risks emerge from time to time. It is not possible for our management to predict all risks, nor can we assess the impact of all factors on our business or the extent to which any factor, or combination of factors, may cause actual results to differ materially from those contained in any forward-looking statements we may make. In light of these risks, uncertainties, and assumptions, the forward-looking events and circumstances discussed in this prospectus may not occur, or unanticipated events or circumstances that we did not foresee may materialize, either of which could cause actual results to differ materially and adversely from those anticipated or implied in our forward-looking statements.

 

You should not rely upon forward-looking statements as predictions of future events. Although we believe that the expectations reflected in our forward-looking statements are reasonable, we cannot guarantee that the future results, levels of activity, performance or events and circumstances described in the forward-looking statements will be achieved or occur. Moreover, neither we nor any other person assumes responsibility for the accuracy and completeness of the forward-looking statements. We undertake no obligation to update publicly any forward-looking statements for any reason after the date of this prospectus to conform these statements to actual results or to changes in our expectations, except as required by law.

 

You should read this prospectus and the documents that we reference in this prospectus and have filed with the SEC as exhibits to the registration statement of which this prospectus is a part with the understanding that our actual future results, levels of activity, performance and events and circumstances may be materially different from what we expect.

 

46

---

Table of Contents

MARKET AND INDUSTRY DATA

 

Unless otherwise indicated, information contained in this prospectus concerning our industry and the markets in which we operate, including our general expectations and market position, market opportunity, and market size, is based on information from various sources, including Gartner, Inc., or Gartner, and International Data Corporation, or IDC, on assumptions we have made based on such data and other similar sources and on our knowledge of the markets for our products, subscriptions and services. This information involves a number of assumptions and limitations, and you are cautioned not to give undue weight to such estimates. In addition, projections, assumptions and estimates of our future performance and the future performance of the industry in which we operate is necessarily subject to a high degree of uncertainty and risk due to a variety of factors, including those described in “Risk Factors” and elsewhere in this prospectus. These and other factors could cause actual results to differ materially from the estimates made by the independent parties and by us.

 

The Gartner Report described herein represents data, research opinion or viewpoints published, as part of a syndicated subscription service, by Gartner, and is not a representation of fact. The Gartner Report speaks as of its original publication date (and not as of the date of this prospectus), and the opinions expressed in the Gartner Report are subject to change without notice.

 

In certain instances, the sources of the market and industry data contained in this prospectus are identified by superscript notations. The sources of these data are provided below:

 

(1)

Gartner, Prevention is Futile in 2020: Protect Information Via Pervasive Monitoring and Collective Intelligence, Gartner Published: May 30, 2013.

 

(2)

IDC, Worldwide Network Security 2013–2017 Forecast and 2012 Vendor Shares, #241926, June 2012, IDC, Worldwide Web Security 2013–2017 Forecast and 2012 Vendor Shares, #242033, July 2012, IDC, Worldwide Messaging Security 2013–2017 Forecast and 2012 Vendor Shares, #24225, June 2012 and IDC, Worldwide Endpoint Security 2013–2017 Forecast and 2012 Vendor Shares, #242618, July 2012.

 

47

---

Table of Contents

USE OF PROCEEDS

 

We estimate that the net proceeds from our sale of 5,582,215 shares of common stock in this offering at the assumed public offering price of $85.64 per share, the closing price of our common stock on The NASDAQ Global Select Market on February 28, 2014, after deducting underwriting discounts and commissions and estimated offering expenses payable by us, will be approximately $461.8 million, or $636.3 million if the underwriters exercise their over-allotment option in full. We will not receive any proceeds from the sale of shares of common stock by the selling stockholders.

 

The principal purposes of this offering are to increase our capitalization and financial flexibility, obtain additional capital, facilitate an orderly distribution of shares for the selling stockholders in this offering and increase our public float. We intend to use the net proceeds received from this offering primarily for general corporate purposes, including headcount expansion, working capital, sales and marketing activities, product development, general and administrative matters, and capital expenditures. We may also use a portion of the net proceeds for the acquisition of, or investment in, technologies, solutions or businesses that complement our business, although we have no present commitments to complete any such transactions at this time. We will have broad discretion over the uses of the net proceeds of this offering. Pending these uses, we intend to invest the net proceeds from this offering in short-term, investment-grade interest-bearing securities such as money market accounts, certificates of deposit, commercial paper, and guaranteed obligations of the U.S. government.

 

MARKET PRICE OF COMMON STOCK

 

Our common stock has been listed on The NASDAQ Global Select Market under the symbol “FEYE” since September 20, 2013. Prior to that date, there was no public trading market for our common stock. The following table sets forth for the periods indicated the high and low sales prices per share of our common stock as reported on The NASDAQ Global Select Market:

 

		High				Low
Year Ended December 31, 2013
Third Quarter (from September 20, 2013)		$	44.89			$	35.25
Fourth Quarter		$	44.55			$	33.30
Year Ending December 31, 2014
First Quarter (through February 28, 2014)		$	88.00			$	40.41

 

On February 28, 2014, the closing price of our common stock on The NASDAQ Global Select Market was $85.64 per share. As of December 31, 2013, we had 352 holders of record of our common stock. The actual number of stockholders is greater than this number of record holders and includes stockholders who are beneficial owners but whose shares are held in street name by brokers and other nominees. This number of holders of record also does not include stockholders whose shares may be held in trust by other entities.

 

DIVIDEND POLICY

 

We have never declared or paid cash dividends on our common stock. We currently intend to retain all available funds and any future earnings for use in the operation of our business and do not anticipate paying any dividends on our common stock in the foreseeable future, if at all. Any future determination to declare dividends will be made at the discretion of our board of directors and will depend on our financial condition, operating results, capital requirements, general business conditions and other factors that our board of directors may deem relevant.

 

48

---

Table of Contents

CAPITALIZATION

 

The following table sets forth our cash and cash equivalents and capitalization as of December 31, 2013 on:

 

•

an actual basis; and

 

•

a pro forma basis, giving effect to (i) the issuance and sale by us of 5,582,215 shares of common stock in this offering, at an assumed public offering price of $85.64 per share, the closing price of our common stock on The NASDAQ Global Select Market on February 28, 2014, after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us, and (ii) the issuance of 796,846 shares of common stock to be acquired by certain selling stockholders upon the exercise of stock options or the vesting of restricted stock units in order to sell such shares in this offering.

 

The pro forma information set forth in the table below is illustrative only and will be adjusted based on the actual public offering price and other terms of this offering determined at pricing. You should read this table together with “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our audited consolidated financial statements and related notes included elsewhere in this prospectus.

 

		December 31, 2013
		Actual				Pro Forma(1)
Cash and cash equivalents		$	173,918			$	637,381
Total debt, current and non-current portion			—				—
Stockholders’ equity:
Preferred stock, par value of $0.0001 per share; 100,000,000 shares authorized, no shares issued and outstanding, actual; 100,000,000 shares authorized, no shares issued and outstanding, pro forma			—				—
Common stock, par value of $0.0001 per share; 1,000,000,000 shares authorized, 137,757,512 issued and outstanding, actual; 1,000,000,000 shares authorized, 144,136,573 issued and outstanding, pro forma			14				14
Additional paid-in capital			1,271,590				1,735,053
Accumulated deficit			(223,502	)			(223,502	)
Total stockholders’ equity			1,048,102				1,511,565
Total capitalization		$	1,048,102			$	1,511,565

 

(1)

Each $1.00 increase (decrease) in the assumed public offering price of $85.64 per share, the closing price of our common stock on The NASDAQ Global Select Market on February 28, 2014, would increase (decrease) our pro forma cash and cash equivalents, additional paid-in capital, total stockholders’ equity and total capitalization by approximately $5.4 million, assuming that the number of shares offered by us, as set forth on the cover page of this prospectus, remains the same and after deducting the estimated underwriting discounts and commissions and estimated offering expenses payable by us.

 

The number of shares of our common stock to be outstanding after this offering is based on 138,554,358 shares of our common stock outstanding as of December 31, 2013, after giving effect to the assumed issuance of 796,846 shares of common stock to be acquired by certain selling stockholders upon the exercise of outstanding stock options and the vesting of outstanding restricted stock units in order to sell such shares in this offering, and excludes:

 

•

26,657,087 shares of common stock issuable upon the exercise of stock options outstanding as of December 31, 2013, with a weighted-average exercise price of $5.49 per share;

 

49

---

Table of Contents

•

605,100 shares of common stock issuable upon the exercise of stock options granted after December 31, 2013, with a weighted-average exercise price of $73.94 per share;

 

•

1,757,031 shares of common stock issuable upon the vesting of restricted stock units outstanding as of December 31, 2013;

 

•

835,011 shares of common stock issuable upon the vesting of restricted stock units granted after December 31, 2013;

 

•

311,747 shares of common stock issuable upon the exercise of warrants outstanding as of December 31, 2013, with a weighted-average exercise price of $0.72 per share;

 

•

11,015,257 shares of common stock reserved for future grants as of December 31, 2013 under our 2013 Equity Incentive Plan (which reserve includes 1,440,111 shares of common stock issuable upon the exercise of stock options and the vesting of restricted stock units granted after December 31, 2013, as described in the bullets above), plus an additional 6,887,875 shares of common stock that became available for future grants under our 2013 Equity Incentive Plan as of January 1, 2014 pursuant to provisions thereof that automatically increase the share reserve under such plan each year, as more fully described in “Executive Compensation—Employee Benefit and Stock Plans”;

 

•

2,500,000 shares of common stock reserved for future issuance as of December 31, 2013 under our 2013 Employee Stock Purchase Plan, plus an additional 1,377,575 shares of common stock that became available for future grants under our 2013 Employee Stock Purchase Plan as of January 1, 2014 pursuant to provisions thereof that automatically increase the share reserve under such plan each year, as more fully described in “Executive Compensation—Employee Benefit and Stock Plans”; and

 

•

any shares of common stock that become available subsequent to this offering under our 2013 Equity Incentive Plan and 2013 Employee Stock Purchase Plan pursuant to provisions thereof that automatically increase the share reserves under such plans each year, as more fully described in “Executive Compensation—Employee Benefit and Stock Plans.”

 

50

---

Table of Contents

DILUTION

 

If you invest in our common stock, your interest will be diluted to the extent of the difference between the amount per share paid by purchasers of shares of common stock in this offering and the pro forma net tangible book value per share of common stock immediately after the completion of this offering.

 

As of December 31, 2013, our historical net tangible book value was approximately $60.4 million, or $0.44 per share of common stock. Our net tangible book value per share represents the amount of our total tangible assets reduced by the amount of our total liabilities and divided by the total number of shares of our common stock outstanding as of December 31, 2013.

 

After giving effect to (i) the issuance and sale in this offering of 5,582,215 shares of our common stock, at an assumed public offering price of $85.64 per share, the closing price of our common stock on The NASDAQ Global Select Market on February 28, 2014, after deducting underwriting discounts and commissions and estimated offering expenses payable by us, and (ii) the issuance of 796,846 shares of common stock to be acquired by certain selling stockholders upon the exercise of stock options or the vesting of restricted stock units in order to sell such shares in this offering, our pro forma net tangible book value as of December 31, 2013 would have been approximately $523.9 million, or $3.63 per share of our common stock. This represents an immediate increase in pro forma net tangible book value of $3.19 per share to our existing stockholders and an immediate dilution of $82.01 per share to investors purchasing shares in this offering.

 

The following table illustrates this dilution:⁽¹⁾

 

Assumed public offering price per share						$	85.64
Net tangible book value per share as of December 31, 2013, before giving effect to this offering		$	0.44
Increase per share attributable to this offering			3.19
Pro forma net tangible book value, as adjusted to give effect to this offering							3.63
Dilution in pro forma net tangible book value per share to new investors purchasing shares in this offering						$	82.01

 

(1)

Each $1.00 increase (decrease) in the assumed public offering price of $85.64 per share, the closing price of our common stock on The NASDAQ Global Select Market on February 28, 2014, would increase (decrease) (i) our pro forma net tangible book value by $0.04 per share, (ii) the increase per share attributable to this offering by $0.04, and (iii) the dilution in pro forma net tangible book value per share to new investors purchasing shares in this offering by $0.96, assuming that the number of shares offered by us, as set forth on the cover page of this prospectus, remains the same and after deducting the estimated underwriting discounts and commissions and estimated offering expenses payable by us.

 

If the underwriters exercise their over-allotment option in full, the pro forma net tangible book value per share of our common stock after giving effect to this offering would be $4.78 per share, and the dilution in net tangible book value per share to investors in this offering would be $80.86 per share.

 

The following table summarizes, on a pro forma basis as of December 31, 2013 after giving effect to the completion of this offering at an assumed public offering price of $85.64 per share, the closing price of our common stock on The NASDAQ Global Select Market on February 28, 2014, the difference between existing stockholders and new investors with respect to the number of shares of common stock purchased from us, the total consideration paid to us, and the average price per share paid, before deducting underwriting discounts and commissions and estimated offering expenses:

 

		Shares Purchased								Total Consideration								Average Price Per Share
		Number				Percent				Amount				Percent
Existing stockholders			138,554,358				96.1	%		$	1,273,263,868				72.7	%		$	9.19
New public investors			5,582,215				3.9				478,060,893				27.3				85.64
Total			144,136,573				100.0	%		$	1,751,324,760				100.0	%

 

51

---

Table of Contents

To the extent that any of our outstanding warrants or outstanding stock options are exercised, outstanding restricted stock units vest or additional warrants, stock options, restricted stock units or shares of common stock are issued in the future, investors will experience further dilution.

 

Except as otherwise indicated, the above discussion and tables assume no exercise of the underwriters’ over-allotment option. If the underwriters exercise their over-allotment option in full, our existing stockholders would own 94.7% and our new investors would own 5.3% of the total number of shares of our common stock outstanding upon the completion of this offering.

 

The number of shares of our common stock to be outstanding after this offering is based on 138,554,358 shares of our common stock outstanding as of December 31, 2013, after giving effect to the assumed issuance of 796,846 shares of common stock to be acquired by certain selling stockholders upon the exercise of outstanding stock options and the vesting of outstanding restricted stock units in order to sell such shares in this offering, and excludes:

 

•

26,657,087 shares of common stock issuable upon the exercise of stock options outstanding as of December 31, 2013, with a weighted-average exercise price of $5.49 per share;

 

•

605,100 shares of common stock issuable upon the exercise of stock options granted after December 31, 2013, with a weighted-average exercise price of $73.94 per share;

 

•

1,757,031 shares of common stock issuable upon the vesting of restricted stock units outstanding as of December 31, 2013;

 

•

835,011 shares of common stock issuable upon the vesting of restricted stock units granted after December 31, 2013;

 

•

311,747 shares of common stock issuable upon the exercise of warrants outstanding as of December 31, 2013, with a weighted-average exercise price of $0.72 per share;

 

•

11,015,257 shares of common stock reserved for future grants as of December 31, 2013 under our 2013 Equity Incentive Plan (which reserve includes 1,440,111 shares of common stock issuable upon the exercise of stock options and the vesting of restricted stock units granted after December 31, 2013, as described in the bullets above), plus an additional 6,887,875 shares of common stock that became available for future grants under our 2013 Equity Incentive Plan as of January 1, 2014 pursuant to provisions thereof that automatically increase the share reserve under such plan each year, as more fully described in “Executive Compensation—Employee Benefit and Stock Plans”;

 

•

2,500,000 shares of common stock reserved for future issuance as of December 31, 2013 under our 2013 Employee Stock Purchase Plan, plus an additional 1,377,575 shares of common stock that became available for future grants under our 2013 Employee Stock Purchase Plan as of January 1, 2014 pursuant to provisions thereof that automatically increase the share reserve under such plan each year, as more fully described in “Executive Compensation—Employee Benefit and Stock Plans”; and

 

•

any shares of common stock that become available subsequent to this offering under our 2013 Equity Incentive Plan and 2013 Employee Stock Purchase Plan pursuant to provisions thereof that automatically increase the share reserves under such plans each year, as more fully described in “Executive Compensation—Employee Benefit and Stock Plans.”

 

52

---

Table of Contents

SELECTED CONSOLIDATED FINANCIAL DATA

 

The selected consolidated statements of operations data for the years ended December 31, 2011, 2012 and 2013 and the consolidated balance sheet data as of December 31, 2012 and 2013 are derived from our audited consolidated financial statements included elsewhere in this prospectus. The selected consolidated statements of operations for the year ended December 31, 2009 and 2010 and the selected consolidated balance sheet data as of December 31, 2009, 2010 and 2011 are derived from our audited consolidated financial statements that are not included in this prospectus. The selected consolidated financial data below should be read in conjunction with the section entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and related notes included elsewhere in this prospectus. The selected consolidated financial data in this section are not intended to replace our consolidated financial statements and the related notes, and are qualified in their entirety by the consolidated financial statements and related notes included elsewhere in this prospectus. Our historical results are not necessarily indicative of the results that may be expected for any period in the future.

 

		Year Ended December 31,
		2009				2010				2011				2012				2013
		(In thousands, except per share data)
Consolidated Statements of Operations Data:
Revenue:
Product		$	1,353			$	9,270			$	24,888			$	52,265			$	88,253
Subscription and services			288				2,495				8,770				31,051				73,299
Total revenue			1,641				11,765				33,658				83,316				161,552
Cost of revenue:
Product(1)			1,171				2,054				5,690				14,467				28,912
Subscription and services			135				277				1,590				3,163				18,853
Total cost of revenue			1,306				2,331				7,280				17,630				47,765
Total gross profit			335				9,434				26,378				65,686				113,787
Operating expenses:
Research and development(1)			3,910				5,291				7,275				16,522				66,036
Sales and marketing(1)			3,063				11,357				30,389				67,562				167,466
General and administrative(1)			2,208				1,943				4,428				15,221				52,503
Total operating expenses			9,181				18,591				42,092				99,305				286,005
Operating loss			(8,846	)			(9,157	)			(15,714	)			(33,619	)			(172,218	)
Interest income			1				3				3				7				68
Interest expense			(5	)			(158	)			(194	)			(537	)			(525	)
Other income (expense), net			43				(156	)			(806	)			(2,572	)			(7,257	)
Loss before income taxes			(8,807	)			(9,468	)			(16,711	)			(36,721	)			(179,932	)
Provision for (benefit from) income taxes			(7	)			13				71				(965	)			(59,297	)
Net loss attributable to common stockholders		$	(8,800	)		$	(9,481	)		$	(16,782	)		$	(35,756	)		$	(120,635	)
Net loss per share attributable to common stockholders, basic and diluted		$	(1.42	)		$	(1.30	)		$	(1.99	)		$	(3.28	)		$	(2.66	)
Weighted-average shares used to compute net loss per share attributable to common stockholders			6,211				7,271				8,447				10,917				45,271

 

53

---

Table of Contents

 

(1)

Includes stock-based compensation expense as follows:

 

 

		As of December 31,
		2009				2010				2011				2012				2013
		(In thousands)
Consolidated Balance Sheet Data:
Cash and cash equivalents		$	1,265			$	7,665			$	10,676			$	60,200			$	173,918
Working capital, excluding deferred revenue and costs			1,501				10,302				18,319				75,074				219,707
Total assets			3,210				15,676				35,646				125,273				1,376,313
Total deferred revenue			2,502				6,266				30,102				76,406				187,514
Total long-term debt, current portion			83				497				1,400				1,231				—
Total long-term debt, non-current portion			25				3,174				4,528				10,916				—
Preferred stock warrant liability			8				189				994				3,529				—
Total stockholders’ equity (deficit)			(409	)			1,348				(14,651	)			5,390				1,048,102

 

		Year Ended or as of December 31,
		2011				2012				2013
		(Dollars in thousands)
Key Business Metrics:
Product revenue		$	24,888			$	52,265			$	88,253
Subscription and services revenue			8,770				31,051				73,299
Total revenue		$	33,658			$	83,316			$	161,552
Year-over-year percentage increase			186	%			148	%			94	%
Gross margin percentage			78	%			79	%			70	%
Deferred revenue, current portion at period end(1)		$	16,215			$	43,750			$	110,535
Deferred revenue, non-current portion at period end		$	13,887			$	32,656			$	76,979
Billings (non-GAAP)(2)		$	57,494			$	129,620			$	256,561
Net cash provided by (used in) operating activities(3)		$	5,111			$	21,500			$	(69,762	)
Free cash flow (non-GAAP)(4)		$	(106	)		$	2,652			$	(127,322	)

 

(1)

Our deferred revenue consists of amounts that have been invoiced but have not yet been recognized as revenue as of the period end. For the year ended December 31, 2013, deferred revenue includes the addition of $16.1 million of deferred revenue assumed in connection with the Mandiant acquisition. The majority of our deferred revenue balance consists of the unamortized portion of revenue from sales of our Email Threat Prevention product, subscriptions to our DTI cloud and Email Threat Prevention Attachment/URL Engine, and support and maintenance contracts. Because invoiced amounts for subscriptions and services can be for multiple years, we classify our deferred revenue as current or non-current depending on when we expect to recognize the related revenue. If the deferred revenue is expected to be recognized within 12 months, it is classified as

 

54

---

Table of Contents

current. Otherwise, the deferred revenue is classified as non-current. We monitor our deferred revenue balance because it represents a significant portion of revenue to be recognized in future periods.

(2)

We define billings as revenue recognized plus the change in deferred revenue from the beginning to the end of the period. For fiscal year 2013, billings exclude the addition of $16.1 million of deferred revenue assumed as part of the Mandiant acquisition. We consider billings to be a useful metric for management and investors because billings drives deferred revenue, which is an important indicator of the health and visibility of our business and represents a significant percentage of our revenue. See “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Key Business Metrics” for more information and a reconciliation of billings to revenue, the most directly comparable financial measure calculated and presented in accordance with U.S. generally accepted accounting principles, or GAAP.

(3)

We monitor cash flow provided by (used in) operating activities as a measure of our overall business performance. Our cash flow provided by (used in) operating activities is driven in large part by sales of our products and from up-front payments for both new and renewal contracts for subscription and support and maintenance. Monitoring cash flow provided by (used in) operating activities enables us to analyze our financial performance without the non-cash effects of certain items such as depreciation, amortization, and stock-based compensation costs, thereby allowing us to better understand and manage the cash needs of our business.

(4)

We define free cash flow as net cash provided by operating activities less purchases of property and equipment and demonstration units. We consider free cash flow to be a liquidity measure that provides useful information to management and investors about the amount of cash generated by the business that, after the purchases of property and equipment and demonstration units, can be used for strategic opportunities, including investing in our business, making strategic acquisitions, and strengthening the balance sheet. See “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Key Business Metrics” for more information and a reconciliation of free cash flow to cash flow provided by (used in) operating activities, the most directly comparable financial measure calculated and presented in accordance with GAAP.

 

55

---

Table of Contents

MANAGEMENT’S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION

AND RESULTS OF OPERATIONS

 

You should read the following discussion and analysis of our financial condition and results of operations together with the consolidated financial statements and related notes that are included elsewhere in this prospectus. This discussion contains forward-looking statements based upon current plans, expectations and beliefs that involve risks and uncertainties. Our actual results may differ materially from those anticipated in these forward-looking statements as a result of various factors, including those set forth under “Risk Factors” and in other parts of this prospectus.

 

Overview

 

We provide a comprehensive solution of products and services for detecting, preventing and resolving advanced cybersecurity threats. We have invented a purpose-built, virtual machine-based security platform that provides real-time protection to enterprises and governments worldwide against the next generation of cyber attacks. Our technology approach represents a paradigm shift from how IT security has been conducted since the earliest days of the information technology industry. The core of our purpose-built, virtual machine-based security platform is our virtual execution engine, to which we refer as our MVX engine, which identifies and protects against known and unknown threats that existing signature-based technologies are unable to detect. We believe it is imperative for organizations to invest in this new approach to security to protect their critical assets, such as intellectual property and customer and financial data, from the global pandemic of cybercrime, cyber espionage and cyber warfare.

 

We were founded in 2004 to address the fundamental limitations of legacy signature-based technologies in detecting and blocking sophisticated cyber attacks. From 2004 to 2008, we focused our efforts on research and development to build our virtual machine technology. We released our first product, the Web Threat Prevention appliance, in 2008. Our Web Threat Prevention appliance is designed to analyze and block advanced attacks via the Web. Since that time, we have continued to enhance our product portfolio, releasing our Email Threat Prevention appliance in 2011 and our File Threat Prevention appliance in 2012. Our Email and File Threat Prevention products address advanced threats that are introduced through email attachments and file shares. Due to the scale of our customer deployments and our customers’ desire for deeper analysis of potential malicious software, we also provide management and analysis appliances, specifically our Central Management System and our Forensic Analysis System. We support and enhance the functionality of our products through our Dynamic Threat Intelligence, or DTI, cloud, a subscription service that offers global threat intelligence sharing and provides a closed-loop system that leverages the network effects of a globally distributed, automated threat analysis network. Our over ten years of research and development in virtual machine technology, anomaly detection and associated heuristic algorithms has enabled us to provide signature-less threat protection against next-generation cyber attacks.

 

We primarily market and sell our virtual machine-based security platform to Global 2000 companies in a broad range of industries and governments worldwide. As of December 31, 2013, we had over 1,900 end-customers across more than 60 countries, including over 130 of the Fortune 500.

 

We have experienced rapid growth over the last several years, increasing our revenue at a compound annual growth rate of 139% from 2010 to 2013. We have also increased our number of employees from 35 as of December 31, 2008 to 416 and 1,679 as of December 31, 2012 and December 31, 2013, respectively. We expect to continue rapidly scaling our organization to meet the needs of our customers and to pursue opportunities in new and existing markets. We intend to continue to invest in the development of our sales and marketing teams, with a particular focus on expanding our network of international channel partners, opening sales offices, hiring key sales and marketing personnel and carrying out associated marketing activities in key geographies. As of December 31, 2013, we were selling our solution to end-customers in over 60 countries, and we expect revenue from international sales to grow as a percentage of our overall revenue. In 2013, we completed the reorganization

 

56

---

Table of Contents

of our corporate structure and intercompany relationships to more closely align our corporate organization with the expansion of our international business activities and improve our overall effective tax rate. We intend to continue to invest in our product development organization to enhance the functionality of our existing platform, introduce new products and subscriptions, and build upon our technology leadership. Due to our continuing investments to scale our business, particularly internationally, reorganize our corporate structure for improved tax efficiency, pursue new opportunities, enhance our product functionality, introduce new products and build upon our technology leadership in advance of, and in preparation for, our expected increase in sales and expansion of our customer base, we are continuing to incur expenses in the near term for which we may not realize any long-term benefit. As a result, we do not expect to be profitable for the foreseeable future.

 

During the years ended December 31, 2011, 2012 and 2013, our revenue was $33.7 million, $83.3 million and $161.6 million, representing year-over-year growth of 186%, 148% and 94%, respectively. Our net losses were $16.8 million, $35.8 million and $120.6 million during the years ended December 31, 2011, 2012 and 2013, respectively. During the year ended December 31, 2012, approximately 80%, 8% and 8% of our revenue came from the United States, Asia Pacific and Japan (APAC), and Europe, the Middle East and Africa (EMEA), respectively. During the year ended December 31, 2013, approximately 72%, 10% and 14% of our revenue came from the United States, APAC and EMEA, respectively.

 

In September 2013, we closed our initial public offering, or IPO, in which we sold 17,450,000 shares of common stock (inclusive of 2,275,000 shares of common stock from the exercise of the over-allotment option granted to the underwriters). The public offering price of the shares sold in the IPO was $20.00 per share. The total gross proceeds from the offering were $349.0 million. After deducting underwriting discounts and commissions and offering expenses, the aggregate net proceeds received by us totaled approximately $321.0 million.

 

On December 30, 2013, we acquired privately held Mandiant Corporation, or Mandiant, the leading provider of advanced endpoint security products and security incident response management solutions. We believe this combination creates the industry’s leading advanced threat protection vendor with the ability to detect, prevent and resolve cyber attacks at every stage of the attack life cycle. Under the terms of the merger agreement governing the transaction, we delivered to the former security holders of Mandiant merger consideration with an aggregate value equal to approximately $1,020.3 million, consisting of approximately $106.5 million in net cash and an aggregate of 21.5 million shares and options to purchase shares of our common stock.

 

This acquisition creates risks for us. These risks are set forth more fully in the section of this prospectus titled “Risk Factors.” Audited Mandiant financial statements and unaudited pro forma condensed combined financial statements are included in this prospectus following our financial statements and should be read by investors in conjunction with the respective accompanying notes. The results of operations of Mandiant have been included in our consolidated statements of operations since December 30, 2013, the acquisition date. Our balance sheet as of December 31, 2013 reflects items assumed from the Mandiant acquisition.

 

We believe that the growth of our business and our short and long term success are dependent upon many factors, including our ability to extend our technology leadership, grow our base of end-customers, expand deployment of our platform within existing end-customers, and focus on end-customer satisfaction. While these areas present significant opportunities for us, they also pose challenges and risks that we must successfully address in order to sustain the growth of our business and improve our operating results.

 

We have experienced rapid growth and increased demand for our products over the last few years. To manage any future growth effectively, we must continue to improve and expand our information technology and financial infrastructure, our operating and administrative systems and controls, and our ability to manage headcount, capital, and processes in an efficient manner. Additionally, we face intense competition in our market, and to succeed, we need to innovate and offer products that are differentiated from existing infrastructure

 

57

---

Table of Contents

products, as well as effectively hire, retain, train, and motivate qualified personnel and senior management. If we are unable to successfully address these challenges, our business, operating results, and prospects could be adversely affected.

 

For a description of factors that may impact our future performance, see the disclosure below under “—Factors Affecting our Performance.”

 

Our Business Model

 

We generate revenue from sales of our products, subscriptions and services. Our product revenue consists primarily of revenue from the sale of our threat prevention portfolio of software-based appliances, consisting of our Web Threat Prevention, Email Threat Prevention and File Threat Prevention, as well as sales of our Forensic Analysis System and Central Management System appliances. We offer this portfolio as a complete solution to protect the various entry points of a customer’s network from the next generation of cyber attacks. Because the typical customer’s network has more Web entry points to protect than email and file entry points, customers that purchase our threat prevention portfolio generally purchase more Web Threat Prevention appliances than Email or File Threat Prevention appliances. As a result, Web Threat Prevention accounts for the largest portion of our threat prevention product revenue. In addition, because most malicious attacks occur through the Web threat vector, smaller customers and customers who do not have the budget to purchase the full threat prevention portfolio often only purchase Web Threat Prevention. While we have experienced steady growth in sales of our Email Threat Prevention appliance since its introduction in 2011, these sales have not contributed as quickly to the growth in our overall product revenue because revenue associated with Email Threat Prevention is recognized ratably over the longer of the contractual term or the estimated period the customer is expected to benefit from the product. By contrast, revenue associated with our Web Threat Prevention, File Threat Prevention, Central Management System and Forensic Analysis System products is recognized upon shipment. Finally, we introduced our File Threat Prevention appliance in the second quarter of 2012, and as a result, revenue from our File Threat Prevention product represents a small percentage of our product revenue.

 

We require customers to purchase a subscription to our DTI cloud and support and maintenance services when they purchase any part of our product portfolio. In addition, we require customers that purchase our Email Threat Prevention product to also purchase a subscription to our Email Threat Prevention Attachment/URL Engine. Our customers generally purchase these subscriptions and services for a one or three year term, and revenue from such subscriptions is recognized ratably over the subscription period. Sales of these subscriptions and services, along with sales of Email Threat Prevention for multi-year terms, have increased our deferred revenue. As of December 31, 2011, 2012 and 2013, our total deferred revenue was $30.1 million, $76.4 million and $187.5 million, respectively. Amortization of this growing deferred revenue has increased our subscription and services revenue as a percentage of total revenue. For the years ended December 31, 2011, 2012 and 2013, subscription and services revenue as a percentage of total revenue was 26%, 37% and 45%, respectively. While most of the growth in our subscription and services revenue during such years relates to the amortization of the initial subscription and services agreements, renewals of such agreements have also contributed to this growth. Our renewal rate for subscriptions expiring in 2012 and 2013 was in excess of 90%, and we expect to maintain high renewal rates in the future due to the significant value we believe these subscriptions and services add to the efficacy of our product portfolio.

 

58

---

Table of Contents

Key Business Metrics

 

We monitor the key business metrics set forth below to help us evaluate growth trends, establish budgets, measure the effectiveness of our sales and marketing efforts, and assess operational efficiencies. We discuss revenue and gross margin below under “—Components of Operating Results.” Deferred revenue, billings, net cash flow provided by (used in) operating activities, and free cash flow are discussed immediately below the following table.

 

		Year Ended or as of December 31,
		2011				2012				2013
		(Dollars in thousands)
Product revenue		$	24,888			$	52,265			$	88,253
Subscription and services revenue			8,770				31,051				73,299
Total revenue		$	33,658			$	83,316			$	161,552
Year-over-year percentage increase			186	%			148	%			94	%
Gross margin percentage			78	%			79	%			70	%
Deferred revenue, current portion		$	16,215			$	43,750			$	110,535
Deferred revenue, non-current portion		$	13,887			$	32,656			$	76,979
Billings (non-GAAP)		$	57,494			$	129,620			$	256,561
Net cash provided by (used in) operating activities		$	5,111			$	21,500			$	(69,762	)
Free cash flow (non-GAAP)		$	(106	)		$	2,652			$	(127,322	)

 

Deferred revenue. Our deferred revenue consists of amounts that have been invoiced but have not yet been recognized as revenue as of the period end. For the year ended December 31, 2013, deferred revenue includes the addition of $16.1 million of deferred revenue assumed in connection with the Mandiant acquisition. The majority of our deferred revenue consists of the unamortized balance of revenue from sales of our Email Threat Prevention products, subscriptions to our DTI cloud and Email Threat Prevention Attachment/URL Engine, and support and maintenance contracts. Because invoiced amounts for subscriptions and services can be for multiple years, we classify our deferred revenue as current or non-current depending on when we expect to recognize the related revenue. If the deferred revenue is expected to be recognized within 12 months, it is classified as current. Otherwise, the deferred revenue is classified as non-current. We monitor our deferred revenue balance because it represents a significant portion of revenue to be recognized in future periods.

 

Billings. Billings is a non-GAAP financial metric that we define as revenue recognized in accordance with generally accepted accounting principles, or GAAP, plus the change in deferred revenue from the beginning to the end of the period. For the year ended December 31, 2013, billings exclude the addition of $16.1 million of deferred revenue assumed in connection with the Mandiant acquisition. We consider billings to be a useful metric for management and investors, as a supplement to the corresponding GAAP measure, because billings drive deferred revenue, which is an important indicator of the health and visibility of trends in our business, and represents a significant percentage of revenue. However, it is important to note that other companies, including companies in our industry, may not use billings, may calculate billings differently, may have different billing frequencies, or may use other financial measures to evaluate their performance, all of which could reduce the usefulness of billings as a comparative measure. A reconciliation of billings to revenue, the most directly comparable financial measure calculated and presented in accordance with GAAP, is provided below:

 

		Year Ended or as of December 31,
		2011				2012				2013
		(In thousands)
Revenue		$	33,658			$	83,316			$	161,552
Deferred revenue, end of period			30,102				76,406				187,514
Less: deferred revenue, beginning of period			6,266				30,102				76,406
Less: Mandiant deferred revenue assumed			—				—				16,099
Billings (non-GAAP)		$	57,494			$	129,620			$	256,561

 

59

---

Table of Contents

Net cash provided by (used in) operating activities. We monitor net cash provided by (used in) operating activities as a measure of our overall business performance. Our net cash provided by (used in) operating activities is driven in large part by sales of our products and from up-front payments for both subscriptions and support and maintenance services. Monitoring net cash provided by (used in) operating activities enables us to analyze our financial performance without the non-cash effects of certain items such as depreciation, amortization, and stock-based compensation costs, thereby allowing us to better understand and manage the cash needs of our business.

 

Free cash flow. Free cash flow is a non-GAAP financial measure we define as net cash provided by (used in) operating activities less purchases of property and equipment and demonstration units. We consider free cash flow to be a liquidity measure that provides useful information to management and investors about the amount of cash generated by our business that, after the purchases of property and equipment and demonstration units, can be used by us for strategic opportunities, including investing in our business, making strategic acquisitions and strengthening our balance sheet. However, it is important to note that other companies, including companies in our industry, may not use free cash flow, may calculate free cash flow differently, or may use other financial measures to evaluate their performance, all of which could reduce the usefulness of free cash flow as a comparative measure. A reconciliation of free cash flow to cash flow provided by (used in) operating activities, the most directly comparable financial measure calculated and presented in accordance with GAAP, is provided below:

 

		Year Ended or as of December 31,
		2011				2012				2013
		(In thousands)
Cash flow provided by (used in) operating activities		$	5,111			$	21,500			$	(69,762	)
Less: purchase of property and equipment and demonstration units			(5,217	)			(18,848	)			(57,560	)
Free cash flow (non-GAAP)		$	(106	)		$	2,652			$	(127,322	)
Net cash used in investing activities		$	(5,224	)		$	(20,215	)		$	(148,469	)
Net cash provided by financing activities		$	3,124			$	48,239			$	331,949

 

Factors Affecting our Performance

 

Market Adoption. We rely on market education to raise awareness of today’s next-generation cyber attacks, articulate the need for our virtual machine-based security solution and, in particular, the reasons to purchase our products. Our prospective customers often do not have a specific portion of their IT budgets allocated for products that address the next generation of advanced cyber attacks. We invest heavily in sales and marketing efforts to increase market awareness, educate prospective customers and drive adoption of our solution. This market education is critical to creating new IT budget dollars or allocating IT budget dollars across enterprises and governments for next-generation threat protection solutions, and in particular, our platform. Our investment in market education has also increased awareness of us and our solution in international markets. However, we believe that we will need to invest additional resources in targeted international markets to drive awareness and market adoption. The degree to which prospective customers recognize the mission critical need for next-generation threat protection solutions, and subsequently allocate budget dollars for our platform, will drive our ability to acquire new customers and increase renewals and follow-on sales opportunities, which, in turn, will affect our future financial performance.

 

Sales Productivity. Our sales organization consists of a direct sales team, made up of field and inside sales personnel, and indirect channel sales teams to support our channel partner sales. We utilize a direct-touch sales model whereby we work with our channel partners to secure prospects, convert prospects to customers, and pursue follow-on sales opportunities. To date, we have primarily targeted large enterprise and government customers, who typically have sales cycles from three to six months. We have also recently expanded our inside sales teams to pursue customers in the small and medium enterprise, or SME, market.

 

Our growth strategy contemplates increased sales and marketing investments internationally. Newly hired sales and marketing resources will require several months to establish prospect relationships and drive overall

 

60

---

Table of Contents

sales productivity. In addition, sales teams in international regions will face local markets that have not had significant market education about advanced security threats that our platform addresses. All of these factors will influence timing and overall levels of sales productivity, impacting the rate at which we will be able to convert prospects to sales and drive revenue growth.

 

Renewal Rates. New or existing customers that purchase one of our appliances are required to purchase a one or three year subscription to our DTI cloud and, in the case of our Email Threat Prevention products, to our Email Threat Prevention Attachment/URL Engine, as well as support and maintenance services. New or existing customers that purchase one of our Forensic Analysis System or Central Management System appliances are required to purchase support and maintenance services for a term of one or three years.

 

We believe our renewal rate is an important metric to measure the long-term value of customer agreements and our ability to retain our customers. We calculate our renewal rate by dividing the number of renewing customers that were due for renewal in any rolling 12 month period by the number of customers that were due for renewal in that rolling 12 month period. Our renewal rate at December 31, 2011, 2012 and 2013 was over 90%. These high renewal rates are primarily attributable to the incremental value added to our appliances by our DTI cloud and support and maintenance services. As DTI cloud subscriptions and support and maintenance services represented 26%, 37% and 45% of our total revenue during the years ended December 31, 2011, 2012 and 2013, respectively, we expect our ability to maintain high renewal rates for these subscriptions and services to have a material impact on our future financial performance.

 

Follow-On Sales. After the initial sale to a new customer, we focus on expanding our relationship with such customer to sell additional products, subscriptions and services. To grow our revenue, it is important that our customers make additional purchases of our platform. Sales to our existing customer base can take the form of incremental sales of appliances, subscriptions and services, either to deploy our platform into additional parts of their network or to protect additional threat vectors. Our opportunity to expand our customer relationships through follow-on sales will increase as we add new customers, broaden our product portfolio to support more threat vectors, increase network performance and enhance functionality. Follow-on sales lead to increased revenue over the lifecycle of a customer relationship and can significantly increase the return on our sales and marketing investments. With some of our most significant customers, we have realized follow-on sales that were multiples of the value of their initial purchases.

 

Components of Operating Results

 

Revenue

 

We generate revenue from the sales of our products, subscriptions and services. As discussed further in “—Critical Accounting Policies and Estimates—Revenue Recognition” below, revenue is recognized when persuasive evidence of an arrangement exists, delivery has occurred, the fee is fixed or determinable and collectability is reasonably assured.

 

Our total revenue consists of the following:

 

•

Product revenue. Our product revenue is generated from sales of our appliances. For our Web Threat Prevention, File Threat Prevention, Forensic Analysis System and Central Management System appliances, we recognize product revenue at the time of shipment, provided that all other revenue recognition criteria have been met. For our Email Threat Prevention appliance, we recognize product revenue ratably over the longer of the contractual term of the subscription service or the estimated period the customer is expected to benefit from the product. Because we have only been selling our Email Threat Prevention since April 2011, we have a limited history with respect to subscription renewals for such product. As a result, revenue from all Email Threat Prevention products sold by us through December 31, 2013 has been recognized ratably over the contractual term of the subscription services.

 

61

---

Table of Contents

•

Subscription and services revenue. Subscription and services revenue is generated primarily from our DTI cloud, our Email Threat Prevention Attachment/URL Engine, and support and maintenance services. Our DTI cloud subscription is determined as a percentage of the price of the related appliance. The Email Threat Prevention Attachment/URL Engine is priced on a per-user basis. We recognize revenue from subscriptions and support and maintenance services over the one or three year contract term, as applicable.

 

Cost of Revenue

 

Our total cost of revenue consists of cost of product revenue and cost of subscription and services revenue. Personnel costs associated with our operations and global customer support organizations consist of salaries, benefits, bonuses and stock-based compensation. Overhead costs consist of certain facilities, depreciation, benefits, and information technology costs.

 

•

Cost of product revenue. Cost of product revenue primarily consists of costs paid to our third-party contract manufacturers and personnel and other costs in our manufacturing operations department. Our cost of product revenue also includes product testing costs, allocated costs and shipping costs. We expect our cost of product revenue to increase as our product revenue increases.

 

•

Cost of subscription and services revenue. Cost of subscription and services revenue consists of personnel costs for our global customer support organization and allocated costs. We expect our cost of subscription and services revenue to increase as our customer base grows and as we hire additional professional services personnel.

 

Gross Margin

 

Gross margin, or gross profit as a percentage of revenue, has been and will continue to be affected by a variety of factors, including the average sales price of our products, subscriptions and services, manufacturing costs, the mix of products sold, and the mix of revenue among products, subscriptions and services. We expect our gross margins to fluctuate over time depending on the factors described above.

 

Operating Expenses

 

Our operating expenses consist of research and development, sales and marketing, and general and administrative expense. Personnel costs are the most significant component of operating expenses and consist of salaries, benefits, bonuses, stock-based compensation and, with regard to sales and marketing expense, sales commissions. Operating expenses also include overhead costs for facilities, IT and depreciation.

 

•

Research and development. Research and development expense consists primarily of personnel costs and allocated overhead. Research and development expense also includes prototype-related expenses. We expect research and development expense to continue to increase in absolute dollars as we continue to invest in our research and product development efforts to enhance our product capabilities, address new threat vectors and access new customer markets, although such expense may fluctuate as a percentage of total revenue.

 

•

Sales and marketing. Sales and marketing expense consists primarily of personnel costs, incentive commission costs and allocated overhead. We expense commission costs as incurred. Sales and marketing expense also includes costs for market development programs, promotional and other marketing activities, travel, office equipment, depreciation of proof-of-concept evaluation units and outside consulting costs. We expect sales and marketing expense to continue to increase in absolute dollars as we increase the size of our sales and marketing organizations and expand our international operations, although such expense may fluctuate as a percentage of total revenue.

 

•

General and administrative. General and administrative expense consists of personnel costs, professional services and allocated overhead. General and administrative personnel include our executive, finance, human resources, facilities and legal organizations. Professional services consist

 

62

---

Table of Contents

primarily of legal, auditing, accounting and other consulting costs. We expect general and administrative expense to continue to increase in absolute dollars as we have recently incurred, and expect to continue to incur, additional general and administrative expenses as we grow our operations and comply with public company regulations, including higher legal, corporate insurance, and accounting expenses.

 

Interest Income

 

Interest income consists of interest earned on our cash and cash equivalent balances. We have historically invested our cash in money-market funds and other short-term, investment-grade investments. We expect interest income to vary each reporting period depending on our average investment balances during the period, types and mix of investments and market interest rates.

 

Interest Expense

 

Interest expense consists of interest on our outstanding debt. See Note 6 to our consolidated financial statements included elsewhere in this prospectus for more information about our debt.

 

Other Expense, Net

 

Other expense, net consists primarily of the change in fair value of our preferred stock warrant liability and gains or losses on disposal of fixed assets. Convertible preferred stock warrants are classified as a liability on our consolidated balance sheets and remeasured to fair value at each balance sheet date with the corresponding change recorded as other expense. Upon the completion of our initial public offering, the liability was reclassified to stockholders’ equity, at which time it was no longer subject to fair value accounting.

 

Provision for (Benefit from) Income Taxes

 

Provision for (benefit from) income taxes consists primarily of U.S. federal and state income taxes in the United States and income taxes in certain foreign jurisdictions in which we conduct business. Our effective tax rate for the year ended December 31, 2013 was different from the U.S. statutory tax rate applied to our pretax loss primarily due to tax benefits from the valuation allowance release on U.S. deferred tax assets offset by different tax rates in foreign jurisdictions which are indefinitely reinvested. Our effective tax rate for the years ended December 31, 2011 and 2012 was different than the U.S. statutory tax rate primarily due to the valuation allowance on our U.S. deferred tax assets.

 

63

---

Table of Contents

Results of Operations

 

The following tables summarize our results of operations for the periods presented and as a percentage of our total revenue for those periods. The period-to-period comparison of results is not necessarily indicative of results for future periods.

 

		Year Ended December 31,
		2011				2012				2013
		(In thousands)
Revenue:
Product		$	24,888			$	52,265			$	88,253
Subscription and services			8,770				31,051				73,299
Total revenue			33,658				83,316				161,552
Cost of revenue:
Product			5,690				14,467				28,912
Subscription and services			1,590				3,163				18,853
Total cost of revenue			7,280				17,630				47,765
Total gross profit			26,378				65,686				113,787
Operating expenses:
Research and development			7,275				16,522				66,036
Sales and marketing			30,389				67,562				167,466
General and administrative			4,428				15,221				52,503
Total operating expenses			42,092				99,305				286,005
Operating loss			(15,714	)			(33,619	)			(172,218	)
Interest income			3				7				68
Interest expense			(194	)			(537	)			(525	)
Other expense, net			(806	)			(2,572	)			(7,257	)
Loss before income taxes			(16,711	)			(36,721	)			(179,932	)
Provision for (benefit from) income taxes			71				(965	)			(59,297	)
Net loss attributable to common stockholders		$	(16,782	)		$	(35,756	)		$	(120,635	)

 

64

---

Table of Contents

		Year Ended December 31,
		2011				2012				2013
		(As a percentage of total revenue)
Revenue:
Product			74	%			63	%			55	%
Subscription and services			26				37				45
Total revenue			100				100				100
Cost of revenue:
Product			17				17				18
Subscription and services			5				4				12
Total cost of revenue			22				21				30
Total gross profit			78				79				70
Operating expenses:
Research and development			22				20				41
Sales and marketing			90				81				104
General and administrative			13				18				32
Total operating expenses			125				119				177
Operating loss			(47	)			(40	)			(107	)
Interest income			—				—				—
Interest expense			(1	)			(1	)			—
Other expense, net			(2	)			(3	)			(4	)
Loss before income taxes			(50	)			(44	)			(111	)
Provision for (benefit from) income taxes			—				(1	)			(36	)
Net loss attributable to common stockholders			(50	)%			(43	)%			(75	)%

 

Comparison of the Years Ended December 31, 2012 and 2013

 

Revenue

 

		Year Ended December 31,
		2012								2013								Change
		Amount				% of Total Revenue				Amount				% of Total Revenue				Amount				%
		(Dollars in thousands)
Revenue:
Product		$	52,265				63	%		$	88,253				55	%		$	35,988				69	%
Subscription and services			31,051				37	%			73,299				45	%			42,248				136	%
Total revenue		$	83,316				100	%		$	161,552				100	%		$	78,236				94	%
Revenue by geographic region:
United States		$	66,556				80	%		$	116,730				72	%		$	50,174				75	%
EMEA			6,628				8	%			22,845				14	%			16,217				245	%
APAC			6,488				8	%			16,004				10	%			9,516				147	%
Other			3,644				4	%			5,973				4	%			2,329				64	%
Total revenue		$	83,316				100	%		$	161,552				100	%		$	78,236				94	%

 

65

---

Table of Contents

Total revenue increased by $78.2 million, or 94%, during the year ended December 31, 2013 compared to the year ended December 31, 2012. The increase in product revenue was primarily driven by growth in our installed base of customers, which grew from 927 as of December 31, 2012 to 1,964 as of December 31, 2013, as well as follow-on purchases from customers expanding their initial deployments of our product portfolio. Our Web Threat Prevention product continued to account for the largest portion of our product revenue as customers that purchase our product portfolio generally purchase more Web Threat Prevention appliances than Email Threat Prevention or File Threat Prevention appliances, reflecting the fact that their networks typically have more Web entry points than email or file entry points to protect. In addition, revenue associated with our Web Threat Prevention product is recognized upon shipment whereas revenue associated with our Email Threat Prevention product is recognized ratably over the longer of the contractual term or the estimated period the customer is expected to benefit from the product.

 

Revenue from the amortization of deferred subscription and services revenue related to initial customer purchases was $25.1 million and $55.1 million for the years ended December 31, 2012 and 2013, respectively. Revenue from the amortization of deferred subscription and services revenue related to renewals was $6.0 million and $18.0 million for the years ended December 31, 2012 and 2013, respectively. Given our high renewal rate and increasing base of customers, we expect revenue from the amortization of deferred subscription and services revenue related to renewals to increase as a percentage of our total revenue from deferred subscription and services revenue. Our renewal rate for subscription and services agreements expiring in the 12 months ended December 31, 2013 was in excess of 90%.

 

International revenue increased $28.1 million, or 167%, during the year ended December 31, 2013 compared to the year ended December 31, 2012, which reflects our increasing presence in international markets.

 

Cost of Revenue and Gross Margin

 

		Year Ended December 31,
		2012								2013								Change
		Amount				Gross Margin				Amount				Gross Margin				Amount
		(Dollars in thousands)
Cost of revenue:
Product		$	14,467							$	28,912							$	14,445
Subscription and services			3,163								18,853								15,690
Total cost of revenue		$	17,630							$	47,765							$	30,135
Gross margin:
Product							72	%							67	%
Subscription and services							90	%							74	%
Total gross margin							79	%							70	%

 

Total cost of revenue increased $30.1 million, or 171%, during the year ended December 31, 2013 compared to the year ended December 31, 2012. The increase in cost of product revenue was driven primarily by an increase in product revenue and an increase in personnel costs in our manufacturing operations department as we continue to add capacity and build out our global supply chain. The increase in cost of subscription and services revenue was driven primarily by increased personnel costs in customer support.

 

Gross margin decreased for the year ended December 31, 2013 compared to the year ended December 31, 2012. The decrease in product gross margin was driven primarily by our increased investment in our manufacturing operations to increase capacity. The decrease in subscription and services gross margin was due primarily to an increase in our investment in customer support personnel and infrastructure.

 

66

---

Table of Contents

Operating Expenses

 

		Year Ended December 31,
		2012								2013								Change
		Amount				% of Total Revenue				Amount				% of Total Revenue				Amount				%
		(Dollars in thousands)
Operating expenses:
Research and development		$	16,522				20	%		$	66,036				41	%		$	49,514				300	%
Sales and marketing			67,562				81				167,466				104				99,904				148
General and administrative			15,221				18				52,503				32				37,282				245
Total operating expenses		$	99,305				119	%		$	286,005				177	%		$	186,700				188	%
Includes stock-based compensation expense of:
Research and development		$	1,465							$	6,958
Sales and marketing			1,672								10,748
General and administrative			3,536								8,342
Total		$	6,673							$	26,048

 

Research and Development

 

Research and development expense increased $49.5 million, or 300%, during the year ended December 31, 2013 compared to the year ended December 31, 2012, primarily due to a $24.3 million increase in personnel costs and a $1.3 million increase in related consulting costs as we increased our headcount and consultants to support continued investment in our future product and service offerings, and a $2.9 million increase in nonrecurring engineering activities. Additionally, overhead allocations and depreciation related to capital expenditures for departmental expansion increased by $18.6 million during the year ended December 31, 2013.

 

Sales and Marketing

 

Sales and marketing expense increased $99.9 million, or 148%, during the year ended December 31, 2013 compared to the year ended December 31, 2012, primarily due to a $56.9 million increase in personnel costs of which $13.2 million related to increased commissions for higher headcount and billings, a $4.7 million increase in depreciation expense, a $1.1 million increase in recruiting expenses related to new hires, a $6.8 million increase in travel-related costs and a $2.6 million increase in marketing activity, primarily related to an increase in lead generation services and costs associated with trade shows and conventions, Website development and partner programs. The change was also attributable to a $2.0 million increase in consulting costs and a $23.8 million increase in overhead allocations driven by the increase in sales and marketing personnel.

 

General and Administrative

 

General and administrative expense increased $37.3 million, or 245%, during the year ended December 31, 2013 compared to the year ended December 31, 2012, primarily due to a $14.3 million increase in personnel costs, a $13.1 million increase in professional services, including legal, accounting and recruiting services, and a $0.8 million increase in consulting costs. The change was also attributable to a $5.6 million increase in overhead allocations associated with departmental expansion. The increase in personnel costs, professional services and consulting costs was primarily a result of growth in our operations and our preparations to operate as a public company.

 

67

---

Table of Contents

Interest Income

 

		Year Ended December 31,								Change
		2012				2013				Amount				%
		(Dollars in thousands)
Interest income		$	7			$	68			$	61				871	%

 

The change in interest income resulted from the significant increase in the average balances in cash and cash equivalents during the year ended December 31, 2013 compared to the year ended December 31, 2012.

 

Interest Expense

 

		Year Ended December 31,								Change
		2012				2013				Amount				%
		(Dollars in thousands)
Interest expense		$	(537	)		$	(525	)		$	12				(2	)%

 

The decrease in interest expense resulted from decreased bank borrowings during the year ended December 31, 2013 compared to the year ended December 31, 2012.

 

Other Expense, Net

 

		Year Ended December 31,								Change
		2012				2013				Amount				%
		(Dollars in thousands)
Other expense, net		$	(2,572	)		$	(7,257	)		$	(4,685	)			182	%

 

The change in other expense, net was primarily due to an increase in the estimated fair value of preferred stock warrant liability during the year ended December 31, 2013 compared to the year ended December 31, 2012. At the time of our IPO, our preferred stock warrants were converted into common stock warrants, and the warrant liability was reclassified to stockholders’ equity. We will not incur expenses related to these warrants in future periods.

 

Provision for (Benefit from) Income Taxes

 

		Year Ended December 31,
		2012				2013
		(Dollars in thousands)
Provision for (benefit from) income taxes		$	(965	)		$	(59,297	)
Effective tax rate			3	%			33	%

 

The increase in our tax benefit from income taxes during the year ended December 31, 2013 is primarily due to the release of the valuation allowance on the majority of U.S. deferred tax assets resulting from recording a deferred tax liability on acquisition related intangibles for which no tax benefit will be derived, partially offset by different tax rates in foreign jurisdictions. The tax benefit for the year ended December 31, 2012 is primarily due to a reduction of the valuation allowance for U.S. deferred tax assets resulting from recording a deferred tax liability on acquisition related intangibles for which no tax benefit will be derived, partially offset by an increase in pre-tax income related to international operations.

 

68

---

Table of Contents

Comparison of the Years Ended December 31, 2011 and 2012

 

Revenue

 

		Year Ended December 31,
		2011								2012								Change
		Amount				% of Total Revenue				Amount				% of Total Revenue				Amount				%
		(Dollars in thousands)
Revenue:
Product		$	24,888				74	%		$	52,265				63	%		$	27,377				110	%
Subscription and services			8,770				26				31,051				37				22,281				254	%
Total revenue		$	33,658				100	%		$	83,316				100	%		$	49,658				148	%
Revenue by geographic region:
United States		$	30,050				89	%		$	66,556				80	%		$	36,506				121	%
EMEA			1,129				3				6,628				8				5,499				487	%
APAC			1,142				4				6,488				8				5,346				468	%
Other			1,337				4				3,644				4				2,307				173	%
Total revenue		$	33,658				100	%		$	83,316				100	%		$	49,658				148	%

 

Total revenue increased by $49.7 million, or 148%, during the year ended December 31, 2012 compared to the year ended December 31, 2011. The increase in product revenue was primarily driven by growth in our installed base of customers, which grew from 485 as of December 31, 2011 to 927 as of December 31, 2012, as well as follow-on purchases from customers expanding their initial deployments of our product portfolio. Revenue from our Web Threat Prevention product accounted for the largest portion of our product revenue.

 

Revenue from the amortization of deferred subscription and services revenue related to initial customer purchases was $7.6 million and $25.1 million for the years ended December 31, 2011 and 2012, respectively. Revenue from the amortization of deferred subscription and services revenue related to renewals was $1.2 million and $6.0 million for the years ended December 31, 2011 and 2012, respectively. Our renewal rate for subscription and services agreements that expired in 2011 and 2012 was in excess of 90%. Finally, international revenue increased $13.2 million, or 365%, from 2011 to 2012 as we began to see a return on our investment in increasing our international market presence.

 

Cost of Revenue and Gross Margin

 

		Year Ended December 31,
		2011								2012								Change
		Amount				Gross Margin				Amount				Gross Margin				Amount
		(Dollars in thousands)
Cost of revenue:
Product		$	5,690							$	14,467							$	8,777
Subscription and services			1,590								3,163								1,573
Total cost of revenue		$	7,280							$	17,630							$	10,350
Gross margin:
Product							77	%							72	%
Subscription and services							82	%							90	%
Total gross margin							78	%							79	%

 

69

---

Table of Contents

Total cost of revenue increased $10.4 million, or 142%, during the year ended December 31, 2012 compared to the year ended December 31, 2011. The increase in cost of product revenue was driven primarily by an increase in product revenue and an increase in personnel costs in our manufacturing operations department. The increase in cost of subscription and services revenue was driven primarily by increased personnel costs in customer support. The decrease in product gross margin was driven by our increased investment in our manufacturing operations department. The increase in subscription and services gross margin was due to the growth of our product, subscription and services revenue, partially offset by an increase in our investment in customer support personnel and infrastructure.

 

Operating Expenses

 

		Year Ended December 31,
		2011								2012								Change
		Amount				% of Total Revenue				Amount				% of Total Revenue				Amount				%
		(Dollars in thousands)
Operating expenses:
Research and development		$	7,275				22	%		$	16,522				20	%		$	9,247				127	%
Sales and marketing			30,389				90				67,562				81				37,173				122	%
General and administrative			4,428				13				15,221				18				10,793				244	%
Total operating expenses		$	42,092				125	%		$	99,305				119	%		$	57,213				136	%
Includes stock-based compensation expense of:
Research and development		$	148							$	1,465							$	1,317
Sales and marketing			360								1,672								1,312
General and administrative			168								3,536								3,368
Total		$	676							$	6,673							$	5,997

 

Research and Development

 

Research and development expense increased $9.2 million, or 127%, during the year ended December 31, 2012 compared to the year ended December 31, 2011, primarily due to a $6.1 million increase in personnel costs and a $0.6 million increase in consulting costs as we increased our headcount and consultants to support continued investment in our future product and service offerings. Additionally, overhead allocations and depreciation related to capital expenditures for departmental expansion increased by $1.7 million during the year ended December 31, 2012.

 

Sales and Marketing

 

Sales and marketing expense increased $37.2 million, or 122%, during the year ended December 31, 2012 compared to the year ended December 31, 2011, primarily due to a $20.7 million increase in personnel costs attributable to increased headcount and higher commissions, a $2.0 million increase in depreciation expense and costs associated with shipping evaluation units, a $0.8 million increase in consulting costs and a $3.5 million increase in marketing activity, primarily related to an increase in lead generation services and costs associated with trade shows and conventions, Website development and partner programs. The change was also attributable to a $2.8 million increase in travel-related costs and a $5.0 million increase in overhead allocations associated with additional sales and marketing personnel.

 

70

---

Table of Contents

General and Administrative

 

General and administrative expense increased $10.8 million, or 244%, during the year ended December 31, 2012 compared to the year ended December 31, 2011, primarily due to a $5.5 million increase in personnel costs, a $1.4 million increase in consulting costs and a $2.6 million increase in professional services, including legal, accounting and recruiting services. The change was also attributable to a $1.1 million increase in overhead allocations associated with departmental expansion.

 

Interest Income

 

		Year Ended December 31,								Change
		2011				2012				Amount				%
		(Dollars in thousands)
Interest income		$	3			$	7			$	4				133	%

 

The increase in interest income resulted from higher average balances in cash and cash equivalents during the year ended December 31, 2012 compared to the year ended December 31, 2011.

 

Interest Expense

 

		Year Ended December 31,								Change
		2011				2012				Amount				%
		(Dollars in thousands)
Interest expense		$	(194	)		$	(537	)		$	343				177	%

 

The increase in interest expense resulted from increased bank borrowings during the year ended December 31, 2012 compared to the year ended December 31, 2011.

 

Other Expense, Net

 

		Year Ended December 31,								Change
		2011				2012				Amount				%
		(Dollars in thousands)
Other expense, net		$	(806	)		$	(2,572	)		$	1,766				219	%

 

The change in other expense, net was due to an increase in fair value of preferred stock warrant liability during the year ended December 31, 2012 compared to the year ended December 31, 2011. Upon the completion of our initial public offering, the liability was reclassified to stockholders’ equity, at which time it was no longer subject to fair value accounting.

 

Provision for (Benefit from) Income Taxes

 

		Year Ended December 31,
		2011				2012
		(Dollars in thousands)
Provision for (benefit from) income taxes		$	71			$	(965	)
Effective tax rate			0	%			3	%

 

The increase in provision for (benefit from) income taxes during the year ended December 31, 2012 compared to the year ended December 31, 2011 was primarily due to a reduction in the valuation allowance resulting from recording a deferred tax liability on acquisition related intangibles for which no tax benefit will be derived partially offset by an increase in pre-tax income related to international operations.

 

71

---

Table of Contents

Quarterly Results of Operations

 

The following tables set forth selected unaudited quarterly consolidated statements of operations data for each of the eight quarters in the period ended December 31, 2013, as well as the percentage that each line item represents of total revenue for each quarter. The information for each of these quarters has been prepared on the same basis as the audited annual consolidated financial statements included elsewhere in this prospectus and, in the opinion of management, includes all adjustments of a normal, recurring nature that are necessary for the fair presentation of the results of operations for these periods in accordance with generally accepted accounting principles in the United States. This data should be read in conjunction with our audited consolidated financial statements and related notes included elsewhere in this prospectus. These quarterly operating results are not necessarily indicative of our operating results for any future period.

 

		Three Months Ended
		Mar. 31, 2012				Jun. 30, 2012				Sept. 30, 2012				Dec. 31, 2012				Mar. 31, 2013				Jun. 30, 2013				Sep. 30, 2013				Dec. 31, 2013
		(In thousands)
Revenue:
Product		$	8,550			$	9,651			$	13,754			$	20,310			$	14,988			$	17,240			$	23,729			$	32,296
Subscription and services			5,256				6,284				8,142				11,369				13,428				15,982				18,923				24,966
Total revenue			13,806				15,935				21,896				31,679				28,416				33,222				42,652				57,262
Cost of revenue:
Product			2,319				3,268				3,813				5,067				4,962				5,804				7,358				10,788
Subscription and services			599				680				904				980				1,920				4,482				6,079				6,372
Total cost of revenue			2,918				3,948				4,717				6,047				6,882				10,286				13,437				17,160
Total gross profit			10,888				11,987				17,179				25,632				21,534				22,936				29,215				40,102
Operating expenses:
Research and development			2,489				3,134				4,191				6,708				10,062				14,016				20,492				21,466
Sales and marketing			11,824				14,230				16,734				24,774				28,569				37,594				44,414				56,889
General and administrative			1,884				2,826				4,188				6,323				7,311				10,370				11,704				23,118
Total operating expenses			16,197				20,190				25,113				37,805				45,942				61,980				76,610				101,473
Operating loss			(5,309	)			(8,203	)			(7,934	)			(12,173	)			(24,408	)			(39,044	)			(47,395	)			(61,371	)
Interest income			2				1				2				2				4				48				1				15
Interest expense			(82	)			(128	)			(167	)			(160	)			(144	)			(132	)			(243	)			(6	)
Other expense, net			(210	)			(339	)			(699	)			(1,324	)			(2,200	)			(723	)			(4,206	)			(128	)
Loss before income taxes			(5,599	)			(8,669	)			(8,798	)			(13,655	)			(26,748	)			(39,851	)			(51,843	)			(61,490	)
Provision for (benefit from) income taxes			26				34				54				(1,079	)			213				384				(917	)			(58,977	)
Net loss attributable to common stockholders		$	(5,625	)		$	(8,703	)		$	(8,852	)		$	(12,576	)		$	(26,961	)		$	(40,235	)		$	(50,926	)		$	(2,513	)

 

72

---

Table of Contents

		Three Months Ended
		Mar. 31, 2012				Jun. 30, 2012				Sept. 30, 2012				Dec. 31, 2012				Mar. 31, 2013				Jun. 30, 2013				Sep. 30, 2013				Dec. 31, 2013
		(as a percentage of revenue)
Revenue:
Product			62	%			61	%			63	%			64	%			53	%			52	%			56	%			56	%
Subscription and services			38	%			39	%			37	%			36	%			47	%			48	%			44	%			44	%
Total revenue			100	%			100	%			100	%			100	%			100	%			100	%			100	%			100	%
Cost of revenue:
Product			17	%			21	%			18	%			16	%			17	%			17	%			17	%			19	%
Subscription and services			4	%			4	%			4	%			3	%			7	%			14	%			14	%			11	%
Total cost of revenue			21	%			25	%			22	%			19	%			24	%			31	%			31	%			30	%
Total gross profit			79	%			75	%			78	%			81	%			76	%			69	%			69	%			70	%
Operating expenses:
Research and development			18	%			20	%			19	%			21	%			35	%			42	%			48	%			38	%
Sales and marketing			85	%			89	%			76	%			78	%			101	%			113	%			104	%			99	%
General and administrative			14	%			18	%			20	%			20	%			26	%			32	%			27	%			40	%
Total operating expenses			117	%			127	%			115	%			119	%			162	%			187	%			179	%			177	%
Operating loss			(38	)%			(51	)%			(36	)%			(38	)%			(86	)%			(118	)%			(110	)%			(107	)%
Interest income			—	%			—	%			—	%			—	%			—	%			—	%			—	%			—	%
Interest expense			(1	)%			(1	)%			(1	)%			(1	)%			—	%			—	%			(1	)%			—	%
Other expense, net			(2	)%			(2	)%			(3	)%			(4	)%			(8	)%			(2	)%			(10	)%			—	%
Loss before income taxes			(41	)%			(54	)%			(40	)%			(43	)%			(94	)%			(120	)%			(121	)%			(107	)%
Provision for (benefit from) income taxes			—	%			1	%			—	%			(4	)%			1	%			1	%			(2	)%			(103	)%
Net loss attributable to common stockholders			(41	)%			(55	)%			(40	)%			(39	)%			(95	)%			(121	)%			(119	)%			(4	)%

 

Quarterly Revenue Trends

 

Our quarterly revenue increased year-over-year for all periods presented due to increased sales to new customers, as well as upsells to existing customers. Comparisons of our year-over-year total quarterly revenue are more meaningful than comparisons of our sequential results due to seasonality in the sale of our products and subscriptions and services. Our fourth quarter has historically been our strongest quarter for sales as a result of large enterprise buying patterns. While we believe that these seasonal trends have affected and will continue to affect our quarterly results, our rapid growth has largely masked seasonal trends to date. We believe that our business may become more seasonal in the future. Historical patterns in our business may not be a reliable indicator of our future sales activity or performance.

 

Quarterly Gross Margin Trends

 

Total gross profit increased year-over-year for all periods presented. Total gross margin has remained relatively consistent over all periods presented, and any fluctuation is primarily due to shifts in the mix of sales between products and subscriptions and services, as well as the types and volumes of products sold. For the three months ended June 30, 2013, September 30, 2013 and December 31, 2013, gross margin declined year-over-year primarily due to an increase in cost of subscription and services revenue relating to increased personnel costs in customer support.

 

Quarterly Expense Trends

 

Total operating expenses increased year-over-year for all periods presented primarily due to the addition of personnel in connection with the expansion of our business. Research and development expense increased sequentially over the periods as we increased our headcount to support continued investment in our future product and subscription and services offerings. Sales and marketing expense increased significantly in the three months ended December 31, 2012 compared to the three months ended September 30, 2012, primarily due to an

 

73

---

Table of Contents

increase in personnel costs related to increases in headcount, higher commission expense related to higher sales, and higher stock-based compensation expense. Sales and marketing expense increased significantly in both the three months ended June 30, 2013 and September 30, 2013 compared to the three months ended March 31, 2013, primarily due to an increase in personnel costs related to increases in headcount, higher commission expense related to higher sales, higher stock-based compensation expense and an increase in overhead allocations associated with additional sales and marketing personnel. General and administrative expense increased significantly in the three months ended December 31, 2012 compared to the three months ended September 30, 2012, in both the three months ended June 30, 2013 and September 30, 2013 compared to the three months ended March 31, 2013, primarily due to an increase in personnel, legal expense and higher professional services fees for preparing to be a public company. In the three months ended December 31, 2013 compared to the three months ended September 30, 2013, general and administrative expenses increased primarily due to approximately $8.5 million of expenses incurred in connection with the acquisition of Mandiant and increases in stock compensation expense. For the three months ended December 31, 2012, we recorded a benefit for income taxes due to a reduction in the valuation allowance resulting from recording a deferred tax liability on acquisition-related intangibles for which no tax benefit will be derived, partially offset by an increase in pre-tax income related to international operations.

 

Liquidity and Capital Resources

 

		As of December 31,
		2011				2012				2013
		(In thousands)
Cash and cash equivalents		$	10,676			$	60,200			$	173,918

 

		Year Ended December 31,
		2011				2012				2013
		(In thousands)
Cash provided by (used in) operating activities		$	5,111			$	21,500			$	(69,762	)
Cash used in investing activities			(5,224	)			(20,215	)			(148,469	)
Cash provided by financing activities			3,124				48,239				331,949
Net increase in cash and cash equivalents		$	3,011			$	49,524			$	113,718

 

As of December 31, 2013, our cash and cash equivalents of $173.9 million were held for working capital, capital expenditures, investment in technology and business acquisition purposes, of which approximately $16.6 million was held outside of the United States and is not presently available to fund domestic operations and obligations. If we were to repatriate cash held outside of the United States, it could be subject to U.S. income taxes, less any previously paid foreign income taxes. We have no current plans to repatriate this cash.

 

In June 2010, we entered into a loan agreement that provides for: (i) a revolving line of credit facility, (ii) an equipment facility and (iii) a term loan. In addition, this loan agreement was amended and restated in August 2011 to provide for additional borrowings under a growth facility. As of December 31, 2013, we had no outstanding borrowings under the revolving line of credit. The line of credit carries a floating interest rate equal to prime plus 1.5%, and borrowings under the line of credit are collateralized by all of our assets, excluding intellectual property. The availability of borrowings under the line of credit are subject to certain borrowing base limitations on our outstanding accounts receivable. As of December 31, 2013, amounts available under the line of credit amounted to $25.0 million. These amounts have a maturity date of December 31, 2014. In October 2013, we repaid the outstanding balance of $20.0 million.

 

Prior to our initial public offering, or IPO, in September 2013, we financed our operations primarily through private sales of equity securities and, to a lesser extent, proceeds from our bank facility and cash generated from

 

74

---

Table of Contents

operations. In September 2013, we completed our IPO pursuant to which we sold 17,450,000 shares of our common stock (inclusive of 2,275,000 shares of common stock from the exercise of the over-allotment option granted to the underwriters) at a public offering price of $20.00 per share, resulting in net proceeds of $321.0 million, after underwriting discounts and commissions and offering expenses.

 

On December 30, 2013, we acquired privately held Mandiant, a leading provider of advanced endpoint security products and security incident response management solutions. We believe this combination creates the industry’s leading advanced threat protection vendor with the ability to find and stop attacks at every stage of the attack life cycle. Under the terms of the merger agreement governing the transaction, we delivered to the former security holders of Mandiant merger consideration with an aggregate value equal to approximately $1,020.3 million, consisting of approximately $106.5 million in net cash and an aggregate of 21.5 million shares and options to purchase shares of our common stock.

 

We believe that our existing cash and cash equivalents will be sufficient to meet our anticipated cash needs for at least the next 12 months. Our future capital requirements will depend on many factors, including our growth rate, the timing and extent of spending to support development efforts, the expansion of sales and marketing activities, the introduction of new and enhanced product and service offerings, and the continuing market acceptance of our products. In the event that additional financing is required from outside sources, we may not be able to raise such financing on terms acceptable to us or at all. If we are unable to raise additional capital when desired, our business, operating results, and financial condition would be adversely affected.

 

Operating Activities

 

During the year ended December 31, 2013, operating activities used $69.8 million in cash as a result of a net loss of $120.6 million, adjusted by non-cash charges of $4.8 million and a net increase of $55.6 million in our net operating assets and liabilities. The net increase in our net operating assets and liabilities was primarily the result of a $95.0 million increase in deferred revenue as a result of increases in sales of subscriptions and support and maintenance services, a $11.5 million increase in accounts payable due to growth in our business and a $19.4 million increase in accrued compensation as a result of the growth in our headcount. This increase was partially offset by increases of $35.1 million in accounts receivable and $15.6 million in prepaid expenses, a $18.5 million decrease in accrued liabilities due to payment of Mandiant transaction costs, and a $3.1 million increase in inventory primarily driven by a large purchase of appliances from our legacy contract manufacturer to build our service inventory as we transitioned to a new contract manufacturer.

 

During the year ended December 31, 2012, operating activities provided $21.5 million in cash as a result of a net loss of $35.8 million, adjusted by non-cash charges of $15.3 million and a net increase of $42.0 million in our net operating assets and liabilities. The net increase in our net operating assets and liabilities was primarily the result of a $46.3 million increase in deferred revenue as a result of increases in sales of subscriptions and support and maintenance services and a $6.2 million increase in accounts payable due to the growth in our business and a $3.2 million increase in accrued compensation as a result of the growth in our headcount. This increase was partially offset by a $10.1 million increase in accounts receivable due to an increase in sales and a $3.1 million increase in prepaid expenses and other assets.

 

During the year ended December 31, 2011, operating activities provided $5.1 million in cash, primarily as a result of a net loss of $16.8 million, adjusted by non-cash charges of $5.0 million and a net increase of $16.9 million in our net operating assets and liabilities. The net change in our operating assets and liabilities was primarily the result of a $23.8 million increase in deferred revenue as a result of increases in sales of subscriptions and support and maintenance services and, to a lesser extent, increases in accounts payable and accrued compensation. This increase was partially offset by a $13.5 million increase in accounts receivable due to an increase in sales.

 

75

---

Table of Contents

Investing Activities

 

Cash used in investing activities during the year ended December 31, 2013 was $148.5 million, primarily resulting from the acquisition of Mandiant and from capital expenditures to purchase property and equipment and demonstration units. Cash used in investing activities during the years ended December 31, 2012 and 2011 was $20.2 million and $5.2 million, respectively, primarily resulting from capital expenditures to purchase property and equipment and demonstration units.

 

Financing Activities

 

During the year ended December 31, 2013, financing activities provided $331.9 million in cash, primarily from net proceeds of $321.0 million from our IPO, $10.0 million from the issuance of convertible preferred stock, additional borrowings of $10.0 million under our line of credit, proceeds of $7.3 million from the collection of notes receivable from stockholders as of December 31, 2012 and proceeds of $5.4 million from exercises of stock options, partially offset by payments of $22.2 million on bank borrowings.

 

During the year ended December 31, 2012, financing activities provided $48.2 million in cash, primarily from issuance of convertible preferred stock and proceeds from bank borrowings.

 

During the year ended December 31, 2011, financing activities provided $3.1 million in cash, primarily from proceeds from bank borrowings, partially offset by payments on bank borrowings.

 

Contractual Obligations and Commitments

 

The following summarizes our contractual obligations and commitments as of December 31, 2013:

 

		Payments Due by Period
		Total				Less Than 1 Year				1 - 3 Years				3 - 5 Years				More Than 5 Years
		(In thousands)
Operating leases		$	40,436			$	8,283			$	14,210			$	8,184			$	9,759
Purchase obligations			5,957				2,289				3,668				—				—
Contract manufacturer commitments			16,650				16,650				—				—				—
Total		$	63,043			$	27,222			$	17,878			$	8,184			$	9,759

 

Due to the uncertainty with respect to the timing of future cash flows associated with our unrecognized tax benefits as of December 31, 2013, we are unable to make reasonably reliable estimates of the period of cash settlement with the respective taxing authorities. Therefore, approximately $0.8 million of unrecognized tax benefits classified as “Other long-term liabilities” in the accompanying consolidated balance sheet as of December 31, 2013, have been excluded from the contractual obligations table above. In addition, we are unable to make reasonably reliable estimates with respect to approximately $45 million in noncurrent deferred tax liabilities and have therefore excluded such liabilities from the table above. See Note 12 of our consolidated financial statements for a discussion of our income tax liabilities.

 

Off-Balance Sheet Arrangements

 

As of December 31, 2012 and December 31, 2013, we did not have any relationships with unconsolidated entities or financial partnerships, such as structured finance or special purpose entities, that were established for the purpose of facilitating off-balance sheet arrangements or other purposes.

 

Segment Information

 

We have one primary business activity and operate in one reportable segment.

 

76

---

Table of Contents

Quantitative and Qualitative Disclosures about Market Risk

 

Foreign Currency Exchange Risk

 

Our sales contracts are primarily denominated in U.S. dollars. A portion of our operating expenses are incurred outside the United States and are denominated in foreign currencies and are subject to fluctuations due to changes in foreign currency exchange rates, particularly changes in the Indian Rupee, British Pound Sterling, Japanese Yen and Euro. Additionally, fluctuations in foreign currency exchange rates may cause us to recognize transaction gains and losses in our statement of operations. The effect of a hypothetical 10% adverse change in foreign exchange rates on monetary assets and liabilities at December 31, 2013 would not be material to our financial condition or results of operations. To date, foreign currency transaction gains and losses and exchange rate fluctuations have not been material to our financial statements, and we have not engaged in any foreign currency hedging transactions.

 

As our international operations grow, our risks associated with fluctuation in currency rates will become greater, and we will continue to reassess our approach to managing this risk. In addition, currency fluctuations or a weakening U.S. dollar can increase the costs of our international expansion.

 

Interest Rate Risk

 

We had cash and cash equivalents of $60.2 million and $173.9 million as of December 31, 2012 and 2013, respectively, consisting of bank deposits and money market funds. Such interest-earning instruments carry a degree of interest rate risk. To date, fluctuations in interest income have not been significant. We also had total outstanding debt of $12.1 million as of December 31, 2012, of which $1.2 million was due within 12 months. As of December 31, 2013, we had no outstanding debt. The debt outstanding prior to the fourth quarter of 2013 related to an outstanding line of credit in the amount of $20.0 million, which was repaid in October 2013. The line of credit remains available to draw upon and carries a variable interest rate equal to the prime rate plus 1.5% and is available through December 31, 2014.

 

We do not enter into investments for trading or speculative purposes and have not used any derivative financial instruments to manage our interest rate risk exposure. We have not been exposed to, nor do we anticipate being exposed to, material risks due to changes in interest rates. The interest rate on a significant majority of our outstanding debt is variable, which also reduces our exposure to these interest rate risks. A hypothetical 10% change in interest rates during any of the periods presented would not have had a material impact on our financial statements.

 

Concentration

 

Accuvant, one of our resellers, accounted for approximately 10% of our revenue for the year ended December 31, 2012. For the year ended December 31, 2013, Accuvant and Carahsoft, two of our resellers, accounted for approximately 11% and 11% of our revenue, respectively. Our agreements with these resellers were made in the ordinary course of our business and may be terminated with or without cause by either party with advance notice. Although we believe we would experience some short-term disruption in the distribution of our products, subscriptions and services if these agreements were terminated, we believe such termination would not have a material adverse effect on our financial results and that alternative resellers and other channel partners exist to deliver our products to our end-customers.

 

Critical Accounting Policies and Estimates

 

Our consolidated financial statements have been prepared in accordance with U.S. generally accepted accounting principles. The preparation of these consolidated financial statements requires us to make estimates and assumptions that affect the reported amounts of assets, liabilities, revenue, expenses, and related disclosures.

 

77

---

Table of Contents

We base our estimates on historical experience and on various other assumptions that we believe are reasonable under the circumstances. We evaluate our estimates and assumptions on an ongoing basis. Actual results may differ from these estimates. To the extent that there are material differences between these estimates and our actual results, our future financial statements will be affected.

 

The critical accounting policies requiring estimates, assumptions, and judgments that we believe have the most significant impact on our consolidated financial statements are described below.

 

Revenue Recognition

 

We generate revenue from the sales of products, subscriptions, support and maintenance and other services, primarily through our indirect relationships with our partners as well as end customers through a direct sales force. Our products include operating system software that is integrated into the appliance hardware and is deemed essential to its functionality. As a result, we account for revenue in accordance with ASC 605 and all related interpretations as all our security appliance deliverables include proprietary operating system software, which together deliver the essential functionality of our products.

 

Revenue is recognized when all of the following criteria are met:

 

•

Persuasive Evidence of an Arrangement Exists. We rely upon non-cancelable sales agreements and purchase orders to determine the existence of an arrangement.

 

•

Delivery has Occurred. We use shipping documents or receipt of transmissions of service contract registration codes to verify delivery.

 

•

The Fee is Fixed or Determinable. We assess whether the fee is fixed or determinable based on the payment terms associated with the transaction.

 

•

Collectability is Reasonably Assured. We assess collectability based on credit analysis and payment history.

 

Our products include three principal security product families that address critical vectors of attack, including Web, email and file shares. Our Web Threat Prevention, File Threat Prevention, Forensic Analysis System and Central Management System appliances and subscription services qualify as separate units of accounting. Therefore, Web Threat Prevention, File Threat Prevention, Forensic Analysis System and Central Management System appliance product revenue is recognized at the time of shipment. However, unlike our Web Threat Prevention and File Threat Prevention appliances, our Email Threat Prevention appliance cannot function without the use of our Email Threat Prevention Attachment/URL Engine, which analyzes email attachments and URLs embedded in emails for next-generation threats. As such, our Email Threat Prevention and related services do not have stand-alone value and do not qualify as separate units of accounting. Therefore, Email Threat Prevention product revenue is recognized ratably over the longer of the contractual term of the subscription services or the estimated period the customer is expected to benefit from the product, provided that all other revenue recognition criteria have been met. Because we have only been selling our Email Threat Prevention since April 2011, we have a limited history with respect to subscription renewals for such product. As a result, revenue from all Email Threat Prevention products sold by us through December 31, 2013 has been recognized ratably over the contractual term of the subscription services. At the time of shipment, product revenue generally meets the criteria for fixed or determinable fees as our partners receive an order from an end-customer prior to placing an order with us. In addition, payment from our partners is not contingent on the partners’ collection from their end-customers. Our partners do not stock products and do not have any stock rotation rights. We recognize subscription and support and maintenance services revenue ratably over the contractual service period, which is typically one or three years. Other services revenue is recognized as the services are rendered and has not been significant to date.

 

Most of our arrangements, other than renewals of subscriptions and support and maintenance services, are multiple-element arrangements with a combination of product, subscriptions, support and maintenance, and other services. For multiple-element arrangements, we allocate revenue to each unit of accounting based on an

 

78

---

Table of Contents

estimated selling price at the arrangement inception. The estimated selling price for each element is based upon the following hierarchy: vendor-specific objective evidence, or VSOE, of selling price, if available, third-party evidence, or TPE, of selling price, if VSOE of selling price is not available, or best estimate of selling price, or BESP, if neither VSOE of selling price nor TPE of selling price are available. The total arrangement consideration is allocated to each separate unit of accounting using the relative estimated selling prices of each unit based on the aforementioned selling price hierarchy. We limit the amount of revenue recognized for delivered elements to an amount that is not contingent upon future delivery of additional products or services or meeting of any specified performance conditions.

 

To determine the estimated selling price in multiple-element arrangements, we establish VSOE of selling price using the prices charged for a deliverable when sold separately and, for subscriptions and support and maintenance, based on the renewal rates and discounts offered to partners. If VSOE of selling price cannot be established for a deliverable, we establish TPE of selling price by evaluating similar and interchangeable competitor products or services in standalone arrangements with similarly situated partners. However, as our products contain a significant element of proprietary technology and offer substantially different features and functionality from our competitors, we are unable to obtain comparable pricing of our competitors’ products with similar functionality on a stand-alone basis. Therefore, we have not been able to obtain reliable evidence of TPE of selling price. If neither VSOE nor TPE of selling price can be established for a deliverable, we establish BESP primarily based on historical transaction pricing. Historical transactions are segregated based on our pricing model and our go-to-market strategy, which include factors such as type of sales channel (reseller, distributor, or end-customer), the geographies in which our products and services were sold (domestic or international), offering type (products or services), and whether or not the opportunity was identified by our sales force or by our partners. In analyzing historical transaction pricing, we evaluate whether a majority of the prices charged for a product, as represented by a percentage of list price, fall within a reasonable range. To further support the BESP of selling price as determined by the historical transaction pricing or when such information is unavailable, such as when there are limited sales of a new product, we consider the same factors we have established through our pricing model and go-to-market strategy. The determination of BESP is made through consultation with and approval by our management.

 

Shipping charges billed to partners are included in revenue and related costs are included in cost of revenue. Sales commissions and other incremental costs to acquire contracts are also expensed as incurred. After receipt of a partner order, any amounts billed in excess of revenue recognized are recorded as deferred revenue.

 

Stock-Based Compensation

 

Compensation expense related to stock-based transactions, including employee and non-employee director stock options, is measured and recognized in the financial statements based on the fair value of the awards granted. The fair value of each option award is estimated on the grant date using the Black-Scholes option-pricing model and a single option award approach. Stock-based compensation expense is recognized, net of forfeitures, over the requisite service periods of the awards, which is generally four years.

 

Our use of the Black-Scholes option-pricing model requires the input of highly subjective assumptions, including the fair value of the underlying common stock, the expected term of the option, the expected volatility of the price of our common stock, risk-free interest rates, and the expected dividend yield of our common stock. The assumptions used in our option-pricing model represent management’s best estimates. These estimates involve inherent uncertainties and the application of management’s judgment. If factors change and different assumptions are used, our stock-based compensation expense could be materially different in the future.

 

These assumptions and estimates are as follows:

 

•

Fair Value of Common Stock. Because our common stock was not publicly traded until September 20, 2013, we were required to estimate the fair value of common stock for grants made prior to that date, as discussed in “Common Stock Valuations” below.

 

79

---

Table of Contents

•

Risk-Free Interest Rate. We base the risk-free interest rate used in the Black-Scholes option-pricing model on the implied yield available on U.S. Treasury zero-coupon issues with a remaining term equivalent to that of the options for each option group.

 

•

Expected Term. The expected term represents the period that our stock-based awards are expected to be outstanding. We base the expected term assumption on our historical exercise behavior combined with estimates of the post-vesting holding period.

 

•

Volatility. We determine the price volatility factor based on the historical volatilities of our publicly traded peer group as we do not have a trading history for our common stock. Industry peers consist of several public companies in the technology industry that are similar to us in size, stage of life cycle, and financial leverage. We used the same set of peer group companies in all the relevant valuation estimates. We did not rely on implied volatilities of traded options in our industry peers’ common stock because the volume of activity was relatively low. We intend to continue to consistently apply this process using the same or similar public companies until a sufficient amount of historical information regarding the volatility of our own common stock share price becomes available, or unless circumstances change such that the identified companies are no longer similar to us, in which case, more suitable companies whose share prices are publicly available would be utilized in the calculation.

 

•

Dividend Yield. The expected dividend assumption is based on our current expectations about our anticipated dividend policy. Consequently, we used an expected dividend yield of zero.

 

The following table summarizes the assumptions used in the Black-Scholes option-pricing model to determine the fair value of our stock options as follows:

 

		Year Ended December 31,
		2011		2012		2013
Fair value of common stock		$0.57 – $1.65		$1.65 – $5.44		$6.05 – $42.37
Risk-free interest rate		1.0% – 2.8%		0.2% – 3.4%		0.6% – 2.1%
Expected term (in years)		5 – 7		1 – 6		4 – 6
Volatility		51% – 52%		49% – 53%		46% – 54%
Dividend yield		—%		—%		—%

 

In addition to the assumptions used in the Black-Scholes option-pricing model, we must also estimate a forfeiture rate to calculate the stock-based compensation expense for our awards. Our forfeiture rate is based on an analysis of our actual forfeitures. We will continue to evaluate the appropriateness of the forfeiture rate based on actual forfeiture experience, analysis of employee turnover, and other factors. Quarterly changes in the estimated forfeiture rate can have a significant impact on our stock-based compensation expense as the cumulative effect of adjusting the rate is recognized in the period the forfeiture estimate is changed. If a revised forfeiture rate is higher than the previously estimated forfeiture rate, an adjustment is made that will result in a decrease to the stock-based compensation expense recognized in the financial statements. If a revised forfeiture rate is lower than the previously estimated forfeiture rate, an adjustment is made that will result in an increase to the stock-based compensation expense recognized in the financial statements.

 

We estimate the fair value of the rights to acquire stock under our 2013 Employee Stock Purchase Plan (the “ESPP”) using the Black-Scholes option pricing formula. Our ESPP typically provides for consecutive twelve month offering periods and we use our peer group volatility data in the valuation of ESPP shares. We recognize such compensation expense on a straight-line basis over the employee’s requisite service period

 

We account for the fair value of restricted stock units (“RSUs”) using the closing market price of our common stock on the date of grant. For new-hire grants, RSUs typically vest ratably on an annual basis over four years. For annual refresh grants, RSUs typically vest ratably on an annual basis over two to four years.

 

80

---

Table of Contents

We account for the fair value of performance stock units (“PSUs”) using the closing market price of our common stock on the date of grant. We recognize compensation expense when we concluded that it is probable that the performance conditions will be achieved. We will reassess the probability of vesting at each reporting period and adjust our compensation cost based on the probability assessment.

 

We will continue to use judgment in evaluating the assumptions related to our stock-based compensation on a prospective basis. As we continue to accumulate additional data related to our common stock, we may have refinements to our estimates, which could materially impact our future stock-based compensation expense.

 

Common Stock Valuations

 

We are required to estimate the fair value of the common stock underlying our stock-based awards when performing the fair value calculations with the Black-Scholes option-pricing model. Since the completion of our IPO in September 2013, we have determined the fair value our stock price based on the closing price at the date of grant. Prior to the IPO, the fair values of the common stock underlying our stock-based awards were determined by our board of directors, with input from management and third-party valuations. We believe that our board of directors has the relevant experience and expertise to determine the fair value of our common stock. As described below, the exercise price of our stock-based awards was determined by our board of directors based on the most recent contemporaneous third-party valuation as of the grant date. If awards were granted a short period of time preceding the date of a valuation report, we assessed the fair value used for financial reporting purposes after considering the fair value reflected in the subsequent valuation report and other facts and circumstances on the date of grant as discussed below. In such instances, the fair value that we used for financial reporting purposes generally exceeded the exercise price for those awards, although we believe that relying on the preceding valuation report was appropriate for tax purposes.

 

Prior to our IPO, given the absence of a public trading market for our common stock, and in accordance with the American Institute of Certified Public Accountants Practice Guide, Valuation of Privately-Held-Company Equity Securities Issued as Compensation, our board of directors exercised reasonable judgment and considered numerous objective and subjective factors to determine the best estimate of the fair value of our common stock, including:

 

•

contemporaneous valuations performed by unrelated third-party specialists;

 

•

the prices, rights, preferences, and privileges of our convertible preferred stock relative to those of our common stock;

 

•

the lack of marketability of our common stock;

 

•

our actual operating and financial performance;

 

•

current business conditions and projections;

 

•

our hiring of key personnel and the experience of our management;

 

•

our history and the timing of the introduction of new products and services;

 

•

our stage of development;

 

•

the likelihood of achieving a liquidity event, such as an initial public offering or a merger or acquisition of our company given prevailing market conditions;

 

•

the illiquidity of stock-based awards involving securities in a private company;

 

•

the market performance of comparable publicly traded companies; and

 

•

the U.S. and global capital market conditions.

 

In valuing the common stock, the board of directors determined the fair value of our business, or Enterprise Value or EV, by taking a weighted combination of the value indications under an income approach, market approach and Probability Weighted Expected Return Method, or PWERM, approach.

 

81

---

Table of Contents

The income approach estimates the Enterprise Value based on the present value of future estimated cash flows. These future cash flows are discounted to their present values using a discount rate, which is derived from an analysis of the cost of capital of comparable publicly traded companies in the same industry or similar lines of business, or Guideline Companies, as of each valuation date. This weighted-average cost of capital discount rate, or WACC, is adjusted to reflect the risks inherent in the business. The WACC used for these valuations was determined to be reasonable and appropriate given our stage of development at the time of each respective valuation. The valuations performed during this period evaluated our business under the basis that it was initially in either the second or third stage of development as of the December 2011 valuation but moving forward toward the fourth or fifth stage of development in the March, April, May and June 2013 valuations. The income approach also assesses the residual value beyond the forecast period, or the Terminal Value, utilizing multiples from the Guideline Companies to our future revenue projections.

 

The market approaches were not always relied upon for these valuations. Specifically, the comparable companies market multiple approach and the comparable transactions market approach were not used in these valuations to determine an EV, but methods similar to these were used in the PWERM approach discussed further below. When applicable due to a recent preferred stock offering or a significant common stock repurchase, the prior sale of stock market approach was either assessed as a point of reference or actually utilized in the valuation. This approach involves examining any transactions involving the stock of the business being valued considering the following: the number of shares involved and the timing of the transaction with regard to the valuation date, the class of stock in the transaction, whether other considerations were involved and the participants in the transaction (i.e., related party or new investor), amongst others. Often this involves backing into an Enterprise Value based on the terms of the new financing or stock sale if performed at an arm’s length and with new investors.

 

The PWERM approach estimates the Enterprise Value by evaluating the following multiples as a guide for determining an EV: (1) multiples of the Guideline Companies’ Enterprise Values compared to either last 12 months revenue or EBITDA, (2) multiples of the Enterprise Values of similar companies that had recently been acquired compared to either last 12 months revenue or EBITDA, or (3) multiples of the Enterprise Values of similar companies that had recently completed an IPO compared to either last 12 months revenue or net income.

 

The equity values determined by the various valuation approaches, if more than one was used, were then weighted to determine the aggregate equity value of our business. As we moved closer to our proposed initial public offering, the weighting towards the PWERM approach increased, generally resulting in an increase in the fair value of our common stock.

 

When considering which companies to include as our Guideline Companies, we focused on U.S. based companies in the information technology industry in which we operate. More specifically, we focused on companies that address components of the network security market and networking companies with similar business models of generating revenue from the sale of both products and services, companies with a market capitalization greater than $1 billion, companies with revenue growth rates generally greater than 10%, and companies with net income and positive cash flow from operating activities. In considering companies that had recently completed an initial public offering, we selected those companies with business models similar to ours. The Guideline Companies remained mostly unchanged for the valuations during 2012 and 2013.

 

In some cases, we considered the amount of time between the valuation date and the grant date to determine whether to use the latest common stock valuation determined pursuant to one of the methods described above or to use another value based on a straight-line calculation between two valuation dates. This determination included an evaluation of whether the subsequent valuation increase was the result of specific events recognized by the board that resulted in the increase during the interim period or whether the increase was due to less visible reasons such as general improvements in the business or changes in the valuation methodologies or components.

 

The Enterprise Value determined by the income and market approaches, excluding any PWERM valuations, were then allocated to the common stock using the option pricing method, or OPM. The OPM treats common

 

82

---

Table of Contents

stock and convertible preferred stock as call options on a business, with exercise prices based on the liquidation preference of the convertible preferred stock. Therefore, the common stock has value only if the funds available for distribution to the stockholders exceed the value of the liquidation preference at the time of a liquidity event such as a merger, sale or initial public offering, assuming the business has funds available to make a liquidation preference meaningful and collectible by the stockholders. The common stock is modeled to be a call option with a claim on the business at an exercise price equal to the remaining value immediately after the convertible preferred stock is liquidated. The OPM uses the Black-Scholes option-pricing model to price the call option. The OPM is appropriate to use when the range of possible future outcomes is so difficult to predict that forecasts would be highly speculative. The PWERM was considered but not used due to the uncertainty of the board’s estimates of the probabilities for future potential liquidity events for the valuations as of December 31, 2011, June 30, 2012 and September 30, 2012. However, the PWERM was utilized for the December 31, 2012 and the March 31, April 30, May 31 and June 30, 2013 valuations.

 

In addition, we also considered an appropriate discount adjustment to recognize the lack of marketability within each valuation due to being a closely held entity.

 

Between April 1, 2012 and the date of this prospectus, we granted the following stock options:

 

Grant Date		Number of Awards Granted				Exercise Price				Fair Value Per Share of Common Stock
May 2012			3,726,611			$	1.65			$	2.21
June 2012			41,000				1.65				2.48
September 2012			1,307,850				2.48				3.66
November 2012			968,000				3.66				4.47
January 2013			3,570,844				5.44				6.05
February 2013			642,900				5.44				6.46
May 2013			3,058,900				7.93				8.73
May 2013			798,700				7.93				9.17
June 2013			1,295,450				9.68				10.21
July 2013			1,243,000				10.25				12.90
August 2013			952,500				13.00				14.67
September 2013			824,900				13.00				16.00
September 2013			367,000				20.00				20.00
October 2013			99,000				42.37				42.37
November 2013			121,100				38.86				38.86
December 2013			207,500				38.33				38.33
January 2014			314,900				73.57				73.57
February 2014			290,200				74.35				74.35

 

In addition to the stock options granted, we also granted 2,265,360, 69,632, 26,111, 23,711, 26,670, 240,000 and 5,000 shares of restricted common stock in May 2012, December 2012, May 2013, July 2013, August 2013, September 2013 and November 2013, respectively. In addition, we granted restricted stock units in January 2013, February 2013, August 2013, December 2013, February 2014 and March 2014, which are performance based and the underlying shares of common stock are subject to adjustment. In December 2013, February 2014 and March 2014, we also granted 9,350, 287,194 and 75,000 restricted stock units which are not performance based, respectively. Each of the restricted stock unit grants prior to our IPO is discussed in greater detail in the individual valuation discussions below.

 

Based upon the initial public offering price of $20.00 per share, the aggregate intrinsic value of options outstanding as of June 30, 2013 was approximately $332.1 million, of which $100.0 million related to vested options and approximately $232.1 million related to unvested options.

 

83

---

Table of Contents

We obtained independent third-party valuations, the results and timing of which were as follows:

 

Valuation Date (As of)		Fair Value Per Share of Common Stock
December 31, 2011		$	1.65
June 30, 2012			2.48
September 30, 2012			3.66
December 31, 2012			5.44
March 31, 2013			7.93
April 30, 2013			8.63
May 31, 2013			9.68
June 30, 2013			10.25

 

The following discussion relates primarily to our determination of the fair value per share of our common stock for purposes of calculating stock-based compensation expenses since April 2012. No single event caused the valuation of our common stock to increase during this period. Instead, a combination of the factors described below in each period led to the changes in the fair value of our common stock. Notwithstanding the fair value reassessments described below, we believe we applied a reasonable valuation method to determine the stock option exercise prices on the respective stock option grant dates.

 

May and June 2012

 

We granted 3,726,611 stock options in May 2012. Our board of directors set an exercise price of $1.65 per share for these options based in part on a third-party valuation prepared as of December 31, 2011. In addition, we granted 2,265,360 shares of restricted common stock in May 2012 which, by definition, do not have an exercise price. When assessing the appropriate fair value for purposes of calculating the related stock-based compensation expense for these awards, we evaluated the two surrounding valuations prepared as of December 31, 2011 and June 30, 2012.

 

The December 31, 2011 contemporaneous valuation was prepared on a minority, non-marketable basis assuming our business was in the second or third stage of development. We considered our business to be in the second or third stage of development because our product development was generally complete, we were receiving feedback from our customers and sales growth was very strong. However, there was still significant risk associated with our business plan. This valuation was developed using the income approach, specifically a discounted cash flow analysis, to determine our EV. The discounted cash flow analysis was developed based on our forecast through 2014 and utilized a WACC of 35%, which was deemed appropriate considering our stage of development. For purposes of determining a Terminal Value, the valuation applied a multiple consistent with observed revenue multiples from our Guideline Companies. This calculated value was then discounted to present value using the same WACC to determine the final Terminal Value. The resulting equity value was then allocated to the common stock utilizing an OPM with the following assumptions: a time to a liquidity event of 2.25 years, risk-free rate of 0.3%, dividend yield of 0% and volatility of 50% over the time to a liquidity event. The fair value of our common stock, as determined by an OPM and after applying a marketability discount of 30%, was $1.65 per share as of December 31, 2011.

 

The June 30, 2012 contemporaneous valuation was prepared on a minority, non-marketable basis assuming our business was in the third stage of development. We considered our business to be in the third stage of development because our sales growth remained very strong and profitability was becoming seemingly more achievable, but there was still risk around operating in a competitive market that is subject to technological change with larger established competitors. This valuation was developed using a combination of the income approach, specifically a discounted cash flow analysis, and the prior sales of stock market approach to determine our EV. The discounted cash flow analysis was developed based on our forecast through 2014 and utilized a WACC of 31% which was deemed appropriate considering our stage of development. For purposes of determining a Terminal Value, the valuation applied a multiple consistent with observed revenue multiples from our Guideline Companies. This calculated value was then discounted to present value using the same WACC to

 

84

---

Table of Contents

determine the final Terminal Value. The resulting equity value was then allocated to the common stock utilizing an OPM with the following assumptions: a time to a liquidity event of 2.0 years, risk-free rate of 0.3%, dividend yield of 0% and volatility of 57% over the time to a liquidity event. The fair value of our common stock under the income approach, as determined by an OPM and after applying a marketability discount of 25%, was $2.35 per share as of June 30, 2012. When combined with the results from the prior sale of stock under the market approach, the fair value of our common stock as of June 30, 2012 was determined to be $2.48 per share.

 

The primary reasons for the increase in fair value from the December 31, 2011 valuation to the June 30, 2012 valuation was the decrease in the WACC due to the evolution of our business’s stage of development and the use of a higher multiple in the Terminal Value calculation as we were recognizing record growth in revenue. These changes directly resulted in an increase in EV from December 2011 to June 2012. In addition, the OPM in the June 2012 valuation utilized a slightly shorter time to a liquidity event due to the passage of time, and the valuation utilized a lower marketability discount as we neared this assumed liquidity event.

 

For financial reporting purposes for the awards granted in May 2012, we applied a straight-line calculation between the $1.65 per share determined in the contemporaneous third-party valuation as of December 31, 2011 and the $2.48 per share determined in the contemporaneous third-party valuation as of June 30, 2012 to determine the fair value of our common stock on the grant date. Using the benefit of hindsight, we determined that the straight-line calculation would provide the most appropriate conclusion for the valuation of our common stock on the interim dates between valuations because we did not identify any single event or series of events that occurred during this interim period that would have caused a material change in fair value. Based on this calculation, we assessed the fair value of our common stock for awards granted in May 2012 to be $2.21 per share.

 

In addition, we granted 41,000 stock options in June 2012. Our board of directors set an exercise price of $1.65 per share for these options based in part on a third-party valuation prepared as of December 31, 2011 because the June 30, 2012 valuation was not completed until August 2012.

 

For financial reporting purposes for the awards granted in June 2012, we utilized the fair value of $2.48 per share determined in the contemporaneous third-party valuation as of June 30, 2012 for the grant date fair value of these awards.

 

September 2012

 

We granted 1,307,850 stock options in September 2012. Our board of directors set an exercise price of $2.48 per share for these options based in part on a third-party valuation prepared as of June 30, 2012.

 

Following the grant of these options, a contemporaneous valuation was prepared as of September 30, 2012 on a minority, non-marketable basis assuming our business was in the third stage of development. We considered our business to still be in the third stage of development because our sales growth remained very strong and it appeared that profitability was becoming more achievable, but there also remained risk around operating in a competitive market that is subject to technological change with larger established competitors. This valuation was developed using the income approach, specifically a discounted cash flow analysis, to determine our EV. The discounted cash flow analysis was developed based on our forecast through 2014 and utilized a WACC of 28% which was deemed appropriate considering our stage of development. For purposes of determining a Terminal Value, the valuation applied a multiple which was unchanged from the June 30, 2012 valuation. This multiple was determined to still be appropriate as it was still consistent with observed revenue multiples from our Guideline Companies. This calculated value was then discounted to present value using the same WACC to determine the final Terminal Value. The resulting equity value was then allocated to the common stock utilizing an OPM with the following assumptions: a time to a liquidity event of 1.75 years, risk-free rate of 0.2%, dividend yield of 0% and volatility of 55% over the time to a liquidity event. The fair value of our common stock, as determined by an OPM and after applying a marketability discount of 25%, was $3.66 per share as of September 30, 2012.

 

85

---

Table of Contents

The primary reasons for the increase in fair value from the June 30, 2012 valuation to the September 30, 2012 valuation was the decrease in the WACC as we continued to recognize record growth in revenue and improvements in our forecasting ability. In addition, the forecasts for 2013 and 2014 were revised for this valuation to show increases in revenue over the forecast used in the prior valuations. These changes directly resulted in an increase in EV from June to September 2012. In addition, the OPM in the September 2012 valuation utilized a slightly shorter time to a liquidity event due to the passage of time.

 

For financial reporting purposes for the awards granted in September 2012, we utilized the fair value of $3.66 per share determined in this contemporaneous third-party valuation as of September 30, 2012 to determine the grant date fair value of these awards.

 

November and December 2012

 

We granted 968,000 stock options in November 2012 and 69,632 shares of restricted common stock in December 2012. Our board of directors set an exercise price of $3.66 per share for the November 2012 options based in part on a third-party valuation prepared as of September 30, 2012. When assessing the appropriate fair value for purposes of calculating the related stock-based compensation expense for these awards, we evaluated the two surrounding valuations prepared as of September 30, 2012 and December 31, 2012.

 

As discussed in the preceding section, the September 30, 2012 valuation determined a fair value of $3.66 per share as of that date. The December 31, 2012 contemporaneous valuation was prepared on a minority, non-marketable basis. This valuation was developed using a combination of the prior sales of stock market approach and the PWERM approach to determine our EV. The prior sales of stock market approach incorporated our recent convertible preferred stock financing in which we sold shares of Series F convertible preferred stock at approximately $10.53 per share. Using the information from the Series F convertible preferred stock financing, the valuation determined an equity value for our business. The equity value was then allocated to the common stock utilizing an OPM with the following assumptions: a time to liquidity event of 1.5 years, risk-free rate of 0.2%, dividend yield of 0% and volatility of 55% over the time to liquidity event. The fair value of our common stock per the prior sales of stock market approach, as determined by an OPM and after applying a marketability discount of 15%, was $3.15 per share as of December 31, 2012. The ultimate fair value determined in the PWERM approach was developed by combining the results of two similar valuations, one estimating an IPO in September 2013 and the other estimating an IPO in June 2014. However, both of these valuations were derived by developing hypothetical enterprise values for three different scenarios for the selected IPO timing, a low estimate, medium estimate and high estimate, which were all iterated such that the value attributable to the Series F convertible preferred stock was equal to the purchase price of the Series F convertible preferred stock of approximately $10.53 per share in the recent financing. The results from the three scenarios were then weighted as follows: 20% for the scenario that provided the lowest fair value while the other two scenarios were each weighted by 40%. The results from the two IPO PWERM valuations were then combined with the fair value determined in the IPO by September 2013 valuation weighted by 30% and the fair value determined in the IPO by June 2014 valuation by 70%. The resulting equity value was then reduced by a marketability discount of 15% to determine a fair value under the PWERM approach of $7.73 per share. Finally, the fair value determined under the prior sales of stock market approach was weighted by 50% while the fair value determined under the PWERM approach was also weighted by 50% to determine a final fair value of $5.44 per share as of December 31, 2012.

 

The primary reasons for the increase in fair value from the September 30, 2012 valuation to the December 31, 2012 valuation was inclusion of the information from the Series F convertible preferred stock financing and the increase in multiples assessed in the PWERM approach.

 

For financial reporting purposes for the awards granted in November 2012, we applied a straight-line calculation between the $3.66 per share determined in the contemporaneous third-party valuation as of September 30, 2012 and the $5.44 per share determined in the contemporaneous third-party valuation as of December 31, 2012 to determine the fair value of our common stock on the grant date. Using the benefit of

 

86

---

Table of Contents

hindsight, we determined that the straight-line calculation would provide the most appropriate conclusion for the valuation of our common stock on the interim date between valuations because we did not identify any single event or series of events that occurred during this interim period that would have caused a material change in fair value. Based on this calculation, we determined the fair value of our common stock for awards granted in November 2012 to be $4.47 per share. In addition, we used the fair value of $5.44 per share for financial reporting purposes for the restricted common stock granted in December 2012.

 

January and February 2013

 

We granted 3,570,844 stock options in January 2013 and 642,900 stock options in February 2013. Our board of directors set an exercise price of $5.44 per share for these options based in part on a third-party valuation prepared as of December 31, 2012. In addition, we granted restricted stock units in January 2013 and February 2013, which, by definition, do not have an exercise price. The restricted stock units are performance-based awards and do not vest unless we complete our IPO by December 31, 2014. The target shares of common stock to be issued if we meet certain performance conditions would be 327,000 shares of common stock for the January 2013 restricted stock unit grant and 10,000 shares of common stock for the February 2013 restricted stock unit grant. These grants allow for a maximum issuance of 490,500 shares for the January 2013 restricted stock unit grant and 15,000 shares for the February 2013 restricted stock unit grant if we outperform with regard to these conditions. In addition, it was noted that 15,000 target shares from the January 2013 restricted stock unit grant, which allowed for a maximum issuance of 22,500 shares, were cancelled soon after the date of grant in February 2013. Because part of the performance element with respect to the restricted stock unit grants are related to our completion of an IPO, we will not recognize any expense related to these awards until the applicable performance conditions have been met. We determined the fair value of the awards on the respective grant dates based on the valuation discussion immediately following. When assessing the appropriate fair value for purposes of calculating the related stock-based compensation expense for these awards, we evaluated the two surrounding valuations prepared as of December 31, 2012 and March 31, 2013.

 

As discussed in the preceding section, the December 31, 2012 valuation determined a fair value of $5.44 per share as of that date. The March 31, 2013 valuation was prepared on a minority, non-marketable basis assuming our business was in the fourth or fifth stage of development. We considered our business to be in the fourth or fifth stage of development because our forecasting process showed reduced risks and a liquidity event was nearing. This valuation was developed using a combination of the income approach, specifically a discounted cash flow analysis, and the PWERM approach to determine our EV. The discounted cash flow analysis was developed based on our forecast through 2015 and utilized a WACC of 24%, which was deemed appropriate considering our stage of development. For purposes of determining a Terminal Value, the valuation applied a multiple consistent with observed revenue multiples from our Guideline Companies. This calculated value was then discounted to present value using the same WACC to determine the final Terminal Value. The resulting equity value was then allocated to the common stock utilizing an OPM with the following assumptions: a time to liquidity event of 1.0 year, risk-free rate of 0.2%, dividend yield of 0% and volatility of 48% over the time to a liquidity event. The fair value of our common stock from the income approach, as determined by an OPM and after applying a marketability discount of 18%, was $7.50 per share as of March 31, 2013. Similar to the December 2012 valuation, the ultimate fair value determined in the PWERM approach was developed by combining the results of two similar valuations, one estimating an IPO in September 2013 and the other estimating an IPO in June 2014. Both of these valuations, however, were derived by developing hypothetical enterprise values for three different scenarios for the selected IPO timing: a low estimate, medium estimate and high estimate. The hypothetical Enterprise Values were estimated using multiples consistent with an analysis of our Guideline Companies and an analysis of IPOs in the IT space during recent years. The results from the three scenarios were then weighted as follows: 20% for the scenario with the lowest estimated enterprise value and 40% for the other two scenarios. The results from the two IPO valuations were then combined, with the fair value determined in the IPO by September 2013 valuation weighted by 50% and the fair value determined in the IPO by June 2014 valuation weighted by 50%. This derived equity value was then reduced by a marketability discount of 18% to determine a fair value under the PWERM approach of $8.36 per share. Finally, the fair value

 

87

---

Table of Contents

determined under the income approach was weighted by 50% while the fair value determined under the PWERM approach was also weighted by 50% to determine a final fair value of $7.93 per share as of March 31, 2013.

 

The increase in fair value from the December 31, 2012 valuation to the March 31, 2013 valuation was primarily due to our success in continuing to drive revenue growth and the related increase in our forecast, as well as a higher likelihood of an IPO.

 

For financial reporting purposes for the awards granted in January and February 2013, we applied a straight-line calculation between the $5.44 per share determined in the contemporaneous third-party valuation as of December 31, 2012 and the $7.93 per share determined in the contemporaneous third-party valuation as of March 31, 2013 to determine the fair value of our common stock on the grant date. Using the benefit of hindsight, we determined that the straight-line calculation would provide the most appropriate conclusion for the valuation of our common stock on the interim date between valuations because we did not identify any single event or series of events that occurred during this interim period that would have caused a material change in fair value. Based on this calculation, we assessed the fair value of our common stock to be $6.05 per share for awards granted in January 2013 and $6.46 per share for awards granted in February 2013.

 

May 2013

 

We granted 3,857,600 stock options in May 2013. Our board of directors set an exercise price of $7.93 per share for these options based in part on a third-party valuation prepared as of March 31, 2013. In addition, we granted 26,111 shares of restricted common stock in May 2013, which, by definition, do not have an exercise price. When assessing the appropriate fair value for purposes of calculating the related stock-based compensation expense for these awards, we evaluated two surrounding valuations prepared as of April 30 and May 31, 2013.

 

The April 30, 2013 valuation was prepared on a minority, non-marketable basis assuming our business was in the fourth or fifth stage of development. We considered our business to be in the fourth or fifth stage of development because our forecasting process showed reduced risks and an approaching liquidity event. This valuation was also developed using a combination of the income approach, specifically a discounted cash flow analysis, and the PWERM approach to determine our EV. The discounted cash flow analysis was developed based on our forecast through 2015 and utilized a WACC of 24%, which was consistent with the March 31, 2013 valuation and still deemed appropriate considering our stage of development. For purposes of determining a Terminal Value, the valuation applied a multiple consistent with observed revenue multiples from our Guideline Companies. This calculated value was then discounted to present value using the same WACC to determine the final Terminal Value. The resulting equity value was then allocated to our common stock utilizing an OPM with the following assumptions: a time to liquidity event of 1.0 year, risk-free rate of 0.1%, dividend yield of 0% and volatility of 50% over the time to a liquidity event. The fair value of our common stock from the income approach, as determined by an OPM and after applying a marketability discount of 15%, was $8.04 per share as of April 30, 2013. Similar to the December 2012 and March 2013 valuations, the ultimate fair value determined in the PWERM approach was developed by combining the results of two similar valuations, one estimating an IPO in September 2013 and the other estimating an IPO in June 2014. Both of these valuations, however, were derived by developing hypothetical Enterprise Values for three different scenarios for the selected IPO timing: a low estimate, medium estimate and high estimate. The hypothetical Enterprise Values were estimated using multiples consistent with an analysis of our Guideline Companies and an analysis of IPOs in the IT space during recent years. The results from the three scenarios were then weighted as follows: 30% for the scenario with the lowest estimated Enterprise Value and 35% for the other two scenarios. The results from the two IPO valuations were then combined, with the fair value determined in the IPO by September 2013 valuation weighted by 60%, and the fair value determined in the IPO by June 2014 valuation weighted by 40%. This derived equity value was then reduced by a marketability discount of 15% to determine a fair value under the PWERM approach of $9.02 per share. Finally, the fair value determined under the income approach was weighted by 40%, while the fair value determined under the PWERM approach was weighted by 60% to determine a final fair value of $8.63 per share as of April 30, 2013.

 

88

---

Table of Contents

The May 31, 2013 valuation was prepared on a minority, non-marketable basis assuming our business was in the fourth or fifth stage of development. We considered our business to be in the fourth or fifth stage of development because our forecasting process showed reduced risks and an approaching liquidity event. This valuation was also developed using a combination of the income approach, specifically a discounted cash flow analysis, and the PWERM approach to determine our EV. The discounted cash flow analysis was developed based on our forecast through 2015 and utilized a WACC of 23%, which was a small decrease from the April 30, 2013 valuation but still deemed appropriate considering our stage of development. For purposes of determining a Terminal Value, the valuation applied a multiple consistent with observed revenue multiples from our Guideline Companies. This calculated value was then discounted to present value using the same WACC to determine the final Terminal Value. The resulting equity value was then allocated to our common stock utilizing an OPM with the following assumptions: a time to liquidity event of 1.0 year, risk-free rate of 0.1%, dividend yield of 0% and volatility of 50% over the time to a liquidity event. The fair value of our common stock from the income approach, as determined by an OPM and after applying a marketability discount of 13%, was $9.01 per share as of May 31, 2013. Similar to the December 2012 and March and April 2013 valuations, the ultimate fair value determined in the PWERM approach was developed by combining the results of two similar valuations, one estimating an IPO in September 2013 and the other estimating an IPO in June 2014. Both of these valuations, however, were derived by developing hypothetical Enterprise Values for three different scenarios for the selected IPO timing: a low estimate, medium estimate and high estimate. The hypothetical Enterprise Values were estimated using multiples consistent with an analysis of our Guideline Companies and an analysis of IPOs in the IT space during recent years. The results from the three scenarios were then weighted as follows: 30% for the scenario with the lowest estimated Enterprise Value and 35% for the other two scenarios. The results from the two IPO valuations were then combined, with the fair value determined in the IPO by September 2013 valuation weighted by 70%, and the fair value determined in the IPO by June 2014 valuation weighted by 30%. This derived equity value was then reduced by a marketability discount of 13% to determine a fair value under the PWERM approach of $9.97 per share. Finally, the fair value determined under the income approach was weighted by 30%, while the fair value determined under the PWERM approach was weighted by 70% to determine a final fair value of $9.68 per share as of May 31, 2013.

 

The increase in fair value from the March 31, 2013 valuation to the April 30 and May 31, 2013 valuations was primarily due to a higher likelihood of an IPO and our continued performance to forecast.

 

For financial reporting purposes for the awards granted in May 2013, we applied a straight-line calculation between the fair value of $8.63 per share determined in the contemporaneous third-party valuation as of April 30, 2013 and the fair value of $9.68 per share determined in the contemporaneous third-party valuation as of May 31, 2013 to determine the fair value of our common stock on the grant dates. More specifically, of the options granted in May 2013, 3,058,900 were granted on May 3, 2013 and 798,700 were granted on May 16, 2013. In addition, the 26,111 shares of restricted common stock were granted on May 3, 2013 as well. Using the benefit of hindsight, we determined that the straight-line calculation would provide the most appropriate conclusion for the valuation of our common stock on the interim date between valuations because we did not identify any single event or series of events that occurred during the month of May 2013 that would have caused a material change in fair value. Based on this calculation, we assessed the fair value of our common stock to be $8.73 per share for awards granted on May 3, 2013 and $9.17 per share for awards granted on May 16, 2013.

 

June 2013

 

We granted 1,295,450 stock options in June 2013. Our compensation committee set an exercise price of $9.68 per share for these options based in part on a third-party valuation prepared as of May 31, 2013. When assessing the appropriate fair value for purposes of calculating the related stock-based compensation expense for these awards, we evaluated two surrounding valuations prepared as of May 31, 2013 and June 30, 2013.

 

As discussed in the preceding section, the May 31, 2013 valuation determined a fair value of $9.68 per share as of that date. The June 30, 2013 valuation was prepared on a minority, non-marketable basis assuming our

 

89

---

Table of Contents

business was in the fourth or fifth stage of development. We considered our business to be in the fourth or fifth stage of development because our forecasting process showed reduced risks and an approaching liquidity event. This valuation was also developed using a combination of the income approach, specifically a discounted cash flow analysis, and the PWERM approach to determine our EV. The discounted cash flow analysis was developed based on our forecast through 2015 and utilized a WACC of 22%, which was a small decrease from the May 31, 2013 valuation but still deemed appropriate considering our stage of development. For purposes of determining a Terminal Value, the valuation applied a multiple consistent with observed revenue multiples from our Guideline Companies. This calculated value was then discounted to present value using the same WACC to determine the final Terminal Value. The resulting equity value was then allocated to our common stock utilizing an OPM with the following assumptions: a time to liquidity event of 0.75 years, risk-free rate of 0.1%, dividend yield of 0% and volatility of 46% over the time to a liquidity event. The fair value of our common stock from the income approach, as determined by an OPM and after applying a marketability discount of 10%, was $9.67 per share as of June 30, 2013. Similar to the December 2012 and the March, April and May 2013 valuations, the ultimate fair value determined in the PWERM approach was developed by combining the results of two similar valuations, one estimating an IPO in September 2013 and the other estimating an IPO in June 2014. Both of these valuations, however, were derived by developing hypothetical Enterprise Values for three different scenarios for the selected IPO timing: a low estimate, medium estimate and high estimate. The hypothetical Enterprise Values were estimated using multiples consistent with an analysis of our Guideline Companies and an analysis of IPOs in the IT space during recent years. The results from the three scenarios were then weighted as follows: 30% for the scenario with the lowest estimated Enterprise Value and 35% for the other two scenarios. The results from the two IPO valuations were then combined, with the fair value determined in the IPO by September 2013 valuation weighted by 70%, and the fair value determined in the IPO by June 2014 valuation weighted by 30%. This derived equity value was then reduced by a marketability discount of 10% to determine a fair value under the PWERM approach of $10.50 per share. Finally, the fair value determined under the income approach was weighted by 30%, while the fair value determined under the PWERM approach was weighted by 70% to determine a final fair value of $10.25 per share as of June 30, 2013.

 

The increase in fair value from the May 31, 2013 valuation to the June 30, 2013 valuation was primarily due to our continued performance against forecast.

 

For financial reporting purposes for the awards granted in June 2013, we applied a straight-line calculation between the fair value of $9.68 per share determined in the contemporaneous third-party valuation as of May 31, 2013 and the fair value of $10.25 per share determined in the contemporaneous third-party valuation as of June 30, 2013 to determine the fair value of our common stock on the grant date. Using the benefit of hindsight, we determined that the straight-line calculation would provide the most appropriate conclusion for the valuation of our common stock on the interim date between valuations because we did not identify any single event or series of events that occurred during the month of June 2013 that would have caused a material change in fair value. Based on this calculation, we assessed the fair value of our common stock to be $10.21 per share for awards granted in June 2013.

 

July 2013

 

We granted 1,243,000 stock options in July 2013. Our compensation committee set an exercise price of $10.25 per share for these options based in part on a third-party valuation prepared as of June 30, 2013. In addition, we granted 23,711 shares of restricted common stock in July 2013, which, by definition, do not have an exercise price.

 

When assessing the appropriate fair value for purposes of calculating the related stock-based compensation expense for these awards, we initially evaluated the valuation prepared as of June 30, 2013 and our original anticipated initial offering price range of $11.00 to $15.00 per share.

 

90

---

Table of Contents

We believe the difference between the third-party valuation we obtained as of June 30, 2013, and our original anticipated initial offering price range is a result of the following factors:

 

First, the initial offering price range necessarily assumed that our initial public offering had occurred and a public market for our common stock had been created and, therefore, excluded the discounts associated with the timing or likelihood of an initial public offering, which were appropriately included in the valuation prepared as of June 30, 2013. The assumptions in the June 2013 valuation that changed in the determination of the initial offering price range include (i) a decrease in the non-marketability discount from 10% to 0%, (ii) a change in the probability of a September 2013 initial public offering from 70% to 100% and (iii) the elimination of using the income approach to inform the initial offering price range.

 

Second, after discussions among the underwriters, management, and our board of directors, the original anticipated initial offering price range was informed by the performance of a broader group of comparable companies that have recently completed their initial public offerings, including SaaS software companies that were considered as comparable companies for purposes of our initial public offering. The Guideline Companies that informed our June 2013 valuation typically have product offerings that include an equipment component. The additional comparable companies that informed the initial offering price range typically have higher revenue multiples than the Guideline Companies. As a result, the June 2013 valuation assigned a lower hypothetical Enterprise Value than the estimated value that informed the determination of the initial offering price range.

 

For financial reporting purposes for the awards granted in July 2013, we initially applied a straight-line calculation between the fair value of $10.25 per share determined in the contemporaneous third-party valuation as of June 30, 2013 and the midpoint of the original anticipated initial offering price range of $11.00 to $15.00 per share to determine the fair value of our common stock on the grant date. Using the benefit of hindsight, we determined that the straight-line calculation would provide the most appropriate conclusion for the valuation of our common stock on the interim date between valuations because we did not identify any single event or series of events that occurred during the month of July 2013 that would have caused a material change in fair value. Based on this calculation, we initially assessed the fair value of our common stock to be $11.90 per share for awards granted in July 2013.

 

As more fully described under “—Offering Price Range and Fair Value Reassessment” below, on September 18, 2013, we retrospectively reassessed the fair value of our common stock for the July 2013 grants for financial reporting purposes to be $12.90 per share.

 

August 2013

 

We granted 952,500 stock options in August 2013. In addition, we granted 26,670 shares of restricted common stock in August 2013, which, by definition, do not have an exercise price.

 

In addition, we granted restricted stock units in August 2013, which, by definition, do not have an exercise price. The restricted stock units are performance-based awards and were not scheduled to vest unless we completed our IPO by December 31, 2014. The target shares of common stock to be issued if we meet certain performance conditions would be 40,000 shares of common stock. This grant allows for a maximum issuance of 60,000 shares if we outperform with regard to these conditions. Because part of the performance element with respect to the restricted stock unit grants are related to our completion of an IPO, we will not recognize any expense related to these awards until the applicable performance conditions have been met.

 

When assessing the appropriate fair value for purposes of calculating the related stock-based compensation expense for these awards, we initially used the midpoint of our original anticipated initial public offering price range of $11.00 to $15.00 per share.

 

As more fully described under “—Offering Price Range and Fair Value Reassessment” below, on September 18, 2013, we retrospectively reassessed the fair value of our common stock for the August 2013 grants for financial reporting purposes to be $14.67 per share.

 

91

---

Table of Contents

September 2013

 

We granted 824,900 stock options on September 4, 2013. In addition, we granted 240,000 shares of restricted common stock on September 3, 2013, which, by definition, do not have an exercise price.

 

When assessing the appropriate fair value for purposes of calculating the related stock-based compensation expense for these awards, we initially used $13.00, the midpoint of the price range reflected on the cover page of our preliminary prospectus dated September 9, 2013.

 

As more fully described under “—Offering Price Range and Fair Value Reassessment” below, on September 18, 2013, we retrospectively reassessed the fair value of our common stock for the September 4, 2013 grants for financial reporting purposes to be $16.00 per share.

 

We granted 367,000 stock options on September 19, 2013 with an exercise price of $20.00 per share, which was equal to the initial public offering price.

 

Offering Price Range and Fair Value Reassessment

 

On September 9, 2013, we, along with our managing underwriters, began the marketing phase of our proposed initial public offering. At that time, our preliminary prospectus continued to reflect a preliminary price range of $12.00 to $14.00 per share. After a series of meetings with potential investors that took place during the week of September 9, 2013, our board of directors met with our managing underwriters and members of our senior management team on September 16, 2013 and determined that, as a result of the level of interest in our proposed initial public offering from potential investors, we should increase our preliminary price range to $15.00 to $17.00 per share. On September 17, 2013, we filed an updated preliminary prospectus with the SEC reflecting the increase in our preliminary price range.

 

As a result of the increase in our preliminary price range, we revised our estimate of the fair value of our common stock for the July 2013, August 2013 and September 2013 grants described above. We applied a straight-line calculation between the fair value of $10.25 per share determined in the contemporaneous third-party valuation as of June 30, 2013 and the midpoint of the increased anticipated initial offering price range of $16.00 per share to determine the fair value of our common stock for the July 2013 and August 2013 grants. We used the midpoint of the increased price range of $16.00 per share as our estimated fair value for the September 2013 grants. Using the benefit of hindsight, we determined that the straight-line calculation would provide the most appropriate conclusion for the valuation of our common stock during this period because we did not identify any single event or series of events that occurred during this period that would have caused a material change in fair value.

 

As a result of reassessing the fair value of our common stock, we recorded additional stock-based compensation expense over the vesting period of the awards granted in July 2013, August 2013 and September 2013.

 

Stock-Based Awards Granted Subsequent to our Initial Public Offering.

 

For stock-based awards granted subsequent to our IPO, our board of directors determined the fair market value based on the closing price of our common stock as reported on The NASDAQ Global Select Market on the date of grant.

 

Warrants

 

Warrants to purchase shares of our convertible preferred stock are classified as a liability on the consolidated balance sheet at fair value because the warrants contain “down-round protection” and therefore, do not meet the scope exception for treatment as a derivative. The fair value of the warrants is estimated using the

 

92

---

Table of Contents

Monte Carlo model at each reporting date. The change in fair value of the warrants is then recorded on the consolidated statements of operations as other expense. We use management judgment to estimate the fair value of these warrants, and these estimates could differ significantly in the future. We determined the fair value of the outstanding convertible preferred stock warrants utilizing a Monte Carlo model with the following assumptions as of December 31, 2012:

 

		As of December 31,
		2012
Remaining contractual term (in years)		2.6 – 8.7
Risk-free interest rate		0.3% – 1.5%
Volatility		55% – 64%
Change of control probability		25% – 50%
Control premium		40%
IPO threshold (in billions)		$0.6 – $1.8

 

The above assumptions were determined as follows:

 

Remaining contractual term—The remaining contractual term represents the time from the date of the valuation to the expiration of the warrant;

 

Risk-free interest rate—The risk-free interest rate is based on the U.S. Treasury yield in effect as of December 31, 2011 and 2012 for zero coupon U.S. Treasury notes with maturities approximately equal to the term of the warrant;

 

Volatility—The volatility is derived from historical volatilities of several unrelated publicly listed peer companies over a period approximately equal to the term of the warrant because we have limited information on the volatility of the convertible preferred stock because there is currently no trading history. When making the selections of industry peer companies to be used in the volatility calculation, we considered the size, operational and economic similarities to our principle business operations;

 

Change of control probability—The change of control probability is the board of directors’ estimate of the probability that we are involved with a change of control transaction; and

 

Control premium—The control premium represents an additional amount above the value of an entity’s common stock that an investor would be willing to pay to obtain control over that entity.

 

Prior to our IPO, the fair value of the warrants was recorded as a warrant liability upon issuance. The warrant was recorded at its estimated fair value utilizing the Monte Carlo model with changes in the fair value of the warrant liability reflected in other expense, net. Upon the completion of our IPO, the shares underlying the warrants were converted from preferred stock into approximately 616,000 shares of common stock, and the related balance of the preferred stock warrant liability was reclassified to additional paid-in capital and was no longer subject to fair value accounting.

 

As of December 31, 2012, all of the convertible preferred stock warrants remained outstanding as follows (in thousands, except share and per share amounts):

 

Class of Shares		Issuance Dates		Expiration Dates		No. of Shares				Exercise Price per Share				Fair Value as of December 31,
														2012
Series A-2		2005 and 2006		2015 and 2016			245,899			$	0.61			$	1,632
Series B		2006 through 2008		2016 through 2018			118,942			$	1.32				925
Series D		June 2010		June 2020			100,000			$	0.39				634
Series E		August 2011		August 2021			60,661			$	1.36				338
Total														$	3,529

 

93

---

Table of Contents

During the years ended December 31, 2011, 2012 and 2013, we recognized charges in the amount of $0.8 million, $2.5 million and $6.5 million, respectively, from the remeasurement of the fair value of the warrants, which was recorded through other expense, net in our consolidated statements of operations.

 

Income Taxes

 

We account for income taxes using the asset and liability method, which requires the recognition of deferred tax assets and liabilities for the expected future tax consequences of events that have been recognized in our financial statements or tax returns. In addition, deferred tax assets are recorded for the future benefit of utilizing net operating losses and research and development credit carryforwards. Valuation allowances are provided when necessary to reduce deferred tax assets to the amount expected to be realized.

 

We apply the authoritative accounting guidance prescribing a threshold and measurement attribute for the financial recognition and measurement of a tax position taken or expected to be taken in a tax return. We recognize liabilities for uncertain tax positions based on a two-step process. The first step is to evaluate the tax position for recognition by determining if the weight of available evidence indicates that it is more likely than not that the position will be sustained on audit, including resolution of related appeals or litigation processes, if any. The second step requires us to estimate and measure the tax benefit as the largest amount that is more than 50% likely to be realized upon ultimate settlement.

 

Significant judgment is required in evaluating our uncertain tax positions and determining our provision for income taxes. Although we believe our reserves are reasonable, no assurance can be given that the final tax outcome of these matters will not be different from that which is reflected in our historical income tax provisions and accruals. We adjust these reserves in light of changing facts and circumstances, such as the closing of a tax audit or the refinement of an estimate. To the extent that the final tax outcome of these matters is different than the amounts recorded, such differences may impact the provision for income taxes in the period in which such determination is made.

 

Significant judgment is also required in determining any valuation allowance recorded against deferred tax assets. In assessing the need for a valuation allowance, we consider all available evidence, including scheduled reversal of deferred tax liabilities, past operating results, estimates of future taxable income, and the feasibility of tax planning strategies. We reversed our valuation allowance on U.S. federal and certain state deferred tax assets during the year ended December 31, 2013 as a result of the scheduled reversal of deferred tax liabilities established in purchase accounting. We have maintained a valuation allowance on California net deferred tax assets as it is not more likely than not that these net deferred tax assets will be realized. As we reverse deferred tax liabilities in subsequent periods, we will likely re-establish a valuation allowance in these jurisdictions as it is not more likely than not that these deferred tax assets can be realized outside of the scheduled reversal of deferred tax liabilities.

 

Estimates of future taxable income are based on assumptions that are consistent with our plans. Assumptions represent management’s best estimates and involve inherent uncertainties and the application of management’s judgment. Should actual amounts differ from our estimates, the amount of our tax expense and liabilities could be materially impacted.

 

We do not provide for a U.S. income tax liability on undistributed foreign earnings of our foreign subsidiaries. The earnings of non-U.S. subsidiaries are indefinitely reinvested in non-U.S. operations.

 

Contract Manufacturer Liabilities

 

We outsource most of our manufacturing, repair, and supply chain management operations to our independent contract manufacturers and payments to them are a significant portion of our product cost of revenue. Although we could be contractually obligated to purchase manufactured products, we generally do not own the manufactured products. Product title transfers from our independent contract manufacturers to us and immediately to our partners upon shipment. Our independent contract manufacturers assemble our products using

 

94

---

Table of Contents

design specifications, quality assurance programs, and standards that we establish, and they procure components and assemble our products based on our demand forecasts. These forecasts represent our estimates of future demand for our products based upon historical trends and analysis from our sales and product management functions as adjusted for overall market conditions. If the actual component usage and product demand are significantly lower than forecast, we accrue for costs for contractual manufacturing commitments in excess of our forecasted demand, including costs for excess components or for carrying costs incurred by our contract manufacturers. To date, we have not accrued any significant costs associated with this exposure.

 

As of December 31, 2012 and 2013, we had approximately $3.3 million and $16.7 million, respectively, of open orders with our contract manufacturers that may not be cancelable.

 

Loss Contingencies

 

We are subject to the possibility of various loss contingencies arising in the ordinary course of business. We consider the likelihood of loss or impairment of an asset, or the incurrence of a liability, as well as our ability to reasonably estimate the amount of loss, in determining loss contingencies. An estimated loss contingency is accrued when it is probable that an asset has been impaired or a liability has been incurred and the amount of loss can be reasonably estimated. If we determine that a loss is possible and the range of the loss can be reasonably determined, then we disclose the range of the possible loss. We regularly evaluate current information available to us to determine whether an accrual is required, an accrual should be adjusted or a range of possible loss should be disclosed.

 

Warranties

 

We generally provide a one-year warranty on our hardware and a three-month warranty on our software products. We do not accrue for potential warranty claims as a component of cost of product revenue as all product warranty claims are satisfied under our support and maintenance contracts.

 

Goodwill

 

Goodwill is the excess of the aggregate purchase price paid over the fair value of the net tangible assets acquired. Goodwill is not amortized and is tested for impairment at least annually or whenever events or changes in circumstances indicate that the carrying value may not be recoverable. We have determined that we operate as one reporting unit and have selected December 1 as the date to perform our annual impairment test. In the valuation of our goodwill, we must make assumptions regarding estimated future cash flows to be derived from our business. If these estimates or their related assumptions change in the future, we may be required to record impairment for these assets. The first step of the impairment test involves comparing the fair value of the reporting unit to its net book value, including goodwill. If the net book value exceeds its fair value, then we would perform the second step of the goodwill impairment test to determine the amount of the impairment loss. The impairment loss would be calculated by comparing our implied fair value to our net book value. In calculating the implied fair value of our goodwill, our fair value would be allocated to all of the other assets and liabilities based on their fair values. The excess of our fair value over the amount assigned to our other assets and liabilities is the implied fair value of goodwill. An impairment loss would be recognized when the carrying amount of goodwill exceeds its implied fair value. There was no impairment of goodwill recorded for the years ended December 31, 2013, 2012 or 2011.

 

Recent Accounting Pronouncements

 

In February 2013, the FASB issued guidance which addresses the presentation of amounts reclassified from accumulated other comprehensive income. This guidance does not change current financial reporting requirements, instead an entity is required to cross-reference to other required disclosures that provide additional detail about amounts reclassified out of accumulated other comprehensive income. In addition, the guidance

 

95

---

Table of Contents

requires an entity to present significant amounts reclassified out of accumulated other comprehensive income by line item of net income if the amount reclassified is required to be reclassified to net income in its entirety in the same reporting period. Adoption of this standard is required for periods beginning after December 15, 2012 for public companies. This new guidance impacts how we report comprehensive income and will have no effect on our results of operations, financial position or liquidity upon its required adoption on January 1, 2013.

 

96

---

Table of Contents

BUSINESS

 

Overview

 

We provide a comprehensive solution of products and services for detecting, preventing and resolving advanced cybersecurity threats. We have invented a purpose-built, virtual machine-based security platform that provides real-time protection to enterprises and governments worldwide that are facing the next generation of cyber attacks. Our technology approach represents a paradigm shift in how IT security has been conducted since the earliest days of the information technology industry. The core of our purpose-built, virtual machine-based security platform is our virtual execution, or MVX, engine, which identifies and protects against known and unknown threats that existing signature-based technologies are unable to detect. The new generation of cyber attacks on organizations, including large and small enterprises and governments worldwide, is characterized by an unprecedented escalation in the complexity and scale of advanced malware created by criminal organizations and nation-states. These highly sophisticated cyber attacks routinely circumvent traditional signature-based defenses by launching dynamic, stealthy and targeted malware that penetrates defenses in multiple stages and through multiple entry points of an IT network. Our proprietary virtual machine-based technology represents a new approach to detecting these cyber attacks in real time with high efficacy while also scaling in response to ever-increasing network performance requirements. We believe it is imperative for organizations to invest in this new approach to security to protect their critical assets, such as intellectual property and customer and financial data, from the global pandemic of cybercrime, cyber espionage and cyber warfare.

 

Our over ten years of research and development in proprietary virtual machine technology, anomaly detection and associated heuristic, or experience-based, algorithms enables us to provide real-time, dynamic threat protection without the use of signatures while delivering high efficacy and network performance. We provide a comprehensive platform that employs a virtualized execution engine and a cloud-based threat intelligence network that uniquely protects organizations from next-generation threats at all stages of the attack lifecycle and across all primary threat vectors, including Web, email, file and mobile. Our MVX engine detonates, or “runs,” Web objects, suspicious attachments and files within purpose-built virtual machine environments to detect and block the full array of next-generation threats, including attacks that leverage unknown vulnerabilities in widely used software programs, also known as “zero-day” attacks. Newly identified threats are quarantined to prevent exposure to the organization’s actual network environment, and information regarding such threats is sent to our Dynamic Threat Intelligence, or DTI, cloud. Our DTI cloud enables real-time global sharing of threat intelligence uploaded by our customers’ cloud-connected FireEye appliances.

 

In December 2013, we acquired privately held Mandiant, the leading provider of advanced endpoint security products and security incident response management solutions. FireEye and Mandiant have been strategic partners with integrated product offerings since April 2012. We believe the combination of the two companies deepens this partnership and creates the industry’s leading advanced threat protection vendor with the ability to find and stop attacks at every stage of the attack life cycle. The combination of our industry leading security products and threat intelligence with products and services from Mandiant enables us to provide a complete solution for detecting, preventing and resolving advanced cybersecurity threats across three distinct disciplines:

 

•

First, Mandiant provides endpoint-based advanced threat detection and response. Mandiant’s endpoint products enable security teams to enhance their visibility and make faster, more accurate decisions about potential security incidents occurring across an organization’s network and endpoints.

 

•

Second, Mandiant brings significant depth in intelligence on next-generation attacks, which is continually gathered from ongoing monitoring of more than two million endpoints and by incident response and remediation teams that serve on the front lines combating the most advanced attacks. When this depth of threat intelligence is paired with the breadth of the FireEye real-time threat intelligence gathered from more than two million virtual machines, organizations will have robust detection and contextual information about attempted attacks, including the level of risk, the identity of the attackers, and the intended target of the attacks.

 

97

---

Table of Contents

•

Third, Mandiant’s team of highly skilled incident response experts has performed hundreds of incident response investigations across numerous industries at some of the largest organizations in the world. In addition, Mandiant brings its Managed Defense monitoring service to FireEye. The addition of these skills and expertise significantly expands our ability to offer value-added services to our customers.

 

Our platform is delivered through a family of software-based appliances and includes our cloud subscription services as well as support and maintenance services. Our principal threat prevention appliance families address four critical vectors of attack: Web, email, file and mobile. We also provide a family of threat prevention appliances that enable rapid identification and remediation of attacks that have penetrated and are residing on an organization’s endpoints, such as desktop computers, laptops, or mobile devices. Our management appliances serve as a central nervous system unifying reporting and configuration, while monitoring and correlating attacks that simultaneously cross multiple vectors of the network, thereby increasing the efficacy of our security platform. Our management appliances enable us to share intelligence regarding threats at a local implementation level and also across the organization. In addition, we enhance the efficacy of our solution by sharing with customers anonymized global threat data through our DTI cloud. We also offer a forensic analysis appliance that provides IT security analysts with the ability to test, characterize and conduct forensic examinations on next-generation cyber attacks by simulating their execution path with our virtual machine technology. Our cloud-based mobile threat prevention platform identifies and stops mobile threats by analyzing mobile applications within our MVX engine. Finally, we offer incident response and managed services to assist our customers who have been breached as part of our full service solution to combat advanced threats.

 

As part of our sales strategy, we often provide prospective customers with our products for a short-term evaluation period. As of December 31, 2013, we had conducted over 4,400 of these evaluations across many countries and with companies of all sizes. In each case, our products are deployed within the prospective customer’s network, typically for a period ranging from one week to several months. During this period, the prospective customer conducts evaluations with the assistance of our system engineers and members of our security research team. These evaluations have been part of our ordinary course business practices for the past two years. In over 95% of these prospective customer evaluations, we have discovered incidents of next-generation threats that were conducting malicious activities and that successfully evaded the prospective customers’ existing security infrastructure, including traditional firewalls, next-generation firewalls, intrusion prevention systems, anti-virus software, email security and Web filtering appliances. By deploying our platform, organizations can stop inbound attacks and outbound theft of valuable intellectual property and data with a negligible false-positive rate, enabling them to avoid potentially catastrophic financial and intellectual property losses, reputational harm and damage to critical infrastructures.

 

Our sales model consists of a direct sales team and channel partners that collaborate to identify new sales prospects, sell products and services, and provide post-sale support. We believe this approach allows us to maintain face-to-face connectivity with our customers, including key enterprise accounts, and helps us support our partners, while leveraging their reach and capabilities. Further, we believe our leading incident response capabilities position us as a trusted advisor to our customers and offer us the opportunity to help customers prevent future breaches through the use of our products and services. As of December 31, 2013, we had over 1,900 end-customers across more than 60 countries, including over 130 of the Fortune 500. Our customers include leading enterprises in a diverse set of industries, including telecommunications, technology, financial services, public utilities, healthcare and oil and gas, as well as leading U.S. and international governmental agencies.

 

For 2011, 2012 and 2013, our revenue was $33.7 million, $83.3 million and $161.6 million, respectively, representing year-over-year growth of 148% for 2012 and 94% for 2013, and our net losses were $16.8 million, $35.8 million and $120.6 million, respectively. Subscription and services revenue, which represents a recurring portion of our revenue, has increased as a percentage of revenue over the last three years, from 37% in 2012 to 45% for 2013.

 

98

---

Table of Contents

Industry Background

 

Organizations Are Spending Billions On Signature-Based Security Technologies

 

Organizations today are embracing a confluence of technologies to enhance the productivity of their employees, generate new revenue sources and improve their operating efficiency. These technologies include cloud services, mobile computing and online services and social networking sites, such as LinkedIn, Facebook and Twitter. This emergence of an increasingly distributed IT infrastructure, along with the explosion in the diversity, scale and importance of this infrastructure has greatly increased the vulnerability of these organizations to potential security attacks. This greater reliance on information technology has resulted in significant investments in IT security products and personnel to help protect against a myriad of potential threats. According to IDC, a global market research firm, 2013 worldwide IT security spending was approximately $16.8 billion, including investments in traditional security technologies such as firewalls, virtual private networking, Web security, unified threat management, intrusion detection and prevention, messaging security and corporate endpoint security.⁴ In order to deploy and manage these products, organizations are relying upon an increasingly large staff of highly specialized IT security personnel.

 

To date, organizations have deployed security products to protect their IT infrastructure against earlier generations of security threats. These security products typically fell into two main categories. First, technologies like firewalls were developed in order to enforce a set of policies that governed which types of traffic would be allowed onto an organization’s network. Second, technologies like intrusion detection and anti-virus software were developed to protect against potential security threats embedded within an organization’s traffic. These technologies defended against earlier generations of security threats by utilizing signature-based threat protection technology. The signature model works by forensically examining the code base of known malware and, if no match is found, subsequently developing a signature that network security devices can match against future incoming traffic. These signatures are gathered by IT security companies and distributed periodically to organizations that subscribe to the security company’s update service. This signature-based approach is the principal foundation of existing threat protection technologies.

 

Next-Generation Threats Present New Challenges For Organizations

 

In general, cyber attacks from the late 1990s and early 2000s were intentionally designed to be visible and to be distributed as separate stand-alone software components, making them relatively easy and straightforward for security devices to identify, analyze and prevent. These early generation attacks were deployed less frequently than advanced threats. As a result, IT departments were generally able to respond more effectively to patch system vulnerabilities. These attacks generally consisted of malicious software, or malware, that would be performed only the first time it was encountered by the organization. Because this type of malware was not designed to be persistent, it had significantly less potential to cause incremental damage beyond its initial attack. Moreover, the historical threat landscape was defined by amateur hackers who launched attacks principally for fame or mischief. While these hackers garnered media attention, they caused relatively little damage, and signature-based security solutions were effective at detecting and preventing them. These threats were not targeted at specific individuals or specific IT security vulnerabilities within an organization. Rather, the attacks were broad based in nature and therefore less damaging. Attacks such as these represent the majority of attacks faced by organizations during the last 20 years.

 

Today’s security attacks are being conducted by increasingly sophisticated threat actors

 

Today’s organizations face an advanced malware pandemic of unprecedented severity led by “advanced persistent threat actors,” such as cybercriminals, nation-states and hacktivists. Cybercriminals are expending significant resources to exfiltrate sensitive intellectual property and personal data from organizations, causing financial and reputational damage; nation-states are pursuing cyber espionage and warfare targeting critical infrastructure, such as power grids, and highly sensitive information that can threaten national security; and

 

4

See note (2) in “Market and Industry Data.”

 

99

---

Table of Contents

hacktivists, who are driven by political ideologies, are defacing Websites, stealing information and launching denial of service attacks. These threat actors are utilizing highly sophisticated next-generation threats to circumvent traditional IT defenses at an alarming rate. Given their significant resources, nation-states and organized cyber criminals are now employing automated, constantly changing threats known as “polymorphic attacks” to penetrate mission critical systems. These sophisticated groups are constantly evolving their capabilities to penetrate IT infrastructure, steal sensitive information, and conduct espionage and cyber warfare. They have the human and financial resources to continuously modify and improve attacks to identify and exploit network vulnerabilities that will allow them to breach a target’s network. A 2011 Ponemon Institute study estimated a 44% increase in successful cyber attacks from the prior year. Contributing to this trend is a rise in state sponsored cyber-espionage with many countries armed for cyber warfare. The problem has become so severe that the United States Department of Defense recently elevated cyberspace in the 2010 Quadrennial Defense Report to be a domain on the same level of importance as land, sea, air and space. In addition, cyber attacks are listed as a top national security threat in the 2013 Worldwide Threat Assessment of the US Intelligence Community.

 

These threat actors are utilizing highly sophisticated techniques that differ dramatically from earlier generation threats

 

Next-generation threats, utilized by advanced persistent threat actors, are fundamentally different from earlier generation threats, with a unique set of characteristics that create a new set of detection and prevention challenges. One of the most dangerous characteristics of next-generation threats is their ability to take advantage of a previously unknown vulnerability in widely used software programs, creating what is known as “zero day” threats. By exploiting this vulnerability, significant damage can be done because it can take days before signature-based software vendors discover the vulnerability and patch it, and an even longer period of time for traditional security products to update their signature databases accordingly. Next-generation threats are stealthy by design and are significantly harder to detect. Further compounding the problem, next-generation threats are dynamic, or polymorphic, meaning they are designed to mutate quickly and retain their function while changing their code, making it almost impossible for traditional signature technologies to detect them. These threats are also targeted, which enables them to present specific individuals within organizations’ networks with customized messages or content that maximizes the likelihood of the individual becoming an unwitting accomplice to the attack. Finally, these attacks are persistent and can perform malicious activity over a significantly longer period of time by remaining resident in the network and spreading undetected across devices for a specific period of time before conducting their activity, thereby resulting in higher damage potential.

 

Next-generation threats are attacking all primary entry points and manifesting themselves over a complex series of stages

 

Next-generation threats target all possible entry points of a network by launching advanced malware attacks at the organization through Web, email, file and mobile vectors. Web-based attacks happen when users unknowingly navigate to malicious Websites and click on links or buttons that then execute code on the user’s browser or activate applications on the user’s computer that serve as the initial insertion point for the threat. Worse still, some Web-based attacks, called “drive-by downloads,” require no user interaction beyond simply visiting the Web page to infect user devices. Email attacks typically happen when users are presented with a customized message to lure them into clicking on a link in the email, which then directs the unwitting user to a malicious Website or executes a local application, creating an initial insertion point for malware. File-based attacks happen when a malicious program has already entered the network and is free to propagate malware to network file shares, such as Microsoft network file sharing service, from which it is able to exfiltrate high-value data. Mobile-based attacks typically happen when a malicious application is downloaded on the Android platform. These applications can be downloaded from widely available commercial application stores as well as custom enterprise applications. Once a mobile device is infected, the malicious application can steal any and all information from the device. An additional level of complexity in advanced malware is that the same threat can simultaneously target multiple vectors of a network to gain entry, such as through a Web page, email, file or mobile applications. These advanced “blended” attacks have become increasingly commonplace and significantly increase the difficulty of detection by legacy security products.

 

100

---

Table of Contents

Next-generation threats are difficult to detect and block at each step of their attack lifecycle

 

Next-generation threats are significantly more complex in the way they carry out their attacks. The threats formulate over multiple steps, and they are difficult to detect via legacy security technologies at each step. The typical next-generation attack lifecycle contains the following five steps:

 

1.

Initial Exploit: An exploit is typically a small amount of seemingly harmless content, often just a few hundred bytes in size, that when inserted into vulnerable software can make the software execute code it was not programmed to run. The initial exploit phase is critical and occurs when cyber attackers take advantage of inherent vulnerabilities in widely used software and applications, such as Adobe Acrobat, Flash, and Internet Explorer, to initially penetrate a victim system. The exploit is stealthy and its code can enter an organization even when a user does nothing more than visit a Web page that has been compromised. Importantly, this entire process happens within the compromised system’s random access memory and does not involve writing any files to the hard drive, making it almost impossible to detect with legacy security solutions that are focused on examining files and executables once they are written to the hard drive on a host computer.

 

2.

Malware Download: Once the initial exploit is successful in penetrating a victim’s system, a larger malware program in the form of a file can be downloaded onto the hard drive of the compromised system. Because the download is initiated by seemingly innocuous software from inside the organization and the malware file can be obfuscated to seem harmless, legacy security systems cannot detect the threat. As an example, the file can be presented as a .jpg (a picture) instead of an .exe (executable) file and therefore avoid detection by legacy security technologies designed to look for executables. In addition, the malware program is encrypted and the key to decrypt the file is only available in the exploit code. Therefore, only if a security product detects the initial exploit code, can it collect the key to decrypt, detect and block the larger malware program.

 

3.

Callback and Establish Control: After the larger malware download is successful, it will initiate an outbound connection to an external command and control server operated by a threat actor. Once the program has successfully made a connection, the cyber attacker has full control over the compromised host. Many legacy security solutions do not analyze outbound traffic for malicious transmissions and destinations. Other solutions that attempt to detect malicious outbound transmissions can only find transmissions to known destination IP addresses of servers, and are not able to identify malicious transmissions to unknown destinations.

 

4.

Data Exfiltration: Having established a secure connection with the command and control server, the malware will proceed to take control of the host computer as well as transfer sensitive data, such as intellectual property, credit card information, user credentials, and sensitive file content. Because legacy security solutions cannot detect any of the previous three steps—exploit, malware download and callback—they are unable to detect and block the outbound transfer of data.

 

5.

Lateral Movement: At any point after the malware is downloaded, the malware may conduct reconnaissance across the network to locate other vulnerable systems, and then spread laterally to file shares located deep within the organization’s network to search for additional data that is valuable to exfiltrate. As the lateral movement is conducted within the enterprise, firewalls and other perimeter security solutions focused on blocking malicious traffic from entering an organization are not able to detect the movement of malware within the organization.

 

Next-generation threats have already caused significant damage to organizations

 

Next-generation threats are pervasive and cause substantial damage to organizations around the world. Below are examples of well-known next-generation attacks that breached the legacy network security technologies deployed by large organizations:

 

•

Flame: The Flame cyber attacks were discovered in 2012. These attacks targeted private individuals, governments, enterprises and educational organizations in the Middle East, predominantly in Iran. The

 

101

---

Table of Contents

malware associated with Flame was built specifically for information gathering and ongoing monitoring of victims. It could activate microphones and Web cameras to record audio and video and use blue tooth connections to download data from devices connected to infected computers. Flame has been called the most sophisticated malware ever found. The malware had several unique characteristics that made it extremely hard to detect. One feature allowed the malware to identify security programs on the host and transform its code base to ensure that it evaded the specific security program identified. Flame is an example of modern day espionage, in the form of a cyber attack that targets a broad base of victims. This type of espionage is becoming the strategy of choice for intelligence agencies to execute their missions.

 

•

RSA Attack: The infiltration of RSA, discovered in 2011, is an example that is commonly referred to as an “advanced persistent threat.” This cyber attack started out as a “spear phishing” email titled “2011 Recruitment Plan” with an excel attachment. Once opened, the excel sheet would infect the host computers. The code would then slowly harvest user credentials and look for ways to get onto additional computers of users with higher level credentials. The attackers slowly gained the credentials they needed to infiltrate the core RSA SecureID token master key database, thereby compromising the security of thousands of other companies. This attack took substantial time and effort to access the SecureID token database, which was only one step of a larger plan to attack the organizations using these stolen credentials.

 

•

Operation Aurora: Discovered in 2010, Operation Aurora compromised the systems of several Fortune 500 companies by relying on a zero-day threat to gain access to well protected IT infrastructure. Specifically, there was a vulnerability within Internet Explorer that allowed malicious code to infect a user’s computer when the user took no action other than visiting a Website. This is an example of how a small zero-day exploit on one type of software can allow cyber attackers to compromise even the most sophisticated organizations.

 

•

Shady RAT: Operation Shady RAT, or Shady RAT, is an ongoing series of cyber attacks that started in 2006. The attacks hit and penetrated over 70 organizations, including major defense contractors, the United Nations and the International Olympic Committee. The campaign used spear phishing emails targeted at users with administrative privileges and took advantage of known exploits. The attack is notable for the range of victims and length of the infections. The United Nations was breached for nearly two years and the International Olympic Committee for 28 months before the infection was identified. This is one of the most successful coordinated breaches publicly disclosed and shows the breadth of victims and serious deficiencies in IT security.

 

A widespread underground community has formed to significantly increase the accessibility of attack tools

 

To further compound the problem, attacks like those described above are now being created with automated processes and software easily accessible on the Internet. The software development tool kits necessary to create new unique malware can be purchased for a few hundred U.S. dollars. These tools have shortened the time to threat creation and deployment, resulting in a significant increase in the volume and diversity of unknown threats attacking an organization. A cybercrime ecosystem of developers, consultants, technology providers and funding sources has emerged to support the large and growing market for next-generation threats. Advanced persistent threat actors can purchase the latest technology from this ecosystem or even contract with developers to launch attacks. This ecosystem provides a critical source of funding and resources for the development of the latest advanced malware technology, which has led to a pronounced increase in the proliferation of highly sophisticated cyber attacks.

 

Existing Security Solutions Are Not Architected For Next-Generation Threats

 

The evolving threat landscape has rendered traditional defenses incapable of protecting organizations against next-generation threats. The list below identifies the major security product categories available in the market today and their respective shortcomings in defending against next-generation threats.

 

•

Traditional firewall. Firewalls regulate incoming and outgoing network traffic by limiting which internal and external systems can communicate with each other, and which ports and protocols can be used for

 

102

---

Table of Contents

those communications. Most attacks and subsequent malware communications tunnel over widely used port and protocol configurations, such as port 80 and HTTP, which organizations must allow through the firewall. Traditional firewalls were not designed to inspect the communications of the traffic itself, making them blind to the potentially malicious content being carried through network traffic that they are allowing into the organization. Also, since firewalls operate at the network perimeter, they are unable to block threats that have bypassed the perimeter and spread onto internal file shares or that have attempted to enter through a different vector of attack, such as through the email gateway.

 

•

Next-generation firewall. Next-generation firewalls, or NGFWs, have recently been adopted by organizations to improve upon the capabilities of traditional firewalls. NGFWs add layers of policy rules based on users and applications. This allows administrators to selectively enable the use of certain applications and represents a major improvement in policy-oriented challenges faced by organizations. However, this approach does not address the inability of the firewall itself to intelligently process and inspect traffic to detect potentially malicious content.

 

•

Intrusion prevention system. Intrusion prevention systems, or IPS, were developed to address the firewall’s visibility and granularity limitations. IPS products utilize a signature database of known threats and network vulnerabilities to scan for potentially malicious traffic, making them reactive and unable to look for exploits targeting unknown vulnerabilities. Furthermore, IPS offerings were originally built to detect and analyze network services-based attacks, rather than the client-side application attacks that have become the more popular target for cyber attackers. Everyday client applications being used by individuals, such as browsers, PDF readers and Flash plug-ins, rather than server applications, are the primary targets for advanced malware attacks. Because cyber attackers can disguise these client-side application attacks within multiple layers of application and network protocols, it is nearly impossible for IPS products, to examine the contents of the applications with any granularity.

 

•

Endpoint security. Endpoint security products, like anti-virus, are commonplace in IT environments. As endpoint products rely purely on signatures, on their own they are incapable of detecting next-generation threats that exploit new vulnerabilities in commercial software. The endpoint approach forces organizations to wait as long as a few months before known attacks are forensically examined and the appropriate signatures are propagated through the distribution network. In addition, even if endpoint providers are technically able to prepare signatures quickly, they will often delay the dissemination of signature updates to avoid creating liability for themselves if their signature is faulty and inadvertently causes damage to an organization. Furthermore, whitelisting approaches, which are used to tag trusted applications, are vulnerable because approved applications or servers running on whitelisted IP addresses can be infiltrated by threat actors and become conduits for next-generation threats.

 

•

Web filters. These appliances provide Web filtering and Web browsing security, but rely on a constantly updated database of bad Website addresses when filtering traffic. Given the pace of change of domains and URLs and the transient nature of the Web, these signatures have become outdated and less relevant for organizations.

 

Protecting Today’s IT Infrastructure Requires a Fundamentally Different Approach to Security

 

The rapid and unprecedented escalation in the complexity and scale of next-generation threats has made traditional IT security products almost powerless in their ability to defend the world’s organizations from the advanced persistent threat actors that are developing them. Any solution that could effectively address these threats would have to be built from the ground up and include the following key capabilities:

 

•

Detection and protection capability that overcomes limitations of signature-based approaches. Being able to defend against next-generation threats is now the most critical aspect of any IT security strategy. Central to defending against these threats is a solution that is capable of identifying unknown threats without relying on a signature database and dynamically blocking any exfiltration of sensitive data outside the organization.

 

103

---

Table of Contents

•

The ability to protect the infrastructure across multiple threat vectors. Today’s most sophisticated attacks target all parts of the IT infrastructure across threat vectors—what may appear benign in one threat vector may be nefarious when combined with threat data from other threat vectors. To achieve adequate levels of security, IT security administrators must put solutions in place that cover Web, email, file and mobile, which are the four primary ways in which organizations exchange and store information.

 

•

Visibility into each stage of the attack life cycle and particularly the ability to detect and block attacks at the exploit phase. Given the complexity of next-generation threats today, it is critical to have visibility into any and all phases of an attack lifecycle for any given threat. The initial exploit is extremely difficult to detect because it is stealthy, can be delivered through tiny bits of code and resides within memory as opposed to within a file on the hard drive. It is paramount that any solution be able to detect and block this initial exploit, because once the exploit has penetrated a system, a beachhead has been established allowing for the payload to be delivered and the attack to be carried out. To effectively detect the exploit phase, it is important to have visibility from the network layer to the operating system to applications, browsers, files and plug-ins. Also, subsequent stages of the attack can then be obfuscated, such as through the encryption of a piece of malware that is downloaded onto a host site. It is also important for this platform to be aware of any process that may represent one of the other stages of an attack lifecycle, as advanced malware can lie dormant but then over time attempt to call back to criminal servers, or be introduced to the network from portable devices like USB drives.

 

•

Negligible false-positive rates, thereby allowing the organization’s IT infrastructure to be secure without hindering business productivity. An effective solution must deliver a high degree of detection accuracy and minimize the amount of manual intervention required to “tune” the system.

 

•

The ability to scan all relevant traffic without degrading network performance. An effective solution must be able to block threats as effectively as it detects them. As a result, such a solution must have the ability to operate in the line of network traffic without introducing additional latency in the network. In order to do so, a platform must be capable of accurately detecting malicious threats while exhibiting performance capabilities that scale with today’s ever-increasing network throughput requirements.

 

•

The ability to dynamically leverage knowledge gained by prior threat analysis. An effective solution needs to learn rapidly from previously identified threats, as they occur in real time, and automatically assemble and distribute this intelligence to other devices locally and across a global threat intelligence network.

 

•

Rapid deployment and streamlined management capabilities. The majority of existing enterprise-grade security solutions require extensive resources to deploy and operate, often taking weeks to properly install. They also require significant time from IT teams for ongoing configuration and maintenance of the overall solution offering. Security solutions need to deliver faster time to value through rapid deployment with minimal human intervention, as well as simplified and intuitive management capabilities.

 

•

Ability to rapidly identify, contain and remediate breaches. In situations where an enterprise is breached, it is critical for the organization to rapidly identify which machines have been compromised across potentially hundreds of thousands of endpoints and contain the breach. Existing endpoint security products lack the ability to rapidly identify the presence of a wide array of potential indicators of compromise, or IOCs, as well as understand the pattern of behavior of the attacker’s movements and the nature of the attacking organization itself. Furthermore, most IT security professionals within enterprises are busy with focusing on their everyday business tasks and are not exclusively focused on tracking the latest cybersecurity threats, techniques and threat actors. Organizations need a combination of a software-based product platform and a team of security experts with significant domain expertise to enable them to effectively triage and contain attacks and minimize their exposure after a breach.

 

104

---

Table of Contents

Our Solution

 

We provide a comprehensive solution for detecting, preventing and resolving advanced cybersecurity threats. We invented a purpose-built, virtual machine-based security platform that provides real-time protection to enterprises and governments against the next generation of cyber attacks. Our technology platform, built on our proprietary MVX engine, is able to identify and protect against known and unknown threats without relying on existing signature-based technologies employed by legacy IT security vendors and best-of-breed point solution vendors. To complement our threat prevention platform, our endpoint-based incident response technology platform enables rapid identification, containment and remediation of attacks on the network. Finally, we offer a team of industry-leading experts in the security industry and managed services to help organizations respond faster to breaches and minimize the exposure to their business.

 

The key benefits of our solution include:

 

•

Proprietary MVX engine to enable dynamic, real-time protection against next-generation threats. Our appliance combines dynamic threat intelligence with our proprietary virtual execution engine to analyze network traffic in real time. Our proprietary virtual execution engine is able to capture, analyze, execute, identify and report on next-generation threats. Because our hypervisor, or software that creates and runs virtual machines, resides below the operating system, we are able to detect attacks throughout the protocol stack from the network layer to the operating system, to files, applications, browsers and plug-ins. By executing the potential threat in a virtual environment created by our MVX engine, our appliance can accurately determine if the behavior exhibited by the software is malicious before it enters the network. Each virtual machine has the unique ability to test hundreds of different applications and a complete set of all versions of those applications, Web objects and attachment types. It also has the ability to mimic hundreds of different potential customer operating system environments and versions. Our MVX engine has the ability to run numerous virtual machines per appliance, which can run hundreds of permutations of attacks across four primary vectors (i.e., Web, email, file and mobile) and all stages of the attack life cycle. Our platform can support thousands of virtual machines across multiple appliances within an organization. Finally, our global intelligence network, in concert with our CMS appliance, coordinates and correlates all of this Dynamic Threat Intelligence, or DTI, information at both an enterprise and global level. We believe this ability to process millions of data points and find the “needle in the haystack,” or the set of potentially malicious threats, is a significant achievement in the field of computer science and represents a foundational competitive advantage.

 

•

Proactive defense from network to endpoint. Our broad product portfolio includes software-based appliances, cloud services and endpoint solutions to protect against Web and email threat vectors, malware resident on file shares, malicious mobile applications and targeted endpoints. Each of these elements of our product portfolio interoperates seamlessly with the others, enabling the real-time sharing and correlation of information across all of the appliances within a customer’s infrastructure. By deploying our products across all vectors of attack, we provide not only the broadest level of protection for our customers, from network to endpoint, but also utilize in-depth contextual analysis and coordinated threat intelligence to further enhance our overall efficacy rates because many advanced cyber attacks, such as blended attacks, infiltrate the organization through more than one vector.

 

•

Visibility of each stage of the attack life cycle and particularly the ability to detect and block attacks at the exploit phase. Our platform enables a comprehensive, stage-by-stage analysis of next-generation threats, from initial system exploitation to data exfiltration. Because our virtual execution engine can detonate all suspicious traffic flowing through the network, we virtually execute all of the flows of an attack, enabling us to play out the execution path of a piece of malware over a prolonged period of time and uncover, for example, any attempts to call back to a command and control server. Furthermore, because we can watch the execution path of the initial exploit with a high degree of granularity, we have high detection accuracy at the exploit level. Next-generation threats often encrypt the malware they download, making virtual execution impossible unless it has been monitored at the exploit phase. In the exploit phase, our appliance collects the encryption key necessary to properly execute the

 

105

---

Table of Contents

program in a virtual environment. We are also able to detect threats by running the exploit, not just the malware, through our virtual execution engine, which provides greater defense efficacy since we have an additional point at which we can detect suspicious behavior.

 

•

High efficacy next-generation threat detection. When evaluating a potential threat, our proprietary virtual execution engine mimics multiple production environments simultaneously, causing the potential malicious software to reveal itself by executing in what appears to be a real machine. We can address the hundreds of permutations of software environment targeted by advanced malware attacks by concurrently deploying thousands of virtual machines across an organization’s network, allowing us to monitor attempted exploits of multiple operating system and application versions and hundreds of object types at line speed. This approach allows for high detection efficacy with negligible false-positive rates, resulting in minimal disruption to the business and IT organization.

 

•

Real-time detection across all network traffic with negligible performance degradation. All of our software-based appliances are capable of operating in-line, providing comprehensive and highly accurate detection and protection without slowing down the network. We accomplish this by deploying a scalable technology architecture that processes traffic through our proprietary anomaly detection and associated heuristic algorithms that complement the virtual machine analysis. As a result, we limit the network traffic to be processed by our virtual machine technology. Furthermore, our DTI cloud provides significant intelligence on next-generation threats that are already known, enabling us to confidently block certain traffic that we have already previously identified. Our proprietary technology enables us to process the remaining traffic in a scalable fashion, running hundreds of potential virtual machines at any given time for each appliance. Our high-performance virtual machine technology, working in concert with our cloud services and advanced heuristic algorithms, enables us to deliver industry-leading protection against next-generation threats while scaling with our customers’ network throughput requirements.

 

•

Global cloud-based data sharing within and across organizations. Our CMS correlates threat information generated by our Threat Prevention appliances and facilitates rapid sharing of information across multiple appliances within a customer environment as well as across thousands of customer networks. In addition, by sharing anonymous real-time global threat data through our DTI cloud, our customers have access to a system that leverages the network effects of a globally distributed, automated threat analysis network. By combining our MVX engine with our DTI cloud, our platform is able to increase performance while providing robust and comprehensive threat protection.

 

•

Rapid deployment and rich centralized management capabilities. Our Threat Prevention appliances are easy to deploy with minimal modification to existing networks and seamlessly integrate with other devices in such networks. These appliances are generally deployed in a few hours and most often find existing next-generation threats immediately after deployment. Our CMS appliances offer rich management capabilities, such as coordinating software upgrades, automating the configuration of multiple appliances and presenting security data in an intuitive interface to facilitate reporting and auditing. By designing our solutions to be easy to deploy and manage, we enable our customers to shorten the time to value for our products.

 

•

Tightly integrated incident response, managed services and contextual data. Our in-depth understanding of advanced threats and how they manifest themselves in a customer environment allows us to offer various high value-added security services that complement our product portfolio. We offer managed defense services through which we proactively notify customers in the event of advanced threats, thereby allowing customers to focus on their business yet minimizing the time to respond to such threats. We can deploy and manage additional endpoint and network technologies that, when combined with other elements of our solution, allow us to provide customers with precise and actionable intelligence regarding the threat, the likely actors behind the threat, the assets these actors are after, and next steps to contain the threat and remediate any damage done. Furthermore, in the event of a breach, we can leverage our industry-leading team of consultants to respond quickly to threats to a customer’s environment, scope and minimize damage, and quickly restore the environment to an operational state.

 

106

---

Table of Contents

Our Market Opportunity

 

According to IDC, worldwide IT security spending in 2013 was approximately $16.8 billion across firewalls, virtual private networking, Web security, unified threat management, intrusion detection and prevention, messaging security and corporate endpoint security.⁵ While this spending is focused principally on traditional IT security products, we believe the rise in next-generation threats is creating significant new demand from organizations for products that offer advanced protection against this new threat paradigm. Gartner, Inc., a global market research firm, estimates that, “By 2020, 60% of enterprise information security budgets will be allocated for rapid detection and response approaches, up from less than 10% in 2013.”⁶

 

Our technology approach represents a paradigm shift from how IT security has been conducted since the earliest days of the information technology industry. We believe it will be a critical imperative for organizations worldwide to invest in new solutions that protect their IT infrastructure from next-generation threats. We believe our platform is essential to protect these organizations against next-generation threats. As such, we believe that this approach will take an increasing share of IT security spending from traditional enterprise IT security markets. Specifically, we believe this approach can be applied to initially supplement, and ultimately replace, any threat protection technology that utilizes a traditional signature-based approach. These markets consist of Web security ($2.1 billion), messaging security ($2.6 billion), intrusion detection and prevention ($1.9 billion) and corporate endpoint security ($3.7 billion), and aggregate to a total projected spending of $10.3 billion in 2013, in each case according to IDC.⁵ We also provide solutions that address the IT security consulting industry, which was $6.2 billion in 2013, according to IDC.⁵ With the acquisition of Mandiant, we have added solutions that address portions of the managed security services, or MSS, market and the security incident and event management, or SIEM, market. Based on our research and review of third-party reports, we believe that the MSS and SIEM markets were approximately $12.0 billion and $1.6 billion, respectively, in 2013.

 

Our Competitive Strengths

 

We believe we are the leader in protecting enterprises and governments against advanced cyber attacks. We have developed the following key competitive advantages that we believe will allow us to maintain and extend our leadership position:

 

•

Leader in protecting organizations against the new breed of cyber attacks. We are the inventor of and a leader in providing a virtual machine security approach to protect enterprises and governments against the next generation of cyber attacks. Given the significant potential cost and reputational damage to organizations that can arise from being vulnerable to next-generation threats, we believe that we have become a mission critical vendor to the most discerning customers in the world. This provides us with a strong leadership position, which allows us to attract top technical talent and brands us as the de-facto standard in a rapidly growing and increasingly important market.

 

•

Platform built from the ground up to address next-generation threats. We were founded with the sole purpose of developing a platform to detect and block next-generation threats. To achieve this goal, we developed a proprietary hypervisor (i.e., software that creates and runs virtual machines) and MVX engine to meet the specific challenges associated with high throughput processing of next-generation threats. Our proprietary hypervisor, which is purpose built for security, allows us to achieve a significant level of accuracy and processing efficiency. Unlike recent attempts by others to process next-generation threats with “sandbox” approaches that use third-party hypervisors, our proprietary hypervisor technology allows us to make fundamental improvements and scale our technology to run several virtual machines on each appliance to simultaneously detect multiple threats. We have over one million virtual machines running across our customer environments. We can also embed strict, government-grade security defenses in our hypervisor to prevent the virtual machine itself from being compromised and also make the virtual environment indistinguishable from a real host environment. In addition, we can run hundreds of permutations of files, operating systems, software versions, languages

 

5

See note (2) in “Market and Industry Data.”

6

See note (1) in “Market and Industry Data.”

 

107

---

Table of Contents

and applications to mimic desktop operating environments and force malicious software to reveal itself. We have custom built our anomaly detector, which is now in its third generation, with a focus on helping to filter potentially suspicious data from benign traffic. This filtering allows most normal traffic to pass through and any other traffic to be executed in our virtual machine. While our virtual machine can ultimately process all traffic, using an anomaly detector helps to increase network throughput and limit the amount of traffic that requires virtual execution.

 

•

Unique capabilities across threat detection, prevention and resolution. We offer a comprehensive solution for detecting, preventing and resolving advanced cybersecurity threats. The integration of detection and response provides a seamless solution that enables more rapid threat identification and resolution and lowers the cost of ownership for customers by reducing the number of products they would otherwise have to separately integrate. We believe we are the only vendor that offers an end-to-end solution for advanced threat protection and that we are uniquely positioned to capture market share based on the broad applicability of our platform and ability to meet all of our customers advanced threat protection needs.

 

•

Network effects from our customer base and DTI cloud. The combination of our global installed base of over 1,900 end-customers with over two million virtual machines across customer environments provides us with a rich and broad set of dynamic threat protection data. By sharing this data with our global customer base, we are able to provide both a higher level of protection and higher performance. Because we are protecting many high-profile enterprise and government targets, we are the first to see the most advanced threats and attack techniques, often months or years before our competitors, and are therefore able to develop superior defensive countermeasures that continue to perpetuate our ability to provide the highest level of protection. Our close relationship with customers also allows us to develop insights and knowledge into how they use our products, which we are able to translate into platform enhancements. This relationship between customers and differentiated threat intelligence drives a network effect around our company, leading additional customers to be increasingly attracted to the depth and breadth of our capabilities and intelligence.

 

•

Strong management team with significant IT security expertise. We have a highly experienced management team with extensive IT security expertise gained from past service in leading IT security and networking companies. Our Chief Executive Officer, David G. DeWalt, previously served as the Chief Executive Officer of McAfee and is also a member of the President’s National Security Telecommunications Advisory Committee. Our Founder, Chief Technology Officer and Chief Strategy Officer, Ashar Aziz, is an inventor on multiple patents in the areas of cryptography, network security and networking and is widely regarded as an IT security visionary. Our Senior Vice President and Chief Operating Officer, Kevin Mandia, is the founder and former Chief Executive Officer of Mandiant and previously served as the director of computer forensics at Foundstone, as the director of information security for Sytex and as an officer in the United States Air Force. We believe that our management team and unique engineering talent places us at the leading edge of the IT security industry and positions us well to continue to lead the broader IT security industry to adopt our proprietary virtual machine-based approach.

 

•

Comprehensive platform that enables modular deployment options. Our customers typically initially deploy our solution at one of the threat vectors that we protect, such as Web, email, file or mobile. Once deployed for an initial threat vector, our customers can then deploy additional appliances to protect the same threat vector, as well as expand their level of protection to additional vectors to achieve end-to-end protection for the primary vectors through which next-generation threats enter IT environments. Customers can also purchase our CMS appliances, which enhance the management of multiple appliances and the overall level of threat intelligence across appliances protecting different vectors. Our comprehensive multi-vector platform enables us to enter a customer network for a single use case and expand over time, allowing us to become a critical part of our customers’ security infrastructure and offering us significant revenue opportunities. In addition, customers can expand protection from the network to the endpoint by deploying our endpoint threat prevention solutions.

 

108

---

Table of Contents

•

Significant technology lead. Our technology is recognized as innovative and is protected by, among other things, a combination of copyright, trademark and trade secret laws; confidentiality procedures and contractual provisions; and a patent portfolio including 16 issued and 78 pending U.S. patents.

 

Our Strategy

 

We are the global leader in virtual machine-based security solutions that protect against next-generation threats. Our objective is to extend our global leadership by making virtual machine-based security the standard for how IT security is conducted across all categories of threat protection. The key elements of our strategy include:

 

•

Invest in research and development efforts to extend our technology leadership. We plan to build upon our current performance and current technology leadership to enhance our product capabilities, such as protecting new threat vectors and providing focused solutions for certain markets, such as small and medium-sized enterprises and service providers. Moreover, we intend to deliver additional physical and virtual appliances to address the changing security needs of our customers as well as access new product markets and threat vectors.

 

•

Expand our sales organization to acquire new customers. We intend to continue to invest in our sales organization to drive the efficient acquisition of new customers. In particular, we intend to significantly increase our investments in our international sales organizations as we pursue larger enterprise and government opportunities outside of the United States. As of December 31, 2013, we had grown our sales organization to 495 employees, including direct field and inside sales employees and sales support engineers.

 

•

Expand our channel relationships and develop our partner ecosystem. We believe our channel serves a critical role in our direct-touch sales process, and we intend to continue to invest in our channel and partner ecosystem. In particular, we believe the role our channel partners play in international markets is vital to the sale of our products in those regions. We have established a channel program that, as of December 31, 2013, had approximately 625 channel partners worldwide. We work with many of the world’s leading IT security channel partners. We intend to continue adding and incentivizing our distributors and resellers to drive greater sales and enable further leverage for our internal sales organization. We may also develop OEM relationships as other providers of security, networking and application infrastructure products seek to enhance the security of their products by embedding our proprietary virtual machine-based technology.

 

•

Drive greater penetration into our customer base. We believe our over 1,900 end-customers provide us a large market opportunity to drive incremental sales. Typically, customers initially deploy our platform to protect a portion of their IT infrastructure against one type of security threat, such as Web-based threats. We see a significant opportunity to upsell and cross sell additional products, subscriptions and services as our customers realize the increasing value of our platform. We often expand our presence within our customers’ IT infrastructures to cover a broader portion of their network, address additional threat vectors, such as email and file-based threats, and manage multiple appliances. With the addition of Mandiant, we believe there is significant opportunity to leverage the inherent synergies between products and services. For customers that are initially interested in purchasing our products, we are able to offer them the additional protection and expertise that our services provide. Similarly, when our team of cyber security experts are assisting customers that have experienced a breach, we can help prevent future breaches by introducing them to the value and protection provided by our products.

 

•

Leverage our innovative virtual machine technology in additional product markets. We believe our patented virtual machine technology can serve as a foundational element for the next generation of IT security products. We intend to apply our purpose-built virtual machine security engine to additional security markets that can benefit from the real-time virtual execution of potentially malicious software. In particular, we believe our technology can apply to any threat-protection technology that utilizes a traditional signature-based approach, such as IPS and Web filters. We believe these additional solutions will be critical for organizations to adapt to the rapidly evolving threat landscape.

 

109

---

Table of Contents

Our Products and Services

 

Products

 

•

Threat Prevention System. Our Threat Prevention System consists of vector-specific security appliances that provide comprehensive next-generation threat protection, from network to endpoint, for both inbound and outbound network traffic that may contain sensitive information. Our portfolio of Threat Prevention appliances include the following appliances covering the Web, email and file threat vectors:

 

•

Web Threat Prevention. Our Web Threat Prevention appliances are deployed in-line at enterprise Internet access points to analyze all Web traffic. Utilizing our MVX engine, these appliances identify and block next-generation threats deeply embedded inside Web traffic, create real-time protection descriptors from the identified threats, and capture potential multi-protocol outbound communication data from threats that may already be inside the network. Our MVX engine detects advanced attacks exploiting unknown vulnerabilities as well as malicious code embedded in common Web and multimedia content. Our MVX engine executes suspicious software against a range of browsers, plug-ins, applications, and operating environments that are instrumental in tracking malicious actions. As potential threats can sometimes enter the network via user devices and may have been resident in the network previously, our MVX engine also analyzes outbound traffic for threats that may attempt to extract sensitive information or enable control of devices within the network by communicating with servers. In September 2013, we introduced the NX 10000, a multi-gigabit throughput appliance that can be deployed in-line at Internet egress points to block Web exploits and outbound multi-protocol callbacks. Using our MVX engine, the NX 10000 confirms zero-day attacks, generates real-time security intelligence and captures dynamic callback destinations to defend against attacks. In December 2013, we introduced our NX 900 to enable threat protection at various remote and branch offices as well as at the homes of an organization’s executive officers and key personnel.

 

•

Email Threat Prevention. Our Email Threat Protection appliances detect and stop advanced attacks that exploit unknown OS, browser, and application vulnerabilities as well as malicious code embedded in email content. Using our MVX engine, these appliances analyze all email attachments, including all common file and archive formats. In particular, these appliances secure networks against spear phishing emails, which bypass traditional anti-spam and reputation-based technologies. Spear phishing is a common next-generation threat that is effectively a method used by cybercriminals for financial gain or to extract sensitive information by sending professionally disguised email to users hoping the users respond to what they believe are benign email communications. Our MVX engine actively executes, and is able to quickly identify, this malicious content.

 

•

File Threat Prevention. Our File Threat Prevention appliances analyze network file servers to detect and quarantine malicious software brought into the network by users within the organization through technologies, such as online file sharing and associated collaboration tools, which bypass traditional network solutions. These appliances analyze files using our MVX engine and detect malicious code embedded in common file types, including PDF, Microsoft Office documents, archived files, and multimedia content such as QuickTime and other video, audio and image files. Our File Threat Prevention appliances perform recursive, scheduled, and on-demand scanning of accessible network file servers to continuously identify and quarantine resident threats.

 

•

Central Management System. Our Central Management System, or CMS, unifies reporting, configuration, and threat data sharing and manages the overall deployment of our Threat Prevention System. CMS appliances are used to distribute the dynamic descriptor content locally to the appliances in our Threat Prevention System to provide real-time protection throughout our entire deployment. The CMS also provides cross-enterprise threat data correlation to identify and block blended attacks wherever they may occur in a large global enterprise. It also consolidates the management, reporting, and data sharing of threat data in an easy-to-deploy, network-based appliance. The CMS consolidates

 

110

---

Table of Contents

activities and improves organization-wide situational awareness with a unified security dashboard, which provides a real-time view of the number of infected systems and enables users to drill down directly to infection details.

 

•

Forensic Analysis System. Our Forensic Analysis System provides powerful auto-configured test environments to allow forensics teams to manually execute and inspect advanced malware, zero-day, and other advanced cyber attacks embedded in files, email attachments, and Web objects. The Forensic Analysis System inspects single files or batches of files for malware and tracks outbound connection attempts across multiple protocols. In virtual execution mode, the Forensic Analysis System analyzes the execution path of a particular malware sample to generate a dynamic and anonymized profile that can be distributed to other FireEye appliances on the network. Malware attack profiles include identifiers of malware code, exploit URLs, and other sources of infections and attacks. To fully analyze the behavior of every unknown file, the Forensic Analysis System provides full malware life cycle analysis. While the Forensic Analysis System is not required for deployments, our larger customers typically purchase the product to enable advanced and deeper analysis of potential malicious software outside of the real-time traffic scanning done by our Threat Prevention appliances.

 

•

Endpoint Threat Prevention System. Our Endpoint Threat Prevention System is an appliance and endpoint agent-based system that equips security organizations to confidently detect, analyze and resolve security incidents in a fraction of the time it takes using conventional approaches. The Endpoint Threat Prevention System enables security operations teams to connect the dots between security incidents in their networks and endpoints to provide the holistic picture required to find and scope security breaches as they are unfolding. In addition to applying proprietary intelligence to sweep for indicators of compromise, or IOCs, our Endpoint Prevention System automatically investigates alerts generated by FireEye products, SIEM, log management and other network security solutions, to identify the specific devices that have been impacted and assess the potential risk. Security operations teams receive the information they need, when they need it, to make rapid, accurate decisions about potential incidents. When a suspected incident is confirmed, the endpoints involved can be contained with a single click to deny the attacker access while still allowing forensic investigations to continue.

 

Subscription and Services

 

•

Product Subscriptions. The following product subscriptions are attached to our product sales:

 

•

Dynamic Threat Intelligence Cloud (DTI). Our Dynamic Threat Intelligence, or DTI, cloud interconnects the FireEye appliances deployed within customer networks, technology partner networks, and service providers around the world. Our global FireEye Labs team identifies emerging threats, collects threat samples, and replicates, reviews and characterizes attacks. Threat intelligence is also dynamically generated by each MVX engine to provide real-time forensics used to protect the local network and can be shared globally through our DTI cloud. We leverage the threat intelligence we conduct as well as the real-time analysis from our appliances to update our malware descriptors, attack definitions, scanning engines, and other security solution components. We can easily distribute these updates to customers through our DTI cloud. Our DTI cloud provides a closed-loop system that leverages the network effects of a globally distributed, automated threat analysis network enabled by our Threat Prevention appliances. Customers are required to purchase either a one or three year DTI cloud subscription as part of their initial appliance purchase.

 

•

Email Threat Prevention Attachment/URL Engine. Our Email Threat Prevention Attachment/URL engine analyzes email attachments and URLs embedded in emails for next-generation threats. Customers who purchase the Email Threat Prevention appliance are also required to purchase a one or three year subscription to our Email Threat Prevention Attachment/URL engine.

 

•

Security-as-a-Service Offerings.

 

•

Managed Defense. Managed Defense is a hosted service whereby we monitor a customer’s network and provide a full-service offering that brings together all of the experts, experience and

 

111

---

Table of Contents

technology required to find attackers at any stage of the attack and respond aggressively before they complete their mission. Managed Defense delivers timely, actionable reports of compromise with negligible false positive rates. We do this through real-time network monitoring and traffic analysis, layered with advanced sweeps of enterprise endpoints and active hunting for adversaries, maintaining vigilance 24x7. Analysis is delivered to provide organizations with the context they need to fully understand the threat, assess risk and prioritize action. We can also provide precise, actionable intelligence to customers regarding how to contain the threat and remediate the environment. In cases where a breach has occurred, the Managed Defense team can bring our incident response consultants onsite as an additional value-added service.

 

•

Cloud-Based Email Threat Prevention. Our cloud-based Email Threat Prevention service protects against today’s advanced email attacks. With no hardware or software to install, the cloud-based Email Threat Prevention service is a particularly good fit for organizations already moving their email infrastructure into the cloud. To start protecting against malicious emails, organizations simply route messages to the Email Threat Prevention service. The cloud then uses the signature-less MVX engine to detect threats and stop APT attacks in real time.

 

•

Mobile Threat Prevention. Our Mobile Threat Prevention service identifies malicious applications downloaded onto the Android platform and works with the organization’s infrastructure to prevent these applications from causing damage to the organization. These mobile applications can be downloaded from widely available commercial application stores as well as custom enterprise applications. Rather than relying on malware signatures, which are powerless against today’s fast-moving, constantly changing threats, our Mobile Threat Prevention service executes applications within our MVX engine and provides an automated mobile threat assessment that enables organizations to enforce security policies in the mobile environment.

 

•

Customer Support and Consulting Services. We provide the following customer support and consulting services that are marketed under the Mandiant brand.

 

•

Incident response and related consulting services. We have a team of cyber security experts that can quickly respond to customers that have experienced a breach and help them understand the scope of the incident and quickly remediate the attack. Our cyber security experts will inform customers who is behind the attack (i.e., organized crime, nation state or malicious insider) and how much damage was done, and will work with them to recover from the incident while minimizing the impact of the event on the organization. We have performed hundreds of successful computer security investigations across all industries, organization sizes and technical environments. As part of our services, we can help customers organize their own security programs, help with litigation support and forensics, and assist with threat and vulnerability assessments.

 

•

Training and professional services. We offer training services to our customers and channel partners through our training department and authorized training partners. For both our customers and our channel partners, these services are designed to provide education regarding implementation, use and functionality, and maintenance and support of our products. Specifically for our channel partners, we also provide training regarding how to manage all stages of our sales cycle. We also offer professional services to customers for large implementations where expert technical resources are required. Our professional services consultants help in the design of deployments of our products and work closely with customer engineers, managers and other project team members to implement our products according to design, utilizing network analysis tools, attack simulation software and scripts. We provide professional services directly to our customers, but also deliver these resources by enabling our authorized partners, who provide similar services to our customers.

 

•

Customer Support and Maintenance Services. We offer technical support on our products and subscriptions. We provide multiple levels of support and have regional support centers located across the globe. Our service representatives work with customers to qualify and solve technical

 

112

---

Table of Contents

challenges that they may encounter. In addition to post sales support activities, our support organization places emphasis on service readiness by coordinating with our product management team to ensure the attainment of defined pre-requisite quality levels for our products and services prior to release. Like our subscription services, our support and maintenance contracts have terms of either one or three years.

 

Our products are designed to address security requirements for small-to-mid sized businesses, remote offices, large enterprises, governments and service providers. The table below presents an overview of the various FireEye appliance models and capabilities:

 

Product Category		Models / Types		Key Features		Subscriptions
Web Threat Prevention		NX 900 NX 1400 NX 2400 NX 4400 NX 4420 NX 7400 NX 7420 NX 1000		•    1U to 2U Rack-mount •    10Mbps to 4 Gbps throughput •    50—40,000 users •    Broad Web object support		•    DTI
Email Threat Prevention		EX 3400 EX 5400 EX 8400 EX8420		•    1U to 2U Rack-mount •    Email quarantine •    Spear phishing security •    Anti-Virus integration		•    DTI •    Email Threat Prevention Attachment/URL Engine
File Threat Prevention		FX 5400 FX 8400		•    1U to 2U Rack-mount •    File quarantine •    Deep file analysis •    Anti-virus integration •    Broad file type support		•    DTI
Central Management		CM 4400 CM 7400 CM 9400		•    1U to 2U Rack-mount •    Threat Prevention Appliance management •    Blended attack correlation •    SIEM Integration •    Detailed reporting
Forensic Analysis		AX 5400 AX 8400		•    1U to 2U Rack-mount •    Full threat lifecycle analysis •    Sandbox and honeypot modes •    Broad file type support		•    DTI
Endpoint Threat Prevention		HX Series		•    Endpoint validation for advanced threats •    One-click containment across all endpoints •    Agent Anywhere™ technology to monitor within and outside corporate network		•    DTI

 

The list price of our products range from approximately $8,000 to $350,000 based on throughput and other performance requirements.

 

113

---

Table of Contents

Our Technology

 

The key technologies underlying our platform have been built from the ground up to address next-generation threats. Our foundational technologies are: (i) line rate anomaly detection, (ii) proprietary MVX, (iii) exploit stage monitoring, (iv) cross correlation, and (v) evolved network security architecture. We have built our technology over ten years of research and development, and we believe it represents a significant competitive advantage for us.

 

Custom Anomaly Detector. Commercial anomaly detectors are common place in IT security. While such anomaly detectors are the foundation for IPS solutions, they generate a significant number of false positives, making their efficacy in detecting IT security threats challenging. We have custom built our anomaly detector with a focus on helping to filter potentially suspicious data from benign traffic. This filtering allows for most normal traffic to pass through and any other traffic to be executed in our virtual machine. While our virtual machine can ultimately process all traffic, using an anomaly detector helps to increase network throughput and limit the amount of traffic that requires virtual execution. We are constantly improving the efficacy of our anomaly detector as we discover new threats in our virtual machine. Our anomaly detector also receives updates from our DTI cloud in the attributes, or markers, it looks for when inspecting potentially suspicious data. Uniquely, because the line rate anomaly detector is designed to feed suspicious flows to our MVX engine, it can focus on minimizing missed attacks by aggressively categorizing traffic as suspicious. Any potential false alerts in the output of this system are automatically weeded out by our MVX engine, which confirms whether a suspicious flow or object is malicious. Because we first identify suspicious flows with our line rate anomaly detector and then, through a separate process, use our MVX engine to determine whether such suspicious flows are malicious, our solution is able to achieve negligible false-positive rates and missed attacks, which are the desired results of the ideal detection engine.

 

Proprietary MVX Engine. Our appliances utilize a proprietary virtual execution engine to execute potentially suspicious software code. We have built our virtual execution engine to take advantage of advances in multi-core processing and run on many-core network processors. As we do not use a commercially available virtual machine, we are not encumbered by any incremental overhead beyond the execution of our environments and the detection of threats. We are also free to make modifications to the code base of our virtual execution engine, which our competitors are not able to do. Our virtual execution engine mimics operating systems and configurations of several user devices, including several popular operating systems, applications and Web browsers. Once the unknown software code is loaded into this environment, our engine monitors the software’s behavior. Using a proprietary behavior analysis technology, our appliances determine if the actions the code is taking in the virtual environment are malicious or benign. We have developed our MVX engine over the past nine years to provide high performance next-generation threat protection while maintaining high threat detection efficacy, negligible false-positive rates, and minimal impact on network performance.

 

Exploit Stage Monitoring. Our appliances are able to monitor the full spectrum of data that enters the network. This allows visibility into all stages of an attack, including the exploit phase, where an attacker first compromises a program. The exploit object can be embedded in any piece of content, such as an ordinary Web page. This stage is invisible to legacy network security technologies that are focused on examining files and executables once they are written to the hard drive on a host computer. Next-generation threats often encrypt the malware file they download, making virtual execution impossible unless it has been monitored at the exploit phase. In the exploit phase, our appliance collects the encryption key necessary to properly execute the program in a virtual environment. We are also able to detect threats by running the exploit, not just the malware, through our virtual execution engine, which provides greater defense efficacy since we have an additional point at which we can detect suspicious behavior.

 

Multi-Vector Cross Correlation. Our Threat Prevention appliances, when deployed with the CMS appliance, communicate in real time on threat information as well as receive updates from our DTI cloud. This awareness allows our appliances, which are specific to threat vectors, to communicate threat data to each other in real time to prevent sophisticated multi-vector threats, particularly blended attacks. This cross-fertilization of

 

114

---

Table of Contents

traffic information enables our appliances to piece together seemingly benign components of a broader blended or multi-vector attack. Cross correlation requires Threat Prevention appliances that target different vectors and our CMS appliance work in concert.

 

Evolved Network Security Architecture. Our appliances are designed to operate as part of a comprehensive architecture to defend networks against next-generation threats. This allows appliances to be deployed at the right vectors and have visibility into the traffic streams necessary to detect and block next-generation threats. The ability to monitor all traffic and file stores is critical to detecting next-generation threats that will enter through multiple vectors and move laterally across the network. This is impossible for legacy network security providers to achieve with architectures that were built around traditional threats and file scanning and don’t have visibility into the traffic sources next-generation threats utilize during attacks.

 

Advanced Endpoint Validation and Containment. Our Endpoint Threat Prevention System is an appliance and endpoint agent-based solution that enables real-time automated validation of security incidents across thousands of endpoints to contain the impact of an incident. The Endpoint Threat Prevention System allows customers to uncover attacks in their environment by identifying indicators of compromise, or IOCs, on endpoints left behind by attacker activity. Suspicious hosts are flagged using non-signature based intelligence so customers can confirm the scope of the attack, identify and contain all compromised hosts and quickly secure their networks.

 

As our Threat Prevention appliances are typically deployed in-line with network traffic, they analyze traffic through the following four major phases.

 

•

Fast Path Blocking. To maintain high network throughput and leverage known threat data, our Threat Prevention appliances utilize our proprietary database of threat intelligence as well as third-party threat data feeds to perform identification of known threats. If the traffic is identified as malicious, it is blocked immediately. If the traffic is not identified as malicious, it is passed to our custom anomaly detector. Threat intelligence includes behavioral information about the threat, versus a specific byte-by-byte fingerprint found with signatures. This helps us to guard against threats that can evolve over time.

 

•

Line Rate Anomaly Detection. Traffic that is not blocked in our fast path blocking phase is passed to our proprietary anomaly detector. The anomaly detector is designed to identify any remotely suspicious network flows. We have custom built our anomaly detector to deliver high levels of accuracy while preventing any threats from being missed. If any suspicious attributes are detected, the flow is passed on to the virtual execution environment.

 

•

MVX Execution. Through a pre-configured, instrumented virtual analysis environment, our MVX engine fully executes suspicious objects and flows to allow deep inspection of common file formats, email attachments, and Web objects. Newly discovered malware is installed and executed to completion within our MVX engine so that it is forensically analyzed, tracked and blocked. Analysis of malware is automated to create dynamic blocking of inbound attacks and its outbound transmissions.

 

•

Notification. If a threat is identified in the virtual environment, the associated DTI gained in the process is shared with other FireEye appliances on the network through our CMS appliance and globally via our DTI cloud.

 

Customers

 

Our customer base has grown from over 450 end-customers at the end of 2011 to over 1,900 end-customers as of December 31, 2013 in more than 60 countries, including more than 130 of the Fortune 500. We provide products and subscriptions to customers of varying sizes, including enterprises, governmental agencies and educational and nonprofit organizations. Our customers include leading enterprises in a diverse set of industries, including telecommunications providers, financial services entities, Internet search engines, social networking sites, stock exchanges, electrical grid operators, networking vendors, oil and gas companies and leading U.S. and international governmental agencies. Our business is not dependent on any particular end-customer as no end-

 

115

---

Table of Contents

customer represented more than 10% of our revenue for any of the years ended December 31, 2011, 2012 or 2013. Accuvant, one of our resellers, accounted for approximately 10% of our revenue for each of the years ended December 31, 2011 and 2012. For the year ended December 31, 2013, Carahsoft Technology Corp., one of our distributors, and Accuvant accounted for approximately 11% and 11% of our revenue, respectively.

 

Customer Case Studies

 

The following are examples of customers successfully deploying our platform to protect their organizations against next-generation cyber attacks:

 

Fortune 500 Global Manufacturer

 

Problem: As a global manufacturer with annual sales of over $20 billion and more than 100,000 employees, this enterprise was increasingly targeted with advanced malware, zero-day, and other next-generation threats. This enterprise needed a way to identify and combat these attacks across a number of distributed properties, including those of recently acquired companies. As a result, to be viable, any solution needed to be not only effective, but also easy to deploy and efficient to manage.

 

Solution: With our virtual machine-based security solution, this global manufacturer can detect and block a broad range of cyber-attacks, including advanced malware, spear phishing and other next-generation threats. Our Web Threat Prevention appliance and Email Threat Prevention appliance were deployed across existing corporate offices, and now, before an acquired company’s networks are integrated with the enterprise, the enterprise deploys our solution to ensure newly acquired properties do not introduce new vulnerabilities or compromise the enterprise’s IT security. Since deployment, our solution identified over 10,000 malicious events and callback communications that circumvented and were undetected by the enterprise’s legacy, signature-based systems, including approximately 20 APT attacks. Security professionals within the enterprise realized the value of our solution almost immediately upon deployment. As a result of this success, after installing our Web Threat Prevention appliance and CMS appliance in 2010, the enterprise subsequently purchased our Email Threat Prevention appliance and additional Web Threat Prevention appliances in 2011. As of December 31, 2012, the aggregate price of the products, subscriptions and services purchased by this manufacturer from us was approximately 2.7x the amount it initially purchased from us in 2010.

 

Global Telecommunications Enterprise

 

Problem: As one of the largest global telecom companies, this enterprise was the target of an onslaught of cyber-attacks. Protecting customer data and intellectual property was vital, yet the enterprise’s existing security architecture was ill-equipped to detect the multi-vector, multi-phased attacks that were being encountered.

 

Solution: The enterprise started by purchasing our Web Threat Prevention appliance in the fall of 2012. It quickly determined that it needed broader protection and subsequently purchased our Email Threat Prevention appliance and CMS appliance. Working together, these appliances detect threats on a daily basis that were not being discovered by the enterprise’s signature-based security solutions alone. Our solution has identified more than 200,000 Web and email threats and over 1,000 sophisticated APT attacks. Given the value the enterprise has seen delivered, it has begun to offer its own customers a security service that leverages our solution.

 

Global Information Technology and Electronics Company

 

Problem: As one of the largest information technology and electronics companies in the world, this enterprise had critical intellectual property that needed to be protected. The security team was concerned that the enterprise’s existing security architecture was missing advanced attacks that were exploiting unknown, zero-day vulnerabilities. As a result, the enterprise was increasingly exposed to cyber attacks that it believed could have a devastating impact on its business.

 

116

---

Table of Contents

Solution: The enterprise has leveraged our Web Threat Prevention appliance and Email Threat Prevention appliance to ensure real-time protection of its corporate network. In its initial testing of our solution, the enterprise’s security team immediately identified hundreds of breached systems from which calls were being made to servers outside of the enterprise’s networks. The enterprise was also able to immediately detect an APT attack that had infiltrated its network and had been missed by the enterprise’s prior defenses. Since deploying our solution, the enterprise has identified thousands of advanced threats that had not been detected by its prior defenses.

 

Backlog

 

Each order for services for multiple years is billed shortly after receipt of the order and is included in deferred revenue. The timing of revenue recognition for services may vary depending on the contractual service period or when the services are rendered. Products are shipped and billed shortly after receipt of an order. We do not believe that our product backlog at any particular time is meaningful because it is not necessarily indicative of future revenue in any given period, as such orders may be delayed. Additionally, the majority of our product revenue comes from orders that are received and shipped in the same quarter.

 

Sales and Marketing

 

Sales. Our sales organization consists of a direct sales team and channel partners who work in collaboration with our direct sales team to identify new sales prospects, sell products, subscriptions and services, and provide post-sale support. Our direct field sales team is responsible for securing enterprise and government accounts globally. Our direct inside sales organization is responsible for securing medium and smaller organizations that are focused on protecting key assets. We also recently built a strategic account management team to support and expand sales within our customer base. Our sales cycle varies by industry, but can last several months, although some deals close in only a few weeks given the typically shorter deployment time of our products as compared to traditional network security products. Our incident response engagements are generally sold through inbound inquiries from customers that have recently experienced a breach. The sales cycle for these engagements is typically a few days. We also have a dedicated team focused on the channel that works with our direct sales organization to manage the relationships with our channel partners and work with our channel partners in winning and supporting customers. We believe this direct-touch sales approach allows us to leverage the benefits of the channel as well as maintain face-to-face connectivity with our customers, including key enterprise accounts. We expect to continue to grow our sales headcount in all markets, particularly in countries where we currently do not have a direct sales presence. In our most recent quarter, nearly a third of our engagements with prospects have been led by channel partners.

 

Our sales organization is supported by sales engineers with deep technical domain expertise who are responsible for pre-sales technical support, solutions engineering for our customers, proof of concept work and technical training for our channel partners. We believe that, by providing a proof of concept to potential customers, we are able to contrast the effectiveness of our platform versus our competitors in identifying suspicious and potentially malicious software code in their actual IT environments. Our sales engineers also act as the liaison between customers and our marketing and product development organizations.

 

Marketing. Our marketing is focused on building our brand reputation and the market awareness of our platform, driving customer demand and a strong sales pipeline, and working with our channel partners around the globe. Our marketing team consists primarily of corporate marketing, channel marketing, account/lead development, operations, and corporate communications. Marketing activities include demand generation, advertising, managing our corporate Website and partner portal, trade shows and conferences, press and analyst relations, and customer awareness. We are also actively engaged in driving global thought leadership programs through blogs and media and developing rich content such as the global cyber maps and report released in the second quarter of 2013. In 2011, we started releasing a semi-annual threat report, called FireEye Advanced Threat Report, the industry’s first report exclusively focused on the next-generation threat landscape.

 

117

---

Table of Contents

Technology Alliance Partners

 

Given our role in our customer networks, we maintain a large technology alliance network with other enterprise technology vendors. These vendors include service providers and consulting firms, managed security service providers, network appliance vendors, enterprise hardware manufacturers, enterprise infrastructure software vendors, and threat intelligence firms. The list below contains a representative subset of our broader technology alliance network:

 

•

Instrumentation partners, including Gigamon, VSS Monitoring (acquired by Danaher Corporation in June 2012) and Ixia;

 

•

Endpoint partners, including Guidance Software, Bit9 and Verdasys;

 

•

Analysis/Security Information & Event Management partners, including Radar, a subsidiary of IBM, RSA, a subsidiary of EMC, LogRhythm, ArcSight, a subsidiary of HP, and Splunk; and

 

•

Mitigation partners, including Imperva, Infoblox, Bradford Networks, NetCitadel, ForeScout and OpenDNS.

 

Government Affairs

 

We maintain relationships with several governments around the globe. Our thought leadership in protection against next-generation threats has helped to shape the legislative, regulatory and policy environment to better enhance these governments’ individual and collective cyber posture. As part of this effort, we contribute to the evolving standard-making processes and help define best practices in various jurisdictions. We also identify future needs and requirements and develop technologies in concert with government entities. In the United States, David G. DeWalt, our Chief Executive Officer, is a member of President Obama’s National Security Telecommunications Advisory Committee, which provides recommendations to the President on how to assure vital telecommunications links through any event or crisis, and help the nation maintain a reliable, secure and resilient national communications posture. In addition, we are a member of the Information Technology Sector Coordination Council, which is the primary vehicle for providing sector input to the United States Government on information technology related critical infrastructure protection public policy issues. Through these and related activities, we engage on the front lines of the threat landscape and use that knowledge and insight to improve the efficacy of our solutions.

 

Manufacturing

 

The manufacturing of our security products is outsourced to third-party contract manufacturers. This approach allows us to reduce our costs as it reduces our manufacturing overhead and inventory and also allows us to adjust more quickly to changing customer demand. Our manufacturing partners assemble our products using design specifications, quality assurance programs, and standards that we establish, and they procure components and assemble our products based on our demand forecasts. These forecasts represent our estimates of future demand for our products based upon historical trends and analysis from our sales and product management functions as adjusted for overall market conditions.

 

Our primary contract manufacturer is Flextronics Telecom Systems, Ltd., or Flextronics. The manufacturing agreement we have entered into with Flextronics does not provide for any minimum purchase commitments and has an initial term of one year, which is automatically renewed for one-year terms, unless either party gives written notice to the other party not less than 90 days prior to the last day of the applicable term. Additionally, this agreement may be terminated by either party (i) with advance written notice provided to the other party, subject to certain notice period limitations, or (ii) with written notice, subject to applicable cure periods, if the other party has materially breached its obligations under the agreement.

 

118

---

Table of Contents

Research and Development

 

We invest substantial resources in research and development to enhance our virtual execution engine, build add-on functionality and improve our core technology. We believe that both hardware and software are critical to expanding our leadership in the security industry. Our engineering team has deep networking and security expertise and works closely with customers to identify their current and future needs. In addition to our focus on hardware and software, our research and development team is focused on research into next-generation threats, which is required to respond to the rapidly changing threat landscape.

 

Research and development expense totaled $7.3 million, $16.5 million and $66.0 million for 2011, 2012 and 2013, respectively. We plan to continue to significantly invest in resources to conduct our research and development effort.

 

Competition

 

We operate in the intensely competitive IT security market that is characterized by constant change and innovation. Changes in the threat landscape and broader IT infrastructures result in evolving customer requirements for the protection from next-generation threats. Several vendors have both recently introduced new products to compete with our solutions and are incorporating features to compete with our products. Our current and potential future competitors fall into six general categories:

 

•

large networking vendors such as Cisco and Juniper that may emulate or integrate features similar to ours into their own products;

 

•

large companies such as Intel, IBM and HP that have acquired large IT security specialist vendors in recent years and have the technical and financial resources to bring competitive solutions to the market;

 

•

independent security vendors such as Sourcefire (which was recently acquired by Cisco), Palo Alto Networks and Trend Micro that offer products that claim to perform similar functions to our platform;

 

•

small and large companies that offer point solutions that compete with some of the features present in our platform;

 

•

providers of traditional IT security solutions, such as Symantec, that we may compete with in the future; and

 

•

other providers of incident response services.

 

As our market grows and new IT budgets are created to support next-generation threat protection, it will attract more highly specialized vendors as well as larger vendors that may continue to acquire or bundle their products more effectively.

 

The principal competitive factors in our market include:

 

•

ability to detect next-generation threats by overcoming the limitations of signature-based approaches;

 

•

efficacy of the virtual machine technology in terms of detecting the maximum number of threats;

 

•

scalability, throughput and overall performance of the virtual machine technology;

 

•

visibility into all stages of an attack, especially the exploit phase;

 

•

ability to achieve low false-positive rates;

 

•

breadth and richness of the shared threat data the appliances have access to;

 

•

ability to process all data entering a network on premise;

 

•

brand awareness and reputation;

 

•

strength of sales and marketing efforts;

 

119

---

Table of Contents

•

product extensibility and ability to integrate with other technology infrastructures;

 

•

price and total cost of ownership; and

 

•

our ability to provide a comprehensive solution of products and services for detecting, preventing and resolving advanced cybersecurity threats.

 

We believe we compete favorably with our competitors on the basis of these factors as a result of the features and performance of our platform, the ease of integration of our products with technological infrastructures, and the relatively low total cost of ownership of our products. However, many of our competitors have substantially greater financial, technical and other resources, greater name recognition, larger sales and marketing budgets, deeper customer relationships, broader distribution, and larger and more mature intellectual property portfolios.

 

Intellectual Property

 

Our success depends in part upon our ability to protect our core technology and intellectual property. We rely on, among other things, patents, trademarks, copyrights and trade secret laws, confidentiality safeguards and procedures, and employee non-disclosure and invention assignment agreements to protect our intellectual property rights. We have 16 U.S. issued patents and 78 patent applications pending in the United States. We also have a number of foreign counterparts of these patent applications, consisting of seven pending applications under the Patent Cooperation Treaty, three pending application in the European Patent Office and another two in Japan. Our issued patents expire between 2025 and 2030. We cannot assure you whether any of our patent applications will result in the issuance of a patent or whether the examination process will result in patents of valuable breadth or applicability. In addition, any patents that may issue may be contested, circumvented, found unenforceable or invalidated, and we may not be able to prevent third parties from infringing them. We also license software from third parties for integration into our products, including open source software and other software available on commercially reasonable terms.

 

We control access to and use of our proprietary software, technology and other proprietary information through the use of internal and external controls, including contractual protections with employees, contractors, end-customers and partners, and our software is protected by U.S. and international copyright, patent and trade secret laws. Despite our efforts to protect our software, technology and other proprietary information, unauthorized parties may still copy or otherwise obtain and use our software, technology and other proprietary information. In addition, we intend to expand our international operations, and effective patent, copyright, trademark, and trade secret protection may not be available or may be limited in foreign countries.

 

Our industry is characterized by the existence of a large number of patents and frequent claims and related litigation regarding patent and other intellectual property rights. If we become more successful, we believe that competitors will be more likely to try to develop products that are similar to ours and that may infringe our proprietary rights. It may also be more likely that competitors or other third parties will claim that our products infringe their proprietary rights. In particular, large and established companies in the IT security industry have extensive patent portfolios and are regularly involved in both offensive and defensive litigation. From time-to-time, third parties, including certain of these large companies and non-practicing entities, may assert patent, copyright, trademark, and other intellectual property rights against us, our channel partners, or our end-customers, whom our standard license and other agreements obligate us to indemnify against such claims. Successful claims of infringement by a third party, if any, could prevent us from distributing certain products or performing certain services, require us to expend time and money to develop non-infringing solutions, or force us to pay substantial damages (including, in the United States, treble damages if we are found to have willfully infringed patents), royalties or other fees. We cannot assure you that we do not currently infringe, or that we will not in the future infringe, upon any third-party patents or other proprietary rights. For example, we are currently a party to claims alleging, among other things, patent infringement, which are in the early stages of litigation. See “Risk Factors—Risks Related to Our Business and Our Industry—Claims by others that we infringe their proprietary technology or other rights could harm our business” for additional information.

 

120

---

Table of Contents

Employees

 

As of December 31, 2013, we had 1,679 full-time employees. None of our employees is represented by a labor organization or is a party to any collective bargaining arrangement. We have never had a work stoppage, and we consider our relationship with our employees to be good.

 

Facilities

 

We currently lease approximately 170,000 square feet of space for our corporate headquarters in Milpitas, California under lease agreements that expire on various dates through 2018. We maintain additional offices throughout the United States and various international locations, including Australia, Dubai, India, Ireland, Japan, South Korea, Singapore, Taiwan, Turkey and the United Kingdom. We believe that our current facilities are adequate to meet our ongoing needs, and that, if we require additional space, we will be able to obtain additional facilities on commercially reasonable terms.

 

Legal Proceedings

 

We are a party to litigation and subject to claims incident to the ordinary course of business. Although the results of litigation and claims cannot be predicted with certainty, we currently believe that the final outcome of these matters will not have a material adverse effect on our business. Regardless of the outcome, litigation can have an adverse impact on us because of defense and settlement costs, diversion of management resources and other factors.

 

121

---

Table of Contents

MANAGEMENT

 

Executive Officers and Directors

 

The following table provides information regarding our executive officers and directors:

 

Name		Age				Position(s)
David G. DeWalt			49			Chief Executive Officer and Chairman of the Board
Ashar Aziz			55			Founder, Chief Technology Officer, Chief Strategy Officer and Vice Chairman of the Board
Kevin R. Mandia			43			Senior Vice President and Chief Operating Officer
Michael J. Sheridan			49			Senior Vice President and Chief Financial Officer
Alexa King			46			Senior Vice President, General Counsel and Secretary
Jeffrey C. Williams			47			Senior Vice President, Sales
Bahman Mahbod			54			Senior Vice President, Engineering
Ronald E. F. Codd(1)(2)			58			Director
William M. Coughran Jr.(2)(3)			61			Director
Gaurav Garg(1)			48			Director
Promod Haque(2)(3)			65			Director
Robert F. Lentz(1)			61			Director
Enrique Salem(3)			48			Director

 

(1)

Member of our audit committee.

(2)

Member of our nominating and corporate governance committee.

(3)

Member of our compensation committee.

 

Executive Officers

 

David G. DeWalt has served as our Chief Executive Officer since November 2012 and has served as our Chairman of the Board since May 2012. Prior to joining FireEye, Mr. DeWalt served as President, Chief Executive Officer and director of McAfee, Inc., a provider of antivirus software and intrusion prevention solutions, from April 2007 until February 2011 when McAfee was acquired by Intel Corporation. Mr. DeWalt served as President of McAfee, a wholly-owned subsidiary of Intel, from February 2011 to August 2011. From December 2003 to March 2007, Mr. DeWalt held various positions at EMC Corporation, a developer and provider of information infrastructure technology and solutions, including Executive Vice President, EMC Software Group and President of EMC’s Documentum and Legato Software divisions. Prior to joining EMC, Mr. DeWalt served as President and Chief Executive Officer of Documentum, Inc. from July 2001 to December 2003, Executive Vice President and Chief Operating Officer of Documentum from October 2000 to July 2001 and Executive Vice President and General Manager, eBusiness Unit, of Documentum from August 1999 to October 2000. Mr. DeWalt has served on the board of directors of Delta Air Lines, Inc. since November 2011. Mr. DeWalt also serves on the board of directors of Five9, Inc. Mr. DeWalt served on the board of directors of Polycom, Inc. from November 2005 to May 2013 and as its Chairman of the Board from May 2010 to May 2013 and served on the board of directors of Jive Software, Inc. from February 2011 to April 2013. Mr. DeWalt holds a B.S. in Computer Science from the University of Delaware. Our board of directors believes that Mr. DeWalt possesses specific attributes that qualify him to serve as a director, including the perspective and experience he brings as our Chief Executive Officer and his extensive senior management expertise in the network security industry.

 

122

---

Table of Contents

Ashar Aziz founded FireEye in 2004 and served as our Chief Executive Officer until November 2012. He has served as our Vice Chairman of the Board, Chief Technology Officer and Chief Strategy Officer since November 2012 and as a member of our board of directors since February 2004. Prior to FireEye, Mr. Aziz founded Terraspring, Inc., a data center automation and virtualization company acquired by Sun Microsystems, Inc., in November 2002 and served as Chief Technology Officer of its N1 program until October 2003. Prior to Terraspring, Inc., Mr. Aziz spent 12 years at Sun Microsystems as a distinguished engineer focused on networking and network security. Mr. Aziz holds an S.B. in Electrical Engineering and Computer Science from Massachusetts Institute of Technology and an M.S. in Electrical Engineering and Computer Science from the University of California, Berkeley, where he received the U.C. Regents Fellowship. Our board of directors believes that Mr. Aziz possesses specific attributes that qualify him to serve as a director, including the perspective and experience he brings as our founder and former Chief Executive Officer and as one of our largest stockholders, as well as his extensive experience with technology companies.

 

Kevin R. Mandia has served as our Senior Vice President and Chief Operating Officer since our acquisition of Mandiant in December 2013. Prior to joining FireEye, Mr. Mandia was the chief executive officer of Mandiant and had served in that capacity since he founded Mandiant in 2004. Prior to forming Mandiant, Mr. Mandia served as the director of computer forensics at Foundstone (later acquired by McAfee Corporation) from 2000 to 2003 and as the director of information security for Sytex (later acquired by Lockheed Martin) from 1998 to 2000. From 1993 to 2000, Mr. Mandia was an officer in the United States Air Force, where he served in various capacities, including as a computer security officer in the 7th Communications Group at the Pentagon, and later as a special agent in the Air Force Office of Special Investigations (AFOSI). Mr. Mandia holds a B.S. in Computer Science from Lafayette College and an M.S. in Forensic Science from The George Washington University. In 2011, Mr. Mandia was named Ernst & Young Entrepreneur of the Year for the Greater Washington area. He completed the Harvard Business School’s Owner/President Management Program in February 2013. Mr. Mandia has taught graduate level courses at Carnegie Melon University and The George Washington University and has co-authored two books on responding to security breaches, Incident Response: Performing Computer Forensics (McGraw-Hill, 2003) and Incident Response: Investigating Computer Crime (McGraw-Hill, 2001).

 

Michael J. Sheridan has served as our Senior Vice President and Chief Financial Officer since June 2011. Prior to joining FireEye, Mr. Sheridan was Chief Financial Officer at Mimosa Systems, Inc., a provider of enterprise content archiving systems, from 2009 until its acquisition by Iron Mountain, Inc. in 2010. Prior to Mimosa Systems, Inc., Mr. Sheridan was Chief Financial Officer of Playlist, Inc., a social media and Internet company, from 2008 to 2009, Facebook Inc., a social media and Internet company, from 2006 to 2007, IGN Entertainment, Inc., a media and entertainment company (acquired by News Corporation in 2005), from 2004 to 2006, and SonicWALL, Inc., a network security and data protection company, from 1999 to 2003. Mr. Sheridan received a B.S. in Commerce from Santa Clara University.

 

Alexa King has served as our Senior Vice President, General Counsel and Secretary since April 2012. Prior to joining FireEye, Ms. King was Vice President, General Counsel and Secretary of Aruba Networks, Inc., a provider of enterprise wireless network software and hardware from December 2005 to April 2012. From 2000 to 2005, Ms. King served as Senior Director of Legal at Siebel Systems, Inc. a software company, and her early career included working at Pillsbury Madison & Sutro (now Pillsbury Winthrop) and Fenwick & West. Additionally, Ms. King served as founding director of Pathbrite, Inc. (f/k/a RippleSend, Inc.) from 2008 to 2009 and as advisor from 2009 to 2011. Ms. King graduated magna cum laude from Harvard College with a degree in Eastern European Studies and received her J.D. from the University of California, Berkeley, Boalt Hall School of Law, where she was named to the Order of the Coif.

 

Jeffrey C. Williams has served as our Senior Vice President, Sales since March 2010. He also served as a member of our advisory board from April 2006 to February 2010. Prior to joining FireEye, Mr. Williams was vice president of sales at Cisco Systems, Inc., a technology manufacturing and sales company, from April 2003 to January 2010. Prior to Cisco Systems, Mr. Williams managed sales for IronPort Systems, Inc. prior to its

 

123

---

Table of Contents

acquisition by Cisco Systems in June 2007. Prior to IronPort, Mr. Williams was Vice President of Sales at IntruVert Networks, Inc., a next-generation IPS company which was acquired by McAfee, from February 2002 to April 2003. Prior to IntruVert Networks, Mr. Williams was Vice President of Sales of Abeona Networks, Inc. from January 2001 to January 2002 and at GlobalCenter Inc., which was acquired by Exodus Communications, from February 1990 to January 2001. Additionally, Mr. Williams served on the board of directors of Meraki, Inc. from 2010 until its acquisition by Cisco Systems in 2012. He holds a B.S. in Marketing from California State University, Chico.

 

Bahman Mahbod has served as our Senior Vice President, Engineering since February 2012, and as our Vice President of Engineering and Security Research from October 2007 to February 2012. Prior to joining FireEye, Mr. Mahbod served as Head of Server Engineering, Quality Assurance and Technical Publications at Gemini Mobile Technologies, Inc., a provider of infrastructure and mobile messaging software, from 2005 to 2007 and Vice President of Engineering, Network Operations and Client Services at FaceTime Communications (now Actiance), a provider of extensible real-time security and management solutions, from 1999 to 2005. Prior to that, Mr. Mahbod held various leadership positions at IBM Corporation, Sybase, Inc., Vantive Inc. and Bell-Northern Research Co. Mr. Mahbod holds a B.S. in Computer Science from the University of California, Santa Barbara.

 

Non-Employee Directors

 

Ronald E. F. Codd has served as a member of our board of directors since July 2012. Mr. Codd has been an independent business consultant since April 2002. From January 1999 to April 2002, Mr. Codd served as President, Chief Executive Officer and a director of Momentum Business Applications, Inc., an enterprise software company. From September 1991 to December 1998, Mr. Codd served as Senior Vice President of Finance and Administration and Chief Financial Officer of PeopleSoft, Inc., a provider of human resource management systems. Mr. Codd has served on the board of directors of ServiceNow, Inc., Rocket Fuel Inc., and Veeva Systems Inc. since February 2012. Additionally, Mr. Codd previously served on the boards of directors of numerous information technology companies, including most recently DemandTec, Inc., Interwoven, Inc. and Data Domain, Inc. Mr. Codd holds a B.S. in Accounting from the University of California, Berkeley and an M.M. in Finance and M.I.S. from the Kellogg Graduate School of Management at Northwestern University. Our board of directors believes that Mr. Codd possesses specific attributes that qualify him to serve as a director, including his extensive management and software industry experience, and his experience in finance.

 

William M. Coughran Jr. has served as a member of our board of directors since July 2012. Mr. Coughran has been a member of Sequoia Capital, a venture capital firm, since October 2011. He currently serves on the board of directors of multiple private companies, and he served on the board of directors of Clearwell Systems, Inc. from March 2005 to June 2011, when it was acquired by Symantec, Inc. Prior to joining Sequoia Capital, Mr. Coughran held a number of roles at Google Inc. from April 2003 to September 2011, including Senior Vice President of Engineering. At Google, he was responsible for security efforts as well as serving on the executive committee and as an advisor to the founders and Eric Schmidt. Prior to Google, Mr. Coughran co-founded Entrisphere, Inc., a telecom equipment vendor, and served as its initial Chief Executive Officer and in other roles from November 1999 to December 2002. From 1980 to 1999, Mr. Coughran held a number of roles at Bell Labs, Inc. (originally part of AT&T, Inc. and then Lucent Technologies, Inc.), including vice president of the Computing Sciences Research Center, known for key developments in operating and distributed systems as well as early work in networked computer security. Mr. Coughran has held adjunct and visiting faculty roles at Stanford University, Duke University, and ETH Zürich. Mr. Coughran has a B.S. and M.S. in Mathematics from California Institute of Technology and an M.S. and Ph.D. in Computer Science from Stanford University. Our board of directors believes that Mr. Coughran possesses specific attributes that qualify him to serve as a director, including his extensive experience with technology companies and his experience as an investment professional.

 

Gaurav Garg has served as a member of our board of directors since September 2004. Mr. Garg co-founded and has been a managing member of Wing Venture Partners, a venture capital firm, since June 2013. He has served on the board of directors of Ruckus Wireless, Inc. since August 2002. Mr. Garg also currently serves

 

124

---

Table of Contents

on the board of directors of a number of privately held technology companies, including MobileIron and Jasper Wireless. From May 2001 to June 2010, Mr. Garg was a non-managing member at Sequoia Capital, a venture capital firm. Prior to joining Sequoia Capital, Mr. Garg was a founder, board member and Senior Vice President of Product Management at Redback Networks, Inc., a telecommunications equipment company acquired by Ericsson, Inc. in 2007. Prior to Redback Networks, Mr. Garg held various engineering positions at SynOptics Communications, Inc. and Bay Networks, Inc., both computer network equipment vendors. Mr. Garg holds a B.S. and M.S. in Electrical Engineering and a B.S. in Computer Science, all from Washington University in St. Louis. Our board of directors believes that Mr. Garg possesses specific attributes that qualify him to serve as a director, including his extensive experience with technology and networking companies as an investment professional, board member, company founder, and senior executive.

 

Promod Haque has served as a member of our board of directors since March 2005. Mr. Haque has been a managing partner of Norwest Venture Partners, a venture capital firm, since 1990 and currently serves as senior managing partner. He has served on the board of directors of Cyan, Inc. since April 2007. Mr. Haque also currently serves on the boards of directors of several privately held companies, including Apigee, Inc. and PCH International, Inc., and previously served on the board of directors of Persistent Systems Limited from November 2005 to November 2010, and as Chairman of the Board of Veraz Networks, Inc., a provider of application, control and bandwidth optimization solutions, from July 2001 until October 2010, when it merged with Dialogic Corporation. Mr. Haque holds a B.S. in Electrical Engineering from the University of Delhi, India, an M.B.A. from the Kellogg Graduate School of Management at Northwestern University, and a Ph.D. in Electrical Engineering from Northwestern University. Our board of directors believes that Mr. Haque possesses specific attributes that qualify him to serve as a director, including his substantial experience as an investment professional and his extensive experience with technology and networking companies.

 

Robert F. Lentz has served as a member of our board of directors since March 2010. Mr. Lentz has served as the President of Cyber Security Strategies since October 2009. He served as the Deputy Assistant Secretary of Defense for Cyber, Identity and Information Assurance in the Office of the Assistant Secretary of Defense, Networks and Information Integration/Chief Information Officer from November 2007 to October 2009. Since November 2000, he has also served as the Chief Information Security Officer for the U.S. Department of Defense. He previously worked at the National Security Agency from 1975 to 2000, where he served in the first National Computer Security Center as Chief of Network Security. Mr. Lentz has served as a member of the board of directors of Sypris Solutions, Inc. since July 2012, as well as on the board of directors of two private companies and as an advisor to several other technology companies. Mr. Lentz holds a B.A. in History and Social Science from St. Mary’s College and an M.S. in National Strategy from National Defense University. Our board of directors believes that Mr. Lentz possesses specific attributes that qualify him to serve as a director, including his substantial experience in the security industry, his extensive experience with the U.S. federal government and breadth of knowledge in international cyber security.

 

Enrique Salem has served as a member of our board of directors since February 2013. Mr. Salem was president, Chief Executive Officer and a director of Symantec Corporation, a provider of information security, storage and systems management solutions, from April 2009 until July 2012. Mr. Salem was Chief Operating Officer of Symantec Corporation from January 2008 to April 2009, group President, Worldwide Sales and Marketing from April 2007 to January 2008, group President, Consumer Products from May 2006 to April 2007, Senior Vice President, Consumer Products and Solutions from February 2006 to May 2006, Senior Vice President, Security Products and Solutions from January 2006 to February 2006, and Senior Vice President, Network and Gateway Security Solutions from June 2004 to February 2006. Prior to Symantec, from April 2002 to June 2004, Mr. Salem served as President and Chief Executive Officer of Brightmail, Inc., an email filtering company, prior to its acquisition by Symantec in 2004. Mr. Salem also held senior leadership roles at Oblix Inc., Ask Jeeves Inc., Peter Norton Computing, Inc. and Security Pacific Merchant Bank. In March 2011, he was appointed to President Barack Obama’s Management Advisory Board. Mr. Salem has been a director of Automatic Data Processing, Inc. since January 2010 and previously served on the board of directors of Symantec Corporation from April 2009 to July 2012. He received the Estrella Award from the Hispanic IT Executive

 

125

---

Table of Contents

Council in 2010 and was named Entrepreneur of the Year in 2004 by Ernst & Young. Mr. Salem holds an A.B. in Computer Science from Dartmouth College. Our board of directors believes that Mr. Salem possesses specific attributes that qualify him to serve as a director, including his extensive leadership experience, including oversight of global operations, as well as a strong background in information technology, data security, compliance and systems management.

 

Our executive officers are appointed by our board of directors and serve until their successors have been duly elected and qualified. There are no family relationships among any of our directors or executive officers.

 

Code of Business Conduct and Ethics

 

Our board of directors has adopted a code of business conduct and ethics that applies to all of our employees, officers and directors, including our Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, and other executive and senior financial officers. The full text of our code of business conduct and ethics is available on our Website at www.fireeye.com. We intend to post any amendment to our code of business conduct and ethics, and any waivers of such code for directors and executive officers, on the same Website. The information on our Website is not incorporated by reference into this prospectus.

 

Board Composition

 

Our business affairs are managed under the direction of our board of directors, which is currently composed of eight members. Six of our directors are independent within the meaning of the independent director guidelines of The NASDAQ Stock Market. Our board of directors is divided into three classes with staggered three-year terms. At each annual meeting of stockholders, the successors to the directors whose terms then expire will be elected to serve from the time of election and qualification until the third annual meeting following their election. Our directors are divided among the three classes as follows:

 

•

the Class I directors are Messrs. Coughran, Garg and Haque, and their terms will expire at the annual meeting of stockholders to be held in 2014;

 

•

the Class II directors are Messrs. Aziz, DeWalt and Lentz, and their terms will expire at the annual meeting of stockholders to be held in 2015; and

 

•

the Class III directors are Messrs. Codd and Salem, and their terms will expire at the annual meeting of stockholders to be held in 2016.

 

Each director’s term will continue until the election and qualification of his successor, or his earlier death, resignation, or removal. We expect that any increase or decrease in the number of directors will be distributed among the three classes so that, as nearly as possible, each class will consist of one-third of the directors. The classification of our board of directors may have the effect of delaying or preventing changes in our management or a change in control of our company. See “Description of Capital Stock—Anti-Takeover Effects of Delaware Law and Our Amended and Restated Certificate of Incorporation and Amended and Restated Bylaws” for a discussion of other anti-takeover provisions found in our amended and restated certificate of incorporation and amended and restated bylaws.

 

Director Independence

 

Our common stock is listed on The NASDAQ Global Select Market. Under the rules of The NASDAQ Stock Market, independent directors must comprise a majority of a listed company’s board of directors within a specified period of time after the completion of such company’s initial public offering. In addition, the rules of The NASDAQ Stock Market require that, subject to specified exceptions, each member of a listed company’s audit, compensation, and nominating and corporate governance committees be independent. Under the rules of The NASDAQ Stock Market, a director will only qualify as an “independent director” if, in the opinion of that company’s board of directors, that director does not have a relationship that would interfere with the exercise of independent judgment in carrying out the responsibilities of a director.

 

126

---

Table of Contents

Audit committee members must also satisfy the independence criteria set forth in Rule 10A-3 under the Securities Exchange Act of 1934, as amended, or the Exchange Act. In order to be considered independent for purposes of Rule 10A-3, each member of the audit committee of a listed company may not, other than in his or her capacity as a member of such committee, the board of directors, or any other board committee: (i) accept, directly or indirectly, any consulting, advisory, or other compensatory fees from the listed company or any of its subsidiaries; or (ii) be an affiliated person of the listed company or any of its subsidiaries.

 

Our board of directors has undertaken a review of the independence of each director and considered whether such director has a material relationship with us that could compromise his ability to exercise independent judgment in carrying out his responsibilities. As a result of this review, our board of directors has determined that Messrs. Codd, Coughran, Garg, Haque, Lentz and Salem are “independent directors” as defined under the applicable rules and regulations of the Securities and Exchange Commission, or SEC, and the listing requirements and rules of The NASDAQ Stock Market.

 

Committees of the Board of Directors

 

Our board of directors has established an audit committee, a compensation committee, and a nominating and corporate governance committee, each of which has the composition and responsibilities described below. Members serve on these committees until their resignation or until otherwise determined by our board of directors.

 

Audit Committee

 

Our audit committee is comprised of Ronald E. F. Codd, Gaurav Garg and Robert F. Lentz, each of whom is a non-employee member of our board of directors. Mr. Codd is the chair of our audit committee. Our board of directors has determined that each of the members of our audit committee satisfies the requirements for independence and financial literacy under the rules and regulations of The NASDAQ Stock Market and the SEC, including Rule 10A-3. Our board of directors has also determined that Mr. Codd qualifies as an “audit committee financial expert” as defined in the SEC rules and satisfies the financial sophistication requirements of The NASDAQ Stock Market. This designation does not impose on Mr. Codd any duties, obligations or liabilities that are greater than those generally imposed on members of our audit committee and our board of directors. Our audit committee is responsible for, among other things:

 

•

selecting and hiring our registered public accounting firm;

 

•

evaluating the performance and independence of our registered public accounting firm;

 

•

approving the audit and pre-approving any non-audit services to be performed by our independent registered public accounting firm;

 

•

reviewing the adequacy and effectiveness of our internal control policies and procedures and our disclosure controls and procedures;

 

•

overseeing procedures for the treatment of complaints on accounting, internal accounting controls or audit matters;

 

•

reviewing and discussing with management and the independent registered public accounting firm the results of our annual audit, our quarterly financial statements and our publicly filed reports;

 

•

reviewing and approving related person transactions; and

 

•

preparing the audit committee report that the SEC requires in our annual proxy statement.

 

Compensation Committee

 

Our compensation committee is comprised of William M. Coughran Jr., Promod Haque and Enrique Salem, each of whom is a non-employee member of our board of directors. Mr. Salem is the chair of our compensation committee. Our board of directors has determined that each member of our compensation committee meets the

 

127

---

Table of Contents

requirements for independence under the rules of The NASDAQ Stock Market and the SEC, is a “non-employee director” within the meaning of Rule 16b-3 under the Exchange Act and is an “outside director” within the meaning of Section 162(m) of the Internal Revenue Code of 1986, or the Code. Our compensation committee is responsible for, among other things:

 

•

reviewing and approving our Chief Executive Officer’s and other executive officers’ annual base salaries; incentive compensation plans, including the specific goals and amounts; equity compensation, employment agreements, severance arrangements and change in control agreements; and any other benefits, compensation or arrangements; provided that any approvals relating to the Chief Executive Officer’s compensation will be subject to the ratification of our entire board of directors, with any non-independent directors abstaining;

 

•

administering our equity compensation plans;

 

•

overseeing our overall compensation philosophy, compensation plans and benefits programs; and

 

•

preparing the compensation committee report that the SEC requires in our annual proxy statement.

 

Nominating and Corporate Governance Committee

 

Our nominating and corporate governance committee is comprised of Ronald E. F. Codd, William M. Coughran Jr. and Promod Haque, each of whom is a non-employee member of our board of directors. Mr. Coughran is the chair of our nominating and corporate governance committee. Our board of directors has determined that each member of our nominating and corporate governance committee meets the requirements for independence under the rules of The NASDAQ Stock Market. Our nominating and corporate governance committee is responsible for, among other things:

 

•

evaluating and making recommendations regarding the composition, organization, and governance of our board of directors and its committees;

 

•

evaluating and making recommendations regarding the creation of additional committees or the change in mandate or dissolution of committees;

 

•

reviewing and making recommendations with regard to our corporate governance guidelines and compliance with laws and regulations; and

 

•

reviewing and approving conflicts of interest of our directors and corporate officers, other than related person transactions reviewed by the audit committee.

 

We have posted the charters of our audit, compensation and nominating and corporate governance committees on our Website at www.fireeye.com, and we intend to post any amendments to such charters that may be adopted from time to time on the same Website. Our board of directors may from time to time establish other committees.

 

Compensation Committee Interlocks and Insider Participation

 

None of the members of our compensation committee is or has been an officer or employee of our company. None of our executive officers currently serves, or in the past year has served, as a member of the board of directors or compensation committee, or other board committee performing equivalent functions, of any entity that has one or more executive officers serving on our compensation committee or our board of directors. We have had a compensation committee since November 2012. Prior to establishing the compensation committee, our full board of directors made decisions relating to the compensation of our executive officers.

 

128

---

Table of Contents

Director Compensation

 

We do not currently have a formal policy with respect to compensation payable to our non-employee directors for service as directors. Our non-employee directors do not currently receive, and did not receive during 2013, any cash compensation for their services as directors or as board committee members. Our board of directors has, however, granted equity awards from time to time to non-employee directors who are not affiliated with our venture fund investors as compensation for their service as directors.

 

The table below shows equity compensation earned by our non-employee directors during 2013.

 

Director Compensation Table

 

Name(1)		Option Awards  ($)(2)				Total ($)
Ronald E. F. Codd(3)			—				—
William M. Coughran Jr.			—				—
Enrique Salem(4)			682,093				682,093
Gaurav Garg(5)			—				—
Promod Haque			—				—
Robert F. Lentz(6)			—				—

 

(1)

Except as described in the footnotes below, no non-employee director held options to purchase shares of our common stock or unvested stock awards as of December 31, 2013.

(2)

The amount reported in this column represents the aggregate grant date fair value of the awards as computed in accordance with Financial Accounting Standard Board Accounting Standards Codification Topic 718. The assumptions used in calculating the grant date fair value of the awards reported in this column are set forth in the notes to our audited consolidated financial statements included elsewhere in this prospectus.

(3)

As of December 31, 2013, Mr. Codd held an option to purchase 125,000 shares of common stock at an exercise price of $2.48 per share, and the Codd Revocable Trust dtd March 6, 1998 held 36,459 shares of restricted common stock that remained subject to a right of repurchase by us as of such date.

(4)

As of December 31, 2013, Mr. Salem held 200,000 shares of restricted common stock that remained subject to a right of repurchase by us as of such date.

(5)

As of December 31, 2013, Mr. Garg’s affiliated entities held 151,729 shares of restricted common stock that remained subject to a right of repurchase by us as of such date.

(6)

As of December 31, 2013, Mr. Lentz held an option to purchase 430,382 shares of common stock at an exercise price of $0.07 per share.

 

See “Executive Compensation” for information about the compensation of directors who are also our employees.

 

129

---

Table of Contents

EXECUTIVE COMPENSATION

 

Summary Compensation Table

 

The following table provides information regarding the compensation awarded to, or earned by, our executive officers, including each of our named executive officers, during 2012 and 2013.

 

Name and Principal Position		Year				Salary ($)				Bonus  ($)(1)				Stock Awards ($)(2)(3)				Option Awards ($)(2)				Non-Equity Incentive Plan Compensation ($)(4)				Total ($)
David G. DeWalt, Chief Executive Officer			2013				350,000				190,000				—				431,177				—				971,177
			2012				42,424				23,562				3,576,032	(5)			2,390,756				—				6,032,774
Ashar Aziz,			2013				300,000				—				—				—				137,963				437,963
Chief Technology Officer, Chief Strategy Officer, and Former Chief Executive Officer			2012				300,000				171,000				—				1,916,037				—				2,387,037
Jeffrey C. Williams,			2013				226,042				150,000				302,495				—				190,636				869,173
Senior Vice President, Sales			2012				200,000				150,000				—				—				336,202				686,202
Alexa King,			2013				250,000				—				302,495				—				96,289				648,784
Senior Vice President, General Counsel and Secretary			2012				177,083				40,403				—				436,885				—				654,371
Bahman Mahbod,			2013				250,000				—				302,495				—				94,476				646,971
Senior Vice President, Engineering			2012				246,932				57,000				—				124,813				—				428,745
Michael J. Sheridan,			2013				265,000				—				302,495				—				134,297				701,792
Senior Vice President and Chief Financial Officer			2012				265,000				94,536				—				—				—				359,536
Kevin R. Mandia, Senior Vice President and Chief Operating Officer(6)			2013				—				—				—				—				—				—

 

(1)

Represents amounts paid as a discretionary bonus to our executive officers, including our named executive officers, for exemplary performance in 2012 as compared with our 2012 operating plan.

(2)

The amounts in this column represent the aggregate grant date fair value of the award as computed in accordance with Financial Accounting Standard Board Accounting Standards Codification Topic 718. The assumptions used in calculating the grant date fair value of the awards reported in this column are set forth in the notes to our audited consolidated financial statements included elsewhere in this prospectus.

(3)

In February 2014, our board of directors granted restricted stock units covering up to 41,250 shares of our common stock to Mr. Aziz, restricted stock units covering up to 82,500 shares of our common stock to Mr. Williams, restricted stock units covering up to 53,125 shares of our common stock to Ms. King, restricted stock units covering up to 55,000 shares of our common stock to Mr. Mahbod, and restricted stock units covering up to 48,125 shares of our common stock to Mr. Sheridan. In addition, in March 2014, our board of directors granted restricted stock units covering up to 187,500 shares of our common stock to Mr. DeWalt. All of these restricted stock units are subject to performance-based and/or time-based vesting schedules.

 

130

---

Table of Contents

(4)

For 2013, represents amounts paid under the Employee Incentive Plan. For 2012, represents amounts paid to Mr. Williams under his Master Commission Plan.

(5)

Represents the grant date fair value of stock awards granted to Mr. DeWalt in his capacity as our Chief Executive Officer. For information regarding additional equity awards received by Mr. DeWalt during 2012 in his capacity as a member of our board of directors and as Chairman of the Board, see the disclosure under “Management—Director Compensation—Director Compensation Table” in our prospectus dated September 20, 2013, as filed with the SEC pursuant to Rule 424(b)(3).

(6)

Mr. Mandia was appointed as our Senior Vice President and Chief Operating Officer on December 30, 2013 and accordingly received no compensation from us during 2013.

 

Bonus and Non-Equity Incentive Plan Compensation

 

Discretionary Bonus

 

Mr. DeWalt, our Chief Executive Officer and Chairman of the Board, and Mr. Williams, our Senior Vice President, Sales, each received discretionary bonuses for exemplary individual performance in 2013 and for company performance in 2013 as compared to our 2013 operating plan. These discretionary bonuses were not paid pursuant to any formal plan document.

 

Non-Equity Incentive Plan Compensation

 

Our compensation committee has adopted the Employee Incentive Plan, or the Bonus Plan. See the disclosure under “Employee Incentive Plan” for additional information.

 

2013 Performance Targets under Employee Incentive Plan – Non-Sales Executives

 

For 2013, our compensation committee approved the performance targets under the Bonus Plan for each of our executive officers other than Messrs. Williams, Mandia and DeWalt. For 2013, the compensation committee set commission-based targets for Mr. Williams, as described below, and Mr. Mandia was not employed with us for most of 2013.

 

Under the Bonus Plan, each eligible participant has an opportunity to earn semi-annual payments, subject to our achievement of corporate performance goals and the participant’s achievement of individual goals. For 2013, the relative weight of each performance element was 75% corporate and 25% individual, and our corporate-level goals were certain targets for bookings, EBITDA and new customers.

 

For 2013, each of these corporate goals was equally weighted. The minimum level of achievement for each corporate component is 80%, which corresponds to a 75% payout for that component. If achievement for a component is 120% or greater, then the corresponding payout for that component is 140%. The payout is scaled for achievement between 80% and 120%. Our compensation committee reserves the right to adjust the corporate performance target in the case of a merger, acquisition or such other unforeseeable future event occurs.

 

With respect to individual goals, the amount of achievement and payout is determined based on our Chief Executive Officer’s assessment of achievement. Payout for the individual performance component can be up to 200%.

 

The compensation committee reserves the right to increase or decrease (including to zero) the amount of any payout to a participant.

 

131

---

Table of Contents

For 2013, the target incentive amounts and the aggregate annual payments earned by our executive officers under the Bonus Plan were as follows:

 

Executive Officer		Annual Target  Award Opportunity				Actual Annual  Award Amount
Ashar Aziz		$	150,000				$137,963
Alexa King.			100,000				96,289
Bahman Mahbod			100,000				94,476
Michael J. Sheridan			135,000				134,297

 

2013 Performance Targets under Employee Incentive Plan – Sales Executive

 

For 2013, our compensation committee approved commission-based performance targets for Mr. Williams under the Bonus Plan. These commissions were calculated by multiplying his effective commission rate by the value of our bookings. Certain types of orders were eligible for additional bonuses at an increased commission rate. In addition, the compensation committee provided that (i) Mr. Williams’ effective commission rate would be accelerated if he exceeded his annual bookings target and (ii) commissions would not be subject to a cap and would be paid prior to the end of the month following the close of the month in which the commissions were earned.

 

For 2013, the target incentive amount and the aggregate annual payment earned by Mr. Williams under the Bonus Plan were as follows:

 

Executive Officer		Annual Target Award Opportunity				Actual Annual  Award Amount
Jeffrey C. Williams		$	200,000			$190,636

 

Employment Agreements for Executive Officers

 

David G. DeWalt

 

Effective November 19, 2012, we entered into an amended and restated offer letter with David G. DeWalt, our Chief Executive Officer and Chairman of the Board. The offer letter has no specific term and provides that Mr. DeWalt is an at-will employee. Mr. DeWalt’s current annual base salary is $350,000, and he is eligible for annual target incentive payments of $350,000 for 2014. Mr. DeWalt’s offer letter was subsequently amended in August 2013.

 

In connection with Mr. DeWalt’s commencement of employment as our Chief Executive Officer, the vesting schedule of each of Mr. DeWalt’s equity awards was amended and restated to vest from and after the date Mr. DeWalt became our Chief Executive Officer, as follows:

 

•

Mr. DeWalt’s restricted stock award covering 269,686 shares of common stock granted on May 1, 2012 vests as to 1/48th of the shares subject to the award each month beginning in May 2012, subject to his continuous service as a member of our board of directors on each such vesting date.

 

•

Mr. DeWalt’s restricted stock award covering 377,560 shares of common stock granted on May 1, 2012 vests as to 1/7th of the shares subject to the award each month beginning in May 2012, subject to his continuous service as our Chairman of the Board on each such vesting date.

 

•

Mr. DeWalt’s restricted stock award covering 431,497 shares of common stock granted on May 1, 2012 vests as to 100% of the shares subject to the award on the date that is six months following the date Mr. DeWalt became our Chief Executive Officer, subject to his continuous service as our Chief Executive Officer on such vesting date.

 

132

---

Table of Contents

•

Mr. DeWalt’s restricted stock award covering 836,026 shares of common stock granted on May 1, 2012 vests as to 100% of the shares subject to the award on the first anniversary of the date Mr. DeWalt became our Chief Executive Officer, subject to his continuous service as our Chief Executive Officer on such date.

 

•

Mr. DeWalt’s restricted stock award covering 350,591 shares of common stock granted on May 1, 2012 vests as to 1/5th of the shares subject to the award each month beginning on the last day of the month following the first anniversary of the date Mr. DeWalt became our Chief Executive Officer, subject to his continuous service as our Chief Executive Officer on each such vesting date.

 

•

Mr. DeWalt’s stock option to purchase 2,157,486 shares of our common stock granted on May 1, 2012 vests in 31 equal monthly installments beginning on the last day of the 18th month following the date Mr. DeWalt became our Chief Executive Officer, subject to his continuous service as our Chief Executive Officer on each such vesting date.

 

•

Mr. DeWalt’s stock option to purchase 41,000 shares of our common stock granted on June 15, 2012 vests as to 1/48th of the shares subject to the award each month beginning on the date Mr. DeWalt became our Chief Executive Officer, subject to his continuous service as our Chief Executive Officer on each such vesting date.

 

In August 2013, Mr. DeWalt’s offer letter was amended to provide that any of Mr. DeWalt’s rights to severance, equity acceleration and/or change of control benefits under his offer letter would be superseded by eligibility for severance benefits under our Change of Control Severance Policy for Officers. See the disclosure under “Change of Control Severance Policy for Officers” for additional information.

 

The description above does not purport to be complete and is qualified in its entirety by the provisions of Mr. DeWalt’s offer letter, as amended, a copy of which has been filed as an exhibit to the registration statement of which this prospectus is a part.

 

Ashar Aziz

 

Effective November 19, 2012, we entered into an offer letter with Ashar Aziz, our founder, Vice Chairman of the Board, Chief Technology Officer and Chief Strategy Officer. The offer letter has no specific term and provides that Mr. Aziz is an at-will employee. Mr. Aziz’s current annual base salary is $300,000, and he is eligible for annual target incentive payments of $150,000 each year.

 

In connection with Mr. Aziz’s transition from our Chief Executive Officer to our Chief Technology Officer and Chief Strategy Officer, the offer letter clarified and confirmed the vesting schedule of each of Mr. Aziz’s equity awards as follows:

 

•

Mr. Aziz’s stock option to purchase 2,170,794 shares of common stock granted on December 28, 2009 vests as to 38,441 shares subject to the award each month beginning on June 25, 2009 until fully vested.

 

•

Mr. Aziz’s stock option to purchase 856,218 shares of common stock granted on June 25, 2010 vests as to 15,162 shares subject to the award each month beginning on June 25, 2009 until fully vested.

 

•

Mr. Aziz’s stock option to purchase 926,640 shares of common stock granted on May 27, 2011 vests as to 19,305 shares subject to the award each month beginning on June 1, 2011 until fully vested.

 

•

Mr. Aziz’s stock option to purchase 555,984 shares of common stock granted on May 27, 2011 vests as to 11,583 shares subject to the award each month beginning on December 29, 2012 until fully vested.

 

•

Mr. Aziz’s stock option to purchase 1,618,439 shares of common stock granted on March 30, 2012 vested as to 36,782 shares subject to the award on November 26, 2012 and December 26, 2012, vested as to 12,260 shares on the 26th of each month from January 2013 through June 2013, and then vests as to 36,782 shares on the 26th of each month until fully vested.

 

133

---

Table of Contents

•

Mr. Aziz’s stock option to purchase 484,425 shares of common stock granted on May 25, 2012 vested on November 19, 2012, the date Mr. DeWalt became our Chief Executive Officer.

 

The vesting terms described above as to Mr. Aziz are all subject to Mr. Aziz’s continuous service with us on each vesting date. Pursuant to the terms of the offer letter, effective as of the date Mr. DeWalt joined us as our Chief Executive Officer, 500,000 of the unvested shares subject to the equity awards described above vested on a pro rata basis across all such awards. See “—Outstanding Equity Awards at Fiscal Year-End” for a description of the vesting of Mr. Aziz’s equity awards as of December 31, 2013 after giving effect to the acceleration described in the preceding sentence.

 

In addition to the vesting acceleration described above, Mr. Aziz’s offer letter also provides for the vesting acceleration of his equity awards as follows:

 

•

Upon the effectiveness of our initial public offering and the public trading of our common stock while Mr. Aziz is an employee or director, 500,000 of the unvested shares subject to his equity awards will vest.

 

•

If Mr. Aziz remains an employee or director on the six-month anniversary of the effectiveness of our initial public offering, 500,000 of the unvested shares subject to his equity awards will vest.

 

•

If, prior to the expiration of the underwriter-imposed lock-up agreement in connection with our initial public offering, Mr. Aziz is subject to a termination of employment without cause, then subject to his execution of a release of claims, the unvested shares subject to his equity awards will vest as if Mr. Aziz had completed an additional 12 months of employment following the date of his termination of employment. Also, if Mr. Aziz is entitled to such vesting acceleration and is not maintained as a director through the later of the expiration of the underwriter-imposed lock-up agreement in connection with our initial public offering and our first annual meeting as a public company, then the unvested shares subject to his equity awards will vest as if Mr. Aziz had completed an additional 12 months of service following his termination date.

 

•

If we are subject to a change in control when Mr. Aziz is not an employee but is a director, then 100% of his unvested equity awards will vest.

 

•

If we are subject to a change in control when Mr. Aziz is an employee and Mr. Aziz subsequently terminates his employment, then, subject to his execution of a release of claims, Mr. Aziz’s equity awards will vest as if Mr. Aziz had completed an additional 24 months of employment following his termination of employment date.

 

Mr. Aziz’s offer letter provides that, if prior to the expiration of the underwriter-imposed lock-up agreement in connection with our initial public offering, Mr. Aziz is terminated without cause either prior to, or more than 24 months following, a change in control, then, subject to the execution of a release of claims, Mr. Aziz will receive continuing payment of his base salary for a period of 12 months. If, prior to the expiration of the underwriter imposed lock-up agreement in connection with our initial public offering, Mr. Aziz’s employment is terminated without cause or for good reason, in each case within 24 months following a change in control, then, subject to the execution of a release of claims, Mr. Aziz will receive continuing payment of his base salary for a period of 12 months and a payment equal to Mr. Aziz’s annual target bonus.

 

Mr. Aziz had entered into certain promissory notes with us in connection with the purchase of our common stock. In connection with his transition, the term of these notes were modified so that their term extended until the first to occur of (i) December 31, 2017 or (ii) (a) the day prior to the date we file our registration statement in connection with our initial public offering, (b) the date we are acquired by a company whose stock is publicly traded and the notes would violate applicable law, or (c) the date we determine that the notes would be a violation of Section 402 of the Sarbanes-Oxley Act. All promissory notes have been repaid in full as described in greater detail under the heading “Certain Relationships and Related Party Transactions—Loans to Executive Officers.”

 

134

---

Table of Contents

The description above does not purport to be complete and is qualified in its entirety by the provisions of Mr. Aziz’s offer letter, a copy of which has been filed as an exhibit to the registration statement of which this prospectus is a part.

 

Kevin R. Mandia

 

Effective December 30, 2013, we entered into an offer letter with Kevin R. Mandia, our Senior Vice President and Chief Operating Officer. The offer letter is for no specific term and provides that Mr. Mandia is an at-will employee. Mr. Mandia’s current annual base salary is $260,000, and he is eligible for annual target incentive payments based on the achievement of certain individual performance objectives and company success metrics to be determined by us after consultation with Mr. Mandia. Mr. Mandia is also eligible for severance benefits under our Change of Control Severance Policy for Officers.

 

Pursuant to the terms of the offer letter, Mr. Mandia agreed that we would impose vesting requirements on a portion of the shares of our common stock that were issued to him as stock consideration as part of our acquisition of Mandiant and that would otherwise have been fully vested shares of our common stock. As a result, we imposed the following vesting requirements on 469,813 shares of our common stock issued to Mr. Mandia upon the closing of the acquisition: one half of the total shares of revested stock shall vest on each anniversary of the closing of the acquisition, subject to Mr. Mandia’s continued status as a service provider to us on each such date. If Mr. Mandia’s status as a service provider to us is terminated prior to full vesting, then any unvested portion of the revested shares will be immediately forfeited to us without consideration. Notwithstanding the foregoing, if we terminate Mr. Mandia’s service without “cause” (as defined in our Change of Control Severance Policy for Officers) or breach the terms of his offer letter, the vesting of such revested shares automatically accelerates in full. The terms and conditions of the revested stock are also set forth in a consideration holdback agreement between Mr. Mandia and us.

 

The offer letter also contains certain covenants regarding activities that Mr. Mandia cannot engage in while providing services to us. In addition, Mr. Mandia entered into a key employee non-competition agreement, or non-competition agreement, with us, which provides that he will not, for a period of time equal to the later of (a) the period commencing on December 30, 2013 and ending on the second anniversary of such date, or (b) only if he does not work in California, the period commencing on December 30, 2013 and ending 18 months after the termination of his employment or consulting agreement with us or any of our affiliates, compete with us by engaging in any “competing business purpose” (as defined in the non-competition agreement) in the “restricted territory” (as defined in the non-competition agreement). The non-competition agreement also contains standard non-solicitation provisions, preventing Mr. Mandia from (i) soliciting any of our employees (including former Mandiant employees) or consultants to leave his or her employment and (ii) asking any of our employees (including former Mandiant employees) or consultants to engage in any activity which Mr. Mandia is prohibited from engaging in under the terms of the non-competition agreement.

 

Jeffrey C. Williams

 

Effective August 1, 2013, we entered into a confirmatory offer letter with Jeffrey C. Williams, our Senior Vice President, Sales. The offer letter is for no specific term and provides that Mr. Williams is an at-will employee. Mr. Williams’ current annual base salary is $225,000, and he is eligible for annual target incentive payments equal to $225,000 for 2014. Mr. Williams is also eligible for severance benefits under our Change of Control Severance Policy for Officers.

 

Alexa King

 

Effective August 1, 2013, we entered into a confirmatory offer letter with Alexa King, our Senior Vice President, General Counsel and Secretary. The offer letter is for no specific term and provides that Ms. King is an at-will employee. Ms. King’s current annual base salary is $250,000, and she is eligible for annual target

 

135

---

Table of Contents

incentive payments equal to $125,000 for 2014. Ms. King is also eligible for severance benefits under our Change of Control Severance Policy for Officers.

 

Michael J. Sheridan

 

Effective August 1, 2013, we entered into a confirmatory offer letter with Michael J. Sheridan, our Senior Vice President and Chief Financial Officer. The offer letter is for no specific term and provides that Mr. Sheridan is an at-will employee. Mr. Sheridan’s current annual base salary is $265,000, and he is eligible for annual target incentive payments equal to $198,800 for 2014. Mr. Sheridan is also eligible for severance benefits under our Change of Control Severance Policy for Officers.

 

Bahman Mahbod

 

Effective August 1, 2013, we entered into a confirmatory offer letter with Bahman Mahbod, our Senior Vice President, Engineering. The offer letter is for no specific term and provides that Mr. Mahbod is an at-will employee. Mr. Mahbod’s current annual base salary is $250,000, and he is eligible for annual target incentive payments equal to $125,000 for 2014. Mr. Mahbod is also eligible for severance benefits under our Change of Control Severance Policy for Officers.

 

Definitions for Offer Letter with Mr. Aziz

 

For purposes of the offer letter with Mr. Aziz, “cause” means generally:

 

•

the unauthorized use or disclosure of our confidential information or trade secrets, which use or disclosure causes material harm to us;

 

•

the material breach of any agreement between us and the named executive officer;

 

•

the material failure to comply with our written policies or rules;

 

•

the conviction of, or plea of “guilty” or “no contest” to, a felony under the laws of the United States or any State;

 

•

gross negligence or willful misconduct;

 

•

the continuing failure to perform assigned duties after receiving written notification of the failure from the board of directors; or

 

•

the failure to cooperate in good faith with a governmental or internal investigation of the company or our directors, officers or employees, if we have requested such cooperation;

 

provided, however, that “cause” will not be deemed to exist in the certain events above unless the named executive officer has been provided with (i) 30 days’ written notice by the board of directors of the act or omission constituting “cause” and (ii) 30 days’ opportunity to cure such act or omission, if capable of cure (as determined by the board of directors in its sole discretion).

 

For purposes of the offer letter with Mr. Aziz, “good reason” means generally any of the following without the named executive officer’s consent:

 

•

a material reduction of base salary as set forth in the agreement or as such base salary may be increased during the course of employment;

 

•

a material reduction of target bonus as set forth in the agreement or as such target bonus may be increased during the course of employment;

 

•

a material reduction in duties, authority, reporting relationship or responsibilities, including (i) in the event of a “change in control,” the assignment of responsibilities, duties, reporting relationship or position that are not at least the substantial functional equivalent of the position occupied immediately preceding such change in control, including the assignment of responsibilities, duties, reporting

 

136

---

Table of Contents

relationship or position that are not in a substantive area that is consistent with their experience and the position that they occupied prior to such change in control or (ii) a material diminution in the budget and number of subordinates;

 

•

a requirement to relocate to a location more than 35 miles from the then-current office location;

 

•

a material violation by us of a material term of any employment, severance or change of control agreement; or

 

•

a failure by any successor entity to assume the offer letter.

 

A resignation for “good reason” will not be deemed to have occurred unless the named executive officer gives us written notice of the condition within 90 days after the condition comes into existence and we fail to remedy the condition within 30 days after receiving the written notice.

 

For purposes of the offer letter with Mr. Aziz, “change in control” means (i) the consummation of a merger or consolidation of us with or into another entity or (ii) the dissolution, liquidation or winding up of our company. The foregoing notwithstanding, a merger or consolidation of our company does not constitute a “change in control” if immediately after the merger or consolidation a majority of the voting power of the capital stock of the continuing or surviving entity, or any direct or indirect parent corporation of the continuing or surviving entity, will be owned by the persons who were our company’s stockholders immediately prior to the merger or consolidation in substantially the same proportions as their ownership of the voting power of our company’s capital stock immediately prior to the merger or consolidation. The foregoing notwithstanding, a transaction will not constitute a “change in control” unless such transaction also constitutes a “change in control event” as defined in Treasury Regulation §1.409A-3(i)(5), without regard to any alternative percentages thereunder.

 

Change of Control Severance Policy for Officers

 

In July 2013, our compensation committee adopted and approved a Change of Control Severance Policy for Officers, or the Severance Policy. All of our executive officers and certain non-executive vice presidents (including senior vice presidents) (collectively referred to as “eligible employees”) are generally eligible for severance benefits under the Severance Policy, subject to the conditions described below. Each eligible employee may receive benefits upon a qualified termination of employment three months prior to, or 12 months following a change of control, or the change of control period. In addition, eligible employees may receive severance benefits for qualified terminations of employment unrelated to a change of control. The benefits in the Severance Policy vary based on whether an eligible employee is an executive officer, or Tier 1 Executive, or a non-executive officer, or Tier II Executive.

 

In the event of a termination of employment without “cause” (as generally defined below) outside of the change of control period, an eligible employee will receive the following:

 

•

Tier I Executive:

 

•

lump-sum 12 months base salary payment; and

 

•

paid COBRA continuation for 12 months.

 

•

Tier II Executive:

 

•

lump-sum 6 months base salary payment; and

 

•

paid COBRA continuation for 6 months.

 

In the event of a termination of employment without cause or a resignation for “good reason” (as generally defined below), in each case, during the change of control period, an eligible employee will receive the following:

 

•

Tier I Executive:

 

•

lump-sum 12 months base salary payment;

 

137

---

Table of Contents

•

pro-rata bonus for the year of termination;

 

•

100% acceleration of unvested equity awards with performance awards vesting at maximum level; and

 

•

paid COBRA continuation for 12 months.

 

•

Tier II Executive:

 

•

lump-sum 12 months base salary payment;

 

•

pro-rata bonus for the year of termination;

 

•

100% acceleration of unvested equity awards with performance awards vesting at maximum level; and

 

•

paid COBRA continuation for 12 months.

 

To be an eligible employee, the participant must enter into a participation agreement with us. Also, all severance benefits under the Severance Policy are subject to the eligible employee executing a release of clams. Mr. Aziz is not an eligible employee for purposes of the Severance Policy because he elected not to enter into a participation agreement with us.

 

Benefits under the Severance Policy replace any then-existing severance and/or change of control benefit that an eligible employee had previously.

 

For purposes of the Severance Policy, “cause” has the same general meaning as in the offer letter with Mr. Aziz.

 

For purposes of the Severance Policy, “good reason” means generally any of the following without an eligible employee’s consent:

 

•

a material reduction in duties, authority, reporting relationship, or responsibilities;

 

•

a material reduction in annual cash compensation;

 

•

a requirement to relocate to a location more than twenty miles from the eligible employee’s then-current office location;

 

•

a material breach by us of the eligible employee’s employment agreement or any other agreement between the eligible employee and us; or

 

•

a failure by any successor entity to assume the Severance Policy.

 

138

---

Table of Contents

Outstanding Equity Awards at Fiscal Year-End

 

The following table presents certain information concerning equity awards held by our executive officers, including each of our named executive officers, as of December 31, 2013.

 

		Grant Date				Option Awards																Stock Awards
Name						Number of Securities Underlying Unexercised Options (#) Exercisable				Number of Securities Underlying Unexercised Options (#) Unexercisable				Option Exercise Price ($)				Option Expiration Date				Number of Shares or Units of Stock that have not Vested (#)(1)				Market Value of Shares of Units of Stock that have not Vested ($)
David G. DeWalt			5/1/12	(2)			—				—				1.65				4/30/22				2,157,486				94,087,964
			5/1/12	(3)			—				—				—				—				280,473				12,231,428
			5/1/12	(4)			—				—				—				—				162,936				7,105,639
			6/15/12	(5)			41,000				—				1.65				6/14/22				—				—
			1/22/13	(6)			139,944				—				5.44				1/21/23				—				—
Ashar Aziz			5/27/11	(7)			—				—				0.57				5/26/21				209,482				9,135,510
			5/27/11	(8)			—				—				0.57				5/26/21				251,378				10,962,595
			3/30/12	(9)			—				—				1.65				3/29/22				677,066				29,526,848
Jeffrey C. Williams			4/1/08	(10)			25,000				—				0.14				3/31/18				—				—
			3/16/10	(11)			1,436,719				—				0.07				3/15/20				—				—
			2/10/11	(12)			25,000				—				0.57				2/9/21				—				—
			1/22/13	(13)			—				—				—				—				75,000				3,270,750
Alexa King			5/25/12	(14)			—				—				1.65				5/24/22				204,168				8,903,766
			1/22/13	(13)			—				—				—				—				75,000				3,270,750
Bahman Mahbod			2/10/11	(15)			291,000				—				0.57				2/9/21				—				—
			5/25/12	(16)			100,000				—				1.65				5/24/22				—				—
			1/22/13	(13)			—				—				—				—				75,000				3,270,750
Michael J. Sheridan			7/20/11	(17)			—				—				—				—				451,737				19,700,251
			8/23/11	(17)			—				—				—				—				5,950				259,480
			1/22/13	(13)			—				—				—				—				75,000				3,270,750
Kevin R. Mandia			7/26/12	(18)			—				—				—				—				151,710				6,616,073
			12/30/13	(19)			—				—				—				—				469,813				20,488,545

 

(1)

Unless otherwise described in the footnotes below, represents (i) restricted stock awards and (ii) shares of restricted stock issued upon the early exercise of stock options, in each case that remained unvested as of December 31, 2013. We have a right to repurchase any unvested shares subject to each such award if the holder of the award ceases to provide services to us prior to the date on which all shares subject to the award have vested in accordance with the applicable vesting schedule described in the footnotes below.

(2)

As modified by the amended and restated offer letter entered into with Mr. DeWalt in November 2012, the shares subject to the award vest in 31 equal monthly installments commencing on May 31, 2014, subject to Mr. DeWalt’s continuous service as our Chief Executive Officer on each such vesting date. For a description of Mr. DeWalt’s offer letter, see “Executive Compensation—Employment Agreements for Executive Officers.”

(3)

As modified by the amended and restated offer letter entered into with Mr. DeWalt in November 2012, the shares subject to the award vest in five equal monthly installments with the first such installment on December 31, 2013, subject to Mr. DeWalt’s continuous service as our Chief Executive Officer on each such vesting date. For a description of Mr. DeWalt’s offer letter, see “Executive Compensation—Employment Agreements for Executive Officers.”

 

139

---

Table of Contents

(4)

As modified by the amended and restated offer letter entered into with Mr. DeWalt in November 2012, the shares subject to the award vest in 48 equal monthly installments with the first such installment on May 1, 2012, subject to Mr. DeWalt’s continuous status as a member of our board of directors on each such vesting date. For a description of Mr. DeWalt’s offer letter, see “Executive Compensation—Employment Agreements for Executive Officers.”

(5)

As modified by the amended and restated offer letter entered into with Mr. DeWalt in November 2012, the shares subject to the option are early exercisable and vest in equal monthly installments over 48 months beginning on November 19, 2012, subject to Mr. DeWalt’s continuous status as our Chief Executive Officer as of each such vesting date. For a description of Mr. DeWalt’s offer letter, see “Executive Compensation—Employment Agreements for Executive Officers.”

(6)

The shares subject to the option are early exercisable and vest in equal monthly installments over 48 months beginning on November 19, 2012, subject to Mr. DeWalt’s continuous status as our Chief Executive Officer as of each such vesting date.

(7)

As modified by the offer letter entered into with Mr. Aziz in November 2012, as of December 31, 2013, 717,158 of the shares subject to the award had vested, and 209,482 of the shares subject to the award continue to vest in 18 equal monthly installments, subject to Mr. Aziz’s continuous status as a service provider on each such vesting date. For a description of Mr. Aziz’s offer letter, see “Executive Compensation—Employment Agreements for Executive Officers.”

(8)

As modified by the offer letter entered into with Mr. Aziz in November 2012, as of December 31, 2013, 304,606 of the shares subject to the award had vested, and 251,378 of the shares subject to the award continue to vest in 36 equal monthly installments, subject to Mr. Aziz’s continuous status as a service provider on each such vesting date. For a description of Mr. Aziz’s offer letter, see “Executive Compensation—Employment Agreements for Executive Officers.”

(9)

As modified by the offer letter entered into with Mr. Aziz in November 2012, as of December 31, 2013, 941,373 of the shares subject to the award had vested, and 677,066 of the shares subject to the award continue to vest in 30 equal monthly installments, subject to Mr. Aziz’s continuous status as a service provider on each such vesting date. For a description of Mr. Aziz’s offer letter, see “Executive Compensation—Employment Agreements for Executive Officers.”

(10)

The stock option is fully vested and immediately exercisable.

(11)

25% of the shares subject to the option vested on February 1, 2011, and the remaining shares subject to the option vest in 36 equal monthly installments thereafter, subject to Mr. Williams’ continuous status as a service provider on each such vesting date. All shares subject to the option are early exercisable.

(12)

The shares subject to the option are early exercisable and vest in 48 equal monthly installments with a vesting commencement date of February 10, 2011, subject to Mr. Williams’ continuous status as a service provider on each such vesting date.

(13)

Represents the maximum number of shares issuable upon the vesting of restricted stock units. Upon the achievement of certain performance conditions, 50% of the eligible restricted stock units will vest on the 15th day of the first month in which our trading window is open after the expiration of the period ending 180 days after the effectiveness of our initial public offering, and the remaining eligible restricted stock units will vest on the first anniversary of such date, in each case subject to the holder’s continuous status as a service provider on each such vesting date.

(14)

25% of the shares subject to the award vested on April 16, 2013, and the remaining shares subject to the award vest in 36 equal monthly installments thereafter, subject to Ms. King’s continuous status as a service provider on each such vesting date.

(15)

The shares subject to the option are early exercisable and vest in 48 equal monthly installments with a vesting commencement date of February 10, 2011, subject to Mr. Mahbod’s continuous status as a service provider on each such vesting date.

(16)

The shares subject to the option are early exercisable and vest in 48 equal monthly installments with a vesting commencement date of May 25, 2012, subject to Mr. Mahbod’s continuous status as a service provider on each such vesting date.

 

140

---

Table of Contents

(17)

25% of the shares subject to the award vested on June 8, 2012, and the remaining shares subject to the award vest in 36 equal monthly installments thereafter, subject to Mr. Sheridan’s continuous status as a service provider on each such vesting date.

(18)

Consists of shares of restricted stock issued under the Mandiant Corporation 2011 Equity Incentive Plan, which shares were assumed by us in connection with our acquisition of Mandiant. As of December 31, 2013, the shares subject to the award vest in 31 equal monthly installments, subject to Mr. Mandia’s continuous status as a service provider on each such vesting date.

(19)

Pursuant to the offer letter entered into with Mr. Mandia in December 2013, vesting requirements were imposed on a portion of the shares of our common stock that were issued to him as stock consideration as part of our acquisition of Mandiant. 50% of the shares will vest on each anniversary of December 30, 2013, subject to Mr. Mandia’s continuous status as a service provider on each such vesting date. For a description of Mr. Mandia’s offer letter, see “Executive Compensation—Employment Agreements for Executive Officers.”

 

Employee Benefit and Stock Plans

 

2013 Equity Incentive Plan

 

In August 2013, our board of directors adopted, and our stockholders approved, our 2013 Equity Incentive Plan, or the 2013 Plan. The 2013 Plan became effective on September 18, 2013 and provides for the grant of incentive stock options, within the meaning of Section 422 of the Code, to our employees and any parent and subsidiary corporations’ employees, and for the grant of nonstatutory stock options, restricted stock, restricted stock units, stock appreciation rights, performance units and performance shares to our employees, directors and consultants and our parent and subsidiary corporations’ employees and consultants.

 

Authorized Shares. As of December 31, 2013, a total of 13,098,445 shares of our common stock have been reserved for issuance pursuant to the 2013 Plan, of which options to purchase 793,900 shares of our common stock and 1,284,288 shares of common stock issuable pursuant to restricted stock units were issued and outstanding. In addition, the shares reserved for issuance under the 2013 Plan will also include any shares returned to the 2008 Plan as the result of expiration or termination of awards outstanding under such plan. The number of shares reserved for issuance under the 2013 Plan also includes an annual increase on the first day of each fiscal year equal to the least of:

 

•

12,100,000 shares;

 

•

5% of the outstanding shares of common stock as of the last day of our immediately preceding fiscal year; or

 

•

such other amount as our board of directors may determine.

 

On January 1, 2014, 6,887,875 shares of common stock were automatically added to the share reserve under the 2013 Plan pursuant to this automatic annual increase provision.

 

Plan Administration. Our board of directors or one or more committees appointed by our board of directors has the authority to administer the 2013 Plan. The compensation committee of our board of directors currently administers our 2013 Plan. In the case of awards intended to qualify as “performance-based compensation” within the meaning of Section 162(m) of the Code, the committee will consist of two or more “outside directors” within the meaning of Section 162(m) of the Code. In addition, if we determine it is desirable to qualify transactions under the 2013 Plan as exempt under Rule 16b-3 of the Securities Exchange Act of 1934, as amended, or Rule 16b-3, such transactions will be structured to satisfy the requirements for exemption under Rule 16b-3. Subject to the provisions of our 2013 Plan, the administrator will have the power to administer the plan, including but not limited to, the power to interpret the terms of the 2013 Plan and awards granted thereunder, to create, amend and revoke rules relating to the 2013 Plan, including creating sub-plans, and to determine the terms of the awards, including the exercise price, the number of shares subject to each such award,

 

141

---

Table of Contents

the exercisability of the awards, and the form of consideration, if any, payable upon exercise. The administrator will also have the authority to institute an exchange program by which outstanding awards may be surrendered in exchange for awards of the same type, which may have a higher or lower exercise price or different terms, awards of a different type and/or cash. Under such an exchange program, the administrator may amend existing awards to reduce or increase their exercise price, to allow participants the opportunity to transfer outstanding awards to a financial institution or other person or entity selected by the administrator.

 

Stock Options. Stock options may be granted under the 2013 Plan. The exercise price of options granted under our 2013 Plan must at least be equal to the fair market value of our common stock on the date of grant. The term of an incentive stock option may not exceed 10 years, except that with respect to any participant who owns more than 10% of the voting power of all classes of our outstanding stock, the term must not exceed five years and the exercise price must equal at least 110% of the fair market value on the grant date. The administrator will determine the methods of payment of the exercise price of an option, which may include cash, shares or other property acceptable to the administrator, as well as other types of consideration permitted by applicable law. After the termination of service of an employee, director or consultant, he or she may exercise his or her option for the period of time stated in his or her option agreement. Generally, if termination is due to death or disability, the option will remain exercisable for 12 months. In all other cases, the option will generally remain exercisable for three months following the termination of service. However, in no event may an option be exercised after the expiration of its term. Subject to the provisions of our 2013 Plan, the administrator determines the other terms of options.

 

Stock Appreciation Rights. Stock appreciation rights may be granted under our 2013 Plan. Stock appreciation rights allow the recipient to receive the appreciation in the fair market value of our common stock between the exercise date and the date of grant. Stock appreciation rights may not have a term exceeding 10 years. After the termination of service of an employee, director or consultant, he or she may exercise his or her stock appreciation right for the period of time stated in his or her stock appreciation right agreement. However, in no event may a stock appreciation right be exercised after the expiration of its term. Subject to the provisions of our 2013 Plan, the administrator determines the other terms of stock appreciation rights, including when such rights become exercisable and whether to pay any increased appreciation in cash or with shares of our common stock, or a combination thereof, except that the per share exercise price for the shares to be issued pursuant to the exercise of a stock appreciation right will be no less than 100% of the fair market value per share on the date of grant.

 

Restricted Stock. Restricted stock may be granted under our 2013 Plan. Restricted stock awards are grants of shares of our common stock that vest in accordance with terms and conditions established by the administrator. The administrator will determine the number of shares of restricted stock granted to any employee, director or consultant and, subject to the provisions of our 2013 Plan, will determine the terms and conditions of such awards. The administrator may impose whatever conditions to vesting it determines to be appropriate. For example, the administrator may set restrictions based on the achievement of specific performance goals or continued service to us; provided, however, that the administrator, in its sole discretion, may accelerate the time at which any restrictions will lapse or be removed. Recipients of restricted stock awards generally will have voting and dividend rights with respect to such shares upon grant without regard to vesting, unless the administrator provides otherwise. Shares of restricted stock that do not vest are subject to our right of repurchase or forfeiture.

 

Restricted Stock Units. Restricted stock units may be granted under our 2013 Plan. Restricted stock units are bookkeeping entries representing an amount equal to the fair market value of one share of our common stock. Subject to the provisions of our 2013 Plan, the administrator will determine the terms and conditions of restricted stock units, including the vesting criteria, which may include accomplishing specified performance criteria or continued service to us, and the form and timing of payment. Notwithstanding the foregoing, the administrator, in its sole discretion, may accelerate the time at which any restrictions will lapse or be removed.

 

142

---

Table of Contents

Performance Units and Performance Shares. Performance units and performance shares may be granted under our 2013 Plan. Performance units and performance shares are awards that will result in a payment to a participant only if performance goals established by the administrator are achieved or the awards otherwise vest. The administrator will establish organizational or individual performance goals or other vesting criteria in its discretion, which, depending on the extent to which they are met, will determine the number and the value of performance units and performance shares to be paid out to participants. After the grant of a performance unit or performance share, the administrator, in its sole discretion, may reduce or waive any performance criteria or other vesting provisions for such performance unit or performance share. Performance units shall have an initial value established by the administrator prior to the grant date. Performance shares shall have an initial value equal to the fair market value of our common stock on the grant date. The administrator, in its sole discretion, may pay earned performance units or performance shares in the form of cash, in shares or in some combination thereof.

 

Outside Directors. Our 2013 Plan provides that all non-employee directors are eligible to receive all types of awards, except for incentive stock options, under the 2013 Plan.

 

Non-Transferability of Awards. Unless the administrator provides otherwise, our 2013 Plan generally does not allow for the transfer of awards and only the recipient of an award may exercise an award during his or her lifetime.

 

Certain Adjustments. In the event of certain changes in our capitalization, to prevent diminution or enlargement of the benefits or potential benefits available under the 2013 Plan, the administrator will adjust the number and class of shares that may be delivered under the 2013 Plan and the number, class, and price of shares covered by each outstanding award, and the numerical share limits set forth in the 2013 Plan. In the event of our proposed liquidation or dissolution, the administrator will notify participants as soon as practicable, and all awards will terminate immediately prior to the consummation of such proposed transaction.

 

Merger or Change in Control. Our 2013 Plan provides that in the event of a “merger” or “change in control,” as defined under the 2013 Plan, each outstanding award will be treated as the administrator determines, except that if a successor corporation or its parent or subsidiary does not assume or substitute an equivalent award for any outstanding award, then such award will fully vest, all restrictions on such award will lapse, all performance goals or other vesting criteria applicable to such award will be deemed achieved at 100% of target levels, and such award will become fully exercisable, if applicable, for a specified period prior to the transaction. The award will then terminate upon the expiration of the specified period of time. If the service of an outside director is terminated on or following a change in control (including a resignation at the request of the acquiror), other than pursuant to a voluntary resignation, his or her options, restricted stock units and stock appreciation rights, if any, will vest fully and become immediately exercisable, all restrictions on his or her restricted stock will lapse, and all performance goals or other vesting requirements for his or her performance shares and units will be deemed achieved at 100% of target levels, and all other terms and conditions met.

 

Amendment, Termination. The administrator has the authority to amend, suspend or terminate the 2013 Plan, provided such action does not impair the existing rights of any participant. Our 2013 Plan will automatically terminate in 2023, unless we terminate it sooner.

 

2008 Stock Plan, as amended

 

Our board of directors and our stockholders adopted our 2008 Plan in February 2008. Our 2008 Plan was most recently amended in August 2013.

 

Authorized Shares. Our 2008 Plan was terminated in connection with our initial public offering, and accordingly, no shares are available for issuance under this plan. However, our 2008 Plan continues to govern outstanding awards granted thereunder prior to the completion of our initial public offering. Prior to termination, our 2008 Plan provided for the grant of incentive stock options, nonqualified stock options, restricted stock, and

 

143

---

Table of Contents

restricted stock units. As of December 31, 2013, options to purchase 21,351,406 shares of our common stock and 472,743 shares subject to restricted stock units remained outstanding under our 2008 Plan. Additionally, 485,300 shares of restricted common stock remained subject to forfeiture as of such date.

 

Plan Administration. Our board of directors, or a committee thereof appointed by our board of directors, has the authority to administer the 2008 Plan. Our compensation committee currently administers the 2008 Plan. Subject to the provisions of our 2008 Plan, the administrator has the full authority and discretion to take any actions it deems necessary or advisable for the administration of the 2008 Plan. The administrator also has the authority to amend existing awards to reduce or increase their exercise price, to allow participants the opportunity to transfer outstanding awards to a financial institution or other person or entity selected by the administrator, and to institute an exchange program by which outstanding awards may be surrendered in exchange for awards of the same type, which may have a higher or lower exercise price or different terms, awards of a different type and/or cash. All decisions, interpretations and other actions of the administrator will be final and binding on all participants.

 

Stock Options. Stock options are outstanding under our 2008 Plan. The exercise price per share of all options was equal at least 100% of the fair market value per share of our common stock on the date of grant. The term of an option does not exceed 10 years. An incentive stock option held by a participant who owns more than 10% of the total combined voting power of all classes of our stock, or any parent or subsidiary corporations, does not have a term in excess of five years and has an exercise price of at least 110% of the fair market value per share of our common stock on the date of grant. The administrator will determine the methods of payment of the exercise price of an option, which may include cash, shares, or certain other property, or other consideration acceptable to the administrator. After the termination of service of an employee, director, or consultant, the participant may generally exercise his or her options, to the extent vested as of such date of termination, for at least three months after termination. If termination is due to disability, the option will generally remain exercisable, to the extent vested as of such date of termination, for at least six months. If termination is due to death, the option will generally remain exercisable, to the extent vested as of such date of termination, for at least 12 months. However, in no event may an option be exercised after the expiration of its term.

 

Restricted Stock. Restricted stock is outstanding under our 2008 Plan. Restricted stock awards are grants of shares of our common stock that are subject to various restrictions, including restrictions on transferability and forfeiture provisions. Shares of restricted stock will vest, and the restrictions on such shares will lapse, in accordance with terms and conditions established by the administrator.

 

Restricted Stock Units. Restricted stock units are outstanding under our 2008 Plan. Restricted stock units are bookkeeping entries representing an amount equal to the fair market value of one share of our common stock. Subject to the provisions of our 2008 Plan, the administrator determines the terms and conditions of restricted stock units, including the vesting criteria (which may include accomplishing specified performance criteria or continued service to us) and the form and timing of payment. Notwithstanding the foregoing, the administrator, in its sole discretion, may accelerate the time at which any restrictions will lapse or be removed.

 

Transferability of Options. Our 2008 Plan generally does not allow for the transfer of options, and only the recipient of an option may exercise such an award during his or her lifetime.

 

Adjustments. In the event of certain changes in our capitalization, the number of shares reserved under our 2008 Plan, the exercise prices of, and the number of shares subject to, outstanding options, and the purchase price of, and the numbers of shares subject to, outstanding awards will be proportionately adjusted, subject to any required action by our board of directors.

 

Merger or Change in Control. Our 2008 Plan provides that, in the event of our dissolution or liquidation, a merger or the sale of all or substantially all of our assets, each outstanding award may be assumed or substituted for an equivalent award. In the event that awards are not assumed or substituted for, then the vesting of outstanding awards will be accelerated, and stock options will become exercisable in full prior to such corporate transaction. Stock options will then generally terminate immediately prior to the corporate transaction.

 

144

---

Table of Contents

Amendment; Termination. Our board of directors may amend our 2008 Plan at any time, provided that such amendment does not impair the rights under outstanding awards without the award holder’s written consent. Our 2008 Plan has been terminated and no further awards will be granted thereunder. All outstanding awards will continue to be governed by their existing terms.

 

2004 Stock Option Plan, as amended

 

Our board of directors and our stockholders adopted our 2004 Stock Option Plan, or our 2004 Plan, in August 2004. Our 2004 Plan was most recently amended in February 2008. Our 2004 Plan was terminated in 2008, and accordingly, no shares are available for issuance pursuant to future grants under this plan. However, our 2004 Plan continues to govern outstanding awards granted thereunder prior to the completion of our initial public offering. Prior to its termination, our 2004 Plan provided for the grant of incentive stock options and nonqualified stock options. As of December 31, 2013, options to purchase 3,934 shares of our common stock remained outstanding under our 2004 Plan.

 

2013 Employee Stock Purchase Plan

 

In August 2013, our board of directors adopted, and our stockholders approved, our 2013 Employee Stock Purchase Plan, or the ESPP. The ESPP became effective upon adoption.

 

Authorized Shares. As of December 31, 2013, a total of 2,500,000 shares of our common stock were available for sale under the ESPP. In addition, our ESPP provides for annual increases in the number of shares available for issuance under the ESPP on the first day of each fiscal year, equal to the least of:

 

•

1% of the outstanding shares of our common stock on the first day of such fiscal year;

 

•

3,700,000 shares; or

 

•

such other amount as may be determined by our board of directors.

 

On January 1, 2014, 1,377,575 shares of common stock were automatically added to the share reserve under the ESPP pursuant to this automatic annual increase provision.

 

Plan Administration. Our board of directors, or a committee appointed by our board of directors, administers the ESPP. Our compensation committee currently administers the ESPP. The administrator has authority to administer the plan, including but not limited to, full and exclusive authority to interpret the terms of the ESPP, determine eligibility to participate subject to the conditions of our ESPP as described below, and to establish procedures for plan administration necessary for the administration of the ESPP, including creating sub-plans.

 

Eligibility. Generally, all of our employees are eligible to participate if they are employed by us, or any participating subsidiary, for at least 20 hours per week and more than five months in any calendar year. However, an employee may not be granted an option to purchase stock under the ESPP if such employee:

 

•

immediately after the grant would own stock constituting 5% or more of the total combined voting power or value of all classes of our capital stock; or

 

•

hold rights to purchase stock under all of our employee stock purchase plans that accrue at a rate that exceeds $25,000 worth of stock for each calendar year in which the option is outstanding.

 

Offering Periods. Our ESPP is intended to qualify under Section 423 of the Code, and provides for 12 month offering periods, each of which has two six month purchase periods. The offering periods generally start on the first trading day on or after May 15 and November 15 of each year. The administrator may, in its discretion, modify the terms of future offering periods.

 

Payroll Deductions. Our ESPP permits participants to purchase common stock through payroll deductions of up to 15% of their eligible compensation, which includes a participant’s regular and recurring straight time

 

145

---

Table of Contents

gross earnings, payments for overtime and shift premium, but exclusive of payments for commissions, incentive compensation, bonuses and other similar compensation. A participant may purchase a maximum of 3,000 shares during a purchase period.

 

Exercise of Option. Amounts deducted and accumulated by the participant are used to purchase shares of our common stock at the end of each six-month purchase period. The purchase price of each share will be 85% of the lower of the fair market value per share of our common stock on the first trading day of each offering period or on the exercise date. Participants may end their participation at any time during an offering period, and will be paid their accrued payroll deductions that have not yet been used to purchase shares of common stock. Participation ends automatically upon termination of employment with us.

 

Non-Transferability. A participant may not transfer rights granted under the ESPP other than by will, the laws of descent and distribution, or as otherwise provided under the ESPP.

 

Merger or Change in Control. In the event of our merger or change in control, as will be defined under the ESPP, a successor corporation may assume or substitute for each outstanding option. If the successor corporation refuses to assume or substitute for each outstanding option, the offering period then in progress will be shortened, and a new exercise date will be set. The administrator will notify each participant that the exercise date has been changed and that the participant’s option will be exercised automatically on the new exercise date unless prior to such date the participant has withdrawn from the offering period.

 

Amendment, Termination. Our ESPP will automatically terminate in 2033, unless we terminate it sooner. The administrator has the authority to amend, suspend or terminate our ESPP, except that, subject to certain exceptions described in the ESPP, no such action may adversely affect any outstanding rights to purchase stock under our ESPP.

 

Mandiant Corporation 2011 Equity Incentive Plan

 

The Mandiant Corporation 2011 Equity Incentive Plan, or the 2011 Plan, provided for the grant of incentive stock options, nonqualified stock options, stock appreciation rights, restricted stock, and restricted stock units. At the closing of our acquisition of Mandiant, we assumed all outstanding awards under the 2011 Plan (which consisted of options and restricted stock) held by continuing service providers, and the number of shares subject to each outstanding award and the exercise or purchase price (if any) of each outstanding award were proportionately adjusted to reflect the awards’ conversion into awards for shares of our common stock.

 

Authorized Shares. The 2011 Plan has been terminated in connection with our acquisition of Mandiant, and accordingly, no shares are available for issuance under this plan. However, the 2011 Plan continues to govern outstanding awards granted thereunder prior to our acquisition of Mandiant. As of December 31, 2013, options to purchase 3,349,910 shares of our common stock remained outstanding under the 2011 Plan. Additionally, 327,885 shares of restricted common stock remained subject to forfeiture as of such date.

 

Plan Administration. Our board of directors or one or more committees appointed by our board of directors has the authority to administer the 2011 Plan. The compensation committee of our board of directors currently administers our 2011 Plan. Subject to the provisions of the 2011 Plan, the administrator has full power to implement and carry out the 2011 Plan. The administrator also has the authority to construe and interpret the plan and awards; establish, amend and revoke rules and regulations for the plan’s administration; correct any defect, omission or inconsistency in the plan or in any award agreement; to settle all controversies regarding the plan and awards granted under it; accelerate the time at which an award may first be exercised or will vest; amend the plan in any respect the administrator deems necessary or advisable; terminate or suspend the plan; exercise such powers and perform such acts as it deemed necessary or expedient to promote our best interests and that are not in conflict with the provisions of the plan; and effect, at any time and from time to time, with the consent of any adversely affected participant, (a) the reduction of the exercise price (or strike price) of any outstanding option or stock appreciation right under the plan, (b) the cancellation of any outstanding option or stock appreciation right

 

146

---

Table of Contents

under the plan and the grant in substitution therefore of (1) a new option or stock appreciation right under the plan or another equity plan covering the same or a different number of shares of common stock, (2) a restricted stock award, (3) a restricted stock unit award, (4) cash and/or (5) other valuable consideration (as determined by the administrator, in its sole discretion), or (c) any other action that is treated as a repricing under generally accepted accounting principles.

 

Stock Options. Stock options were granted under the 2011 Plan. The exercise price per share of all options was equal to at least 100% of the fair market value per share of Mandiant’s common stock on the date of grant. The term of an option does not exceed 10 years. An incentive stock option held by a participant who owned more than 10% of the total combined voting power of all classes of Mandiant’s stock, or any parent or subsidiary corporations of Mandiant, does not have a term in excess of five years and has an exercise price of at least 110% of the fair market value per share of Mandiant’s common stock on the date of grant. The administrator determines the methods of payment of the exercise price of an option. After the termination of a participant’s service with us, the participant may generally exercise his or her options, to the extent vested as of such date of termination, for at least 30 days after termination.

 

Transferability of Options. The 2011 Plan generally does not allow for the transfer of options other than by will or by the laws of descent or distribution, and only the recipient of an option may exercise such an award during his or her lifetime.

 

Restricted Stock. Restricted stock was granted under the 2011 Plan. Restricted stock awards are grants of shares of common stock that are subject to various restrictions, including restrictions on transferability and forfeiture provisions. Shares of restricted stock vest, and the restrictions on such shares lapse, in accordance with terms and conditions established by the administrator.

 

Adjustments. In the event of certain changes in our capitalization, the exercise prices of outstanding options and the number of shares subject to outstanding awards will be proportionately adjusted, subject to any required action by our board of directors.

 

Corporate Transaction. The 2011 Plan provides that, in the event of a corporate transaction (as defined in the 2011 Plan), the administrator may take one or more of the following actions with respect to an award: (i) arrange for the surviving or acquiring corporation (or its parent) to assume, continue, or substitute for the award; (ii) arrange for the assignment of any reacquisition or repurchase rights held by us to the surviving or acquiring corporation (or its parent); (iii) accelerate, in whole or in part, the vesting and exercisability of the award, with the award terminating if not exercised at or prior to the effective time of the corporate transaction; (iv) arrange for the lapse of any reacquisition or repurchase rights held by us; (v) cancel all or any portion of the award, to the extent not vested or not exercised prior to the effective time of the corporate transaction, in exchange for cash; and (vi) make a payment equal to the excess (if any) of (x) the value of the property the holder of the award would have received upon the exercise of the award over (y) the award’s exercise price.

 

Amendment; Termination. Our board of directors may amend the 2011 Plan at any time, provided that such amendment does not impair the rights under outstanding awards without the award holder’s written consent. As noted above, the 2011 Plan has been terminated and no further awards will be granted thereunder. All outstanding awards will continue to be governed by their existing terms.

 

Mandiant Corporation 2006 Equity Incentive Plan

 

The Mandiant Corporation 2006 Plan, or the 2006 Plan, provided for the grant of incentive stock options, nonqualified stock options, stock bonuses, and restricted stock. At the closing of our acquisition of Mandiant, we assumed all outstanding awards under the 2006 Plan (which consisted entirely of options) held by continuing service providers, and the exercise price of each outstanding option and the number of shares subject to each outstanding option were proportionately adjusted to reflect the options’ conversion into options to purchase shares of our common stock.

 

147

---

Table of Contents

Authorized Shares. The 2006 Plan was terminated in connection with Mandiant’s adoption of the 2011 Plan, and no shares are available for issuance under the 2006 Plan. However, the 2006 Plan continues to govern outstanding awards granted thereunder prior to our acquisition of Mandiant. As of December 31, 2013, options to purchase 702,224 shares of our common stock remained outstanding under the 2006 Plan.

 

Plan Administration. Our board of directors, or a committee thereof appointed by our board of directors, currently has the authority to administer the 2006 Plan. The compensation committee currently administers the 2006 Plan. Subject to the provisions of the 2006 Plan, the administrator has full power to implement and carry out the 2006 Plan. The administrator also has the authority to construe and interpret the plan and awards; establish, amend and revoke rules and regulations for the plan’s administration; correct any defect, omission or inconsistency in the plan or in any option agreement; amend the plan or an award; terminate or suspend the plan; and exercise such powers and perform such acts as it deems necessary or expedient to promote the best interests of the Company and that are not in conflict with the provisions of the plan.

 

Stock Options. Stock options were granted under the 2006 Plan. The exercise price per share of all options was equal to at least 100% of the fair market value per share of Mandiant’s common stock on the date of grant. The term of an option does not exceed 10 years. An incentive stock option held by a participant who owned more than 10% of the total combined voting power of all classes of Mandiant’s stock, or any parent or subsidiary corporations of Mandiant, does not have a term in excess of five years and has an exercise price of at least 110% of the fair market value per share of Mandiant’s common stock on the date of grant. The administrator determines the methods of payment of the exercise price of an option. After the termination of a participant’s service with us, the participant may generally exercise his or her options, to the extent vested as of such date of termination, for at least 30 days after termination.

 

Transferability of Options. The 2006 Plan generally does not allow for the transfer of options other than by will or by the laws of descent or distribution, and only the recipient of an option may exercise such an award during his or her lifetime.

 

Adjustments. In the event of certain changes in our capitalization, the exercise prices of, and the number of shares subject to, outstanding options will be proportionately adjusted, subject to any required action by our board of directors.

 

Corporate Transaction. The 2006 Plan provides that, in the event of a corporate transaction (as defined in the 2006 Plan), each outstanding award may be assumed or substituted for an equivalent award. In the event that awards are not assumed or substituted for, then the vesting of outstanding awards will be accelerated, and stock options will become exercisable in full prior to such corporate transaction. Stock options will then generally terminate immediately prior to the corporate transaction.

 

Amendment; Termination. Our board of directors may amend the 2006 Plan at any time, provided that such amendment does not impair the rights under outstanding awards without the award holder’s written consent. As noted above, the 2006 Plan has been terminated, and no further awards will be granted thereunder. All outstanding awards will continue to be governed by their existing terms.

 

Umbrella Plan for Assumed Options

 

In connection with the acquisition of Mandiant, we assumed certain stand-alone options to purchase shares of Mandiant common stock that were not subject to the Mandiant 2006 Equity Incentive Plan or the Mandiant 2011 Equity Incentive Plan. After the completion of the acquisition, we adopted the Umbrella Plan for Assumed Options to faciliate the administration of these options. The Umbrella Plan for Assumed Options memorializes that terms on which the options were assumed, including the exercise price of each option and the number of shares subject to each option, both of which were proportionately adjusted to reflect the options’ conversion into options to purchase shares of our common stock.

 

148

---

Table of Contents

Authorized Shares. As of December 31, 2013, options to purchase 455,713 shares of our common stock remained outstanding under the Umbrella Plan for Assumed Options.

 

Plan Administration. Consistent with its charter, our compensation committee administers the Umbrella Plan for Assumed Options.

 

Transferability of Options. Options outstanding under the Umbrella Plan for Assumed Options may not be transferred other than by will or by the laws of descent or distribution, and only the recipient of an option under such plan may exercise the option during his or her lifetime.

 

Adjustments. In the event of certain changes in our capitalization, the exercise prices of and the number of shares subject to each outstanding option under the Umbrella Plan for Assumed Options will be proportionately adjusted, subject to any required action by our board of directors.

 

Merger. If there is a merger or consolidation with another company where we are not the surviving corporation, then the holder of an option under the Umbrella Plan for Assumed Options will receive upon exercise of the option under such plan the amount of transaction consideration to which the holder would have been entitled had the option under such plan had such option been exercised immediately prior to the transaction. In any such case, appropriate adjustment will be made to the option with respect to the rights and interests of the holder after the transaction.

 

Employee Incentive Plan

 

Our compensation committee has adopted an Employee Incentive Plan, or the Bonus Plan. The Bonus Plan allows our compensation committee to provide cash incentive awards to selected employees, including our named executive officers, based upon performance goals established by our compensation committee.

 

Under the Bonus Plan, our compensation committee determines the performance goals applicable to any award. Performance goals that include our financial results may be determined in accordance with GAAP, or such financial results may consist of non-GAAP financial measures, and any actual results may be adjusted by the compensation committee for one-time items or unbudgeted or unexpected items when determining whether the performance goals have been met. The goals may be on the basis of any factors the compensation committee determines relevant, and may be adjusted on an individual, divisional, business unit or company-wide basis. The performance goals may differ from participant to participant and from award to award.

 

Our compensation committee may, in its sole discretion and at any time, increase, reduce or eliminate a participant’s actual award, and/or increase, reduce or eliminate the amount allocated to the bonus pool for a particular performance period. The actual award may be below, at or above a participant’s target award, in the compensation committee’s discretion. Our compensation committee may determine the amount of any reduction on the basis of such factors as it deems relevant, and it is not required to establish any allocation or weighting with respect to the factors it considers.

 

Actual awards are paid in cash only after they are earned, which usually requires continued employment through the date a bonus is paid.

 

Our compensation committee has the authority to amend, alter, suspend or terminate the Bonus Plan, provided that such action does not impair the existing rights of any participant with respect to any earned bonus.

 

401(k) Plan

 

We maintain a tax-qualified retirement plan that provides our eligible employees other than Mandiant employees with an opportunity to save for retirement on a tax-advantaged basis. In addition, we maintain an tax-qualified plan for employees of the Mandiant subsidiary that was assumed in the Mandiant acquisition. All

 

149

---

Table of Contents

participants’ interests in their deferrals are 100% vested when contributed under both 401(k) plans. In 2013, we made no matching contributions into our 401(k) plan. The Mandiant 401(k) plan provides for a match of 100% of the first 4% of an eligible employee’s compensation contributed. Matching contributions under the Mandiant 401(k) plan are 100% vested when made. Under both 401(k) plans, pre-tax contributions are allocated to each participant’s individual account and are then invested in selected investment alternatives according to the participants’ directions. Each 401(k) plan is intended to qualify under Sections 401(a) and 501(a) of the Code. As a tax-qualified retirement plan, contributions to each 401(k) plan and earnings on those contributions are not taxable to the employees until distributed from the 401(k) plan, and all contributions are deductible by us when made.

 

Limitation on Liability and Indemnification Matters

 

Our amended and restated certificate of incorporation and amended and restated bylaws provide that we will indemnify our directors and officers, and may indemnify our employees and other agents, to the fullest extent permitted by the Delaware General Corporation Law, which prohibits our amended and restated certificate of incorporation from limiting the liability of our directors for the following:

 

•

any breach of the director’s duty of loyalty to us or our stockholders;

 

•

acts or omissions not in good faith or that involve intentional misconduct or a knowing violation of law;

 

•

unlawful payment of dividends or unlawful stock repurchases or redemptions; and

 

•

any transaction from which the director derived an improper personal benefit.

 

If Delaware law is amended to authorize corporate action further eliminating or limiting the personal liability of a director, then the liability of our directors will be eliminated or limited to the fullest extent permitted by Delaware law, as so amended. Our amended and restated certificate of incorporation does not eliminate a director’s duty of care and in appropriate circumstances, equitable remedies, such as injunctive or other forms of non-monetary relief, remain available under Delaware law. This provision also does not affect a director’s responsibilities under any other laws, such as the U.S. federal securities laws or other state or U.S. federal laws. Under our amended and restated bylaws, we are also empowered to purchase insurance on behalf of any person whom we are required or permitted to indemnify.

 

In addition to the indemnification required in our amended and restated certificate of incorporation and amended and restated bylaws, we have entered into indemnification agreements with certain of our current directors and officers. These agreements provide indemnification for certain expenses and liabilities incurred in connection with any action, suit, proceeding, or alternative dispute resolution mechanism, or hearing, inquiry, or investigation that may lead to the foregoing, to which they are a party, or are threatened to be made a party, by reason of the fact that they are or were a director, officer, employee, agent, or fiduciary of our company, or any of our subsidiaries, by reason of any action or inaction by them while serving as an officer, director, agent, or fiduciary, or by reason of the fact that they were serving at our request as a director, officer, employee, agent, or fiduciary of another entity. In the case of an action or proceeding by, or in the right of, our company or any of our subsidiaries, no indemnification will be provided for any claim where a court determines that the indemnified party is prohibited from receiving indemnification. We believe that these bylaw provisions and indemnification agreements are necessary to attract and retain qualified persons as directors and officers. We also maintain directors’ and officers’ liability insurance.

 

The limitation of liability and indemnification provisions in our amended and restated certificate of incorporation and amended and restated bylaws may discourage stockholders from bringing a lawsuit against directors for breach of their fiduciary duties. They may also reduce the likelihood of derivative litigation against directors and officers, even though an action, if successful, might benefit us and our stockholders. A stockholder’s investment may be harmed to the extent we pay the costs of settlement and damage awards against

 

150

---

Table of Contents

directors and officers pursuant to these indemnification provisions. Insofar as we may provide indemnification for liabilities arising under the Securities Act to our directors, officers, and controlling persons pursuant to the foregoing provisions, or otherwise, we have been advised that, in the opinion of the SEC, such indemnification is against public policy as expressed in the Securities Act, and is, therefore, unenforceable. There is no pending litigation or proceeding naming any of our directors or officers as to which indemnification is being sought, nor are we aware of any pending or threatened litigation that may result in claims for indemnification by any director or officer.

 

151

---

Table of Contents

CERTAIN RELATIONSHIPS AND RELATED PARTY TRANSACTIONS

 

We describe below transactions, and series of related transactions, since January 1, 2011, to which we were or will be a party, in which:

 

•

the amounts involved exceeded or will exceed $120,000; and

 

•

any of our directors, executive officers, or beneficial holders of more than 5% of any class of our capital stock, or their immediate family members, had or will have a direct or indirect material interest.

 

Other than as described below, there has not been, nor is there any currently proposed, transactions or series of related transactions to which we have been or will be a party other than compensation arrangements, which are described where required under the headings “Management—Director Compensation Table” and “Executive Compensation.”

 

Equity Financings

 

Series F Convertible Preferred Stock Transaction

 

In December 2012 and January 2013, we sold an aggregate of 4,748,591 shares of our Series F convertible preferred stock at a purchase price per share of approximately $10.53, for an aggregate purchase price of approximately $50 million. The following table summarizes purchases of our Series F convertible preferred stock by persons who, at the time of purchase, held more than 5% of our outstanding capital stock and entities affiliated with our directors:

 

Name of Stockholder		Shares of Series F Convertible Preferred Stock				Total Purchase Price
DAG Ventures Entities(1)			446,378			$	4,700,093
Sequoia Capital Entities(2)			919,590				9,682,731
Norwest Venture Partners Entities(3)			886,417				9,333,439
JAFCO Technology Partners Entities(4)			314,357				3,309,991
SVB Entities(5)			273,192				2,876,548
Alameda Alpha, LLC(6)			18,994				199,995

 

(1)

Affiliates of DAG Ventures holding our securities whose shares are aggregated for purposes of reporting share ownership information include DAG Ventures III-QP, L.P., DAG Ventures III, L.P., DAG Ventures GP Fund III, LLC and DAG Ventures III-A, LLC.

(2)

Affiliates of Sequoia Capital holding our securities whose shares are aggregated for purposes of reporting share ownership information include Sequoia Capital XI, Sequoia Capital XI Principals Fund and Sequoia Technology Partners XI. William M. Coughran Jr., a member of our board of directors, is affiliated with the Sequoia Capital Entities.

(3)

Affiliates of Norwest Venture Partners holding our securities whose shares are aggregated for purposes of reporting share ownership information include Norwest Venture Partners IX, LP and Norwest Venture Partners VIII, LP. Promod Haque, a member of our board of directors, is affiliated with the Norwest Venture Partner Entities.

(4)

Affiliates of JAFCO Technology Partners holding our securities whose shares are aggregated for purposes of reporting share ownership information include JAFCO Technology Partners, L.P. and JAFCO Technology Partners II, L.P.

(5)

Affiliates of SVB holding our securities whose shares are aggregated for purposes of reporting share ownership information include Silicon Valley BancVentures, L.P., SVB Capital Partners II, L.P. and SVB Financial Group.

(6)

Gaurav Garg, a member of our board of directors, is affiliated with Alameda Alpha, LLC.

 

152

---

Table of Contents

Acquisition of Mandiant Corporation

 

On December 30, 2013, pursuant to the terms of an Agreement and Plan of Reorganization, or merger agreement, we acquired Mandiant in a two-step merger for aggregate consideration of approximately $989.4 million, consisting of approximately $106.5 million in net cash and an aggregate of 21.5 million shares and options to purchase shares of our common stock.

 

Mr. DeWalt, our Chief Executive Officer and Chairman of our board of directors, served as the Chairman of the board of directors of Mandiant from April 2011 to October 2013, and served as an advisor to Mandiant from October 2013 until the closing of the merger in December 2013. In addition, as of immediately prior to the completion of the merger, Mr. DeWalt held 740,166 shares of Mandiant common stock, of which 328,960 shares were unvested shares subject to forfeiture in the event of his termination as a service provide to Mandiant. Pursuant to the terms of the equity agreements governing Mr. DeWalt’s shares of Mandiant common stock, all of Mr. DeWalt’s unvested Mandiant shares immediately vested in connection with the merger. Upon the closing of the merger, after giving effect to the vesting acceleration described in the preceding sentence, Mr. DeWalt received aggregate merger consideration of approximately $28.6 million, consisting of approximately $3.9 million in cash and 601,439 shares of our common stock, of which 87,335 shares were deposited into a third-party escrow account as partial security for the indemnity obligations of Mandiant and its former stockholders.

 

Due to the foregoing interests of Mr. DeWalt in the merger, Mr. DeWalt recused himself from the deliberations of our board of directors with respect to the approval of the merger agreement, the merger and the transactions contemplated thereby. In addition, in connection with the merger, our board of directors established an independent committee of the board comprised solely of our independent directors. The independent committee actively supervised the negotiation of the merger agreement, the merger and the transactions contemplated thereby. After a thorough review and due consideration of the proposed transaction, including Mr. DeWalt’s interest therein, the independent committee unanimously recommended that our full board of directors approve the merger agreement, the merger and the transactions contemplated thereby, including, but not limited to, the consideration payable to Mr. DeWalt in his capacity as a stockholder of Mandiant, as described above. In addition, the audit committee of our board of directors reviewed and approved the consideration payable to Mr. DeWalt in connection with the merger in accordance with our related party transaction policy described below under “—Policies and Procedures for Related Party Transactions.”

 

Investors’ Rights Agreement

 

In connection with the acquisition of Mandiant, on December 30, 2013, we amended and restated our investors’ rights agreement, dated as of December 27, 2012, among us and certain of our stockholders who are signatories thereto. The amended and restated investors’ rights agreement is referred to below as the “rights agreement.” Under the terms of the rights agreement, former holders of our convertible preferred stock and certain stockholders who received shares of our common stock in connection with the Mandiant acquisition have certain registration rights, including the right to demand that we file a registration statement or request that their shares of common stock be covered by a registration statement that we are otherwise filing. The related persons that have registration rights pursuant to the rights agreement are David DeWalt, Kevin Mandia, affiliates of DAG Ventures, affiliates of Sequoia Capital, affliates of Norwest Venture Partners, affiliates of SVB, and entities affiliated with Gaurav Garg, a member of our board of directors. For a more detailed description of these registration rights, see “Description of Capital Stock—Registration Rights.”

 

Voting Agreement

 

Prior to the completion of our initial public offering, our amended and restated voting agreement, as amended, or the voting agreement, among us and certain purchasers of our preferred stock, including our principal stockholders with whom certain of our directors are affiliated, required the stockholders who were

 

153

---

Table of Contents

parties thereto to vote their shares on certain matters pursuant to the terms of the voting agreement, including with respect to the election of directors. Pursuant to the voting agreement, each of Sequoia Capital and Norwest Venture Partners was granted the right to designate one member of our board of directors, as long as at least one million shares of our preferred stock remained outstanding. William M. Coughran Jr. and Promod Haque were designated by Sequoia Capital and Norwest Venture Partners, respectively, under the voting agreement. Upon the completion of our initial public offering, the voting agreement terminated, and there are no further contractual obligations regarding the election of our directors. Our current directors will continue to serve as directors until their resignations or removal or until their successors are duly elected by the holders of our common stock.

 

Loans to Executive Officers

 

Ashar Aziz

 

On January 29, 2010, June 30, 2010, May 30, 2012 and June 18, 2012, in connection with the exercise of options held by Ashar Aziz, our Chief Technology Officer, Chief Strategy Officer and Vice Chairman of the Board, we loaned Mr. Aziz approximately $151,956, $59,935, $2,670,424 and $799,301, respectively, for the purchase of 2,170,794, 856,218, 1,618,439 and 484,425 shares of our common stock, respectively, pursuant to full-recourse promissory notes and stock pledge agreements. As amended by the offer letter with Mr. Aziz, the interest on these promissory notes was reset to be equal to the minimum interest rate required to avoid the imputation of interest under the Code. As of December 31, 2012, the outstanding principal amount of these loans was $3,681,616, which was the largest aggregate amount of principal outstanding during the last three years. The balance of $3,733,868, including principal of $3,681,616 and total accrued interest of $52,251, was repaid in full by Mr. Aziz in March 2013.

 

David G. DeWalt

 

On May 25, 2012, in connection with the exercise of options held by David G. DeWalt, our Chief Executive Officer, we loaned Mr. DeWalt $3,559,852 for the purchase of 2,157,486 shares of our common stock, pursuant to a full-recourse promissory note and stock pledge agreement. This loan bore interest at the rate per annum of 1.30%, compounded annually. As of December 31, 2012, the outstanding principal amount of this loan was $3,559,852, which was the largest aggregate amount of principal outstanding during the last three years. The balance of $3,602,960, including principal of $3,559,852 and total accrued interest of $43,108, was repaid in full by Mr. DeWalt in April 2013.

 

Indemnification Agreements

 

We have also entered into indemnification agreements with our directors and certain of our executive officers. The indemnification agreements and our amended and restated certificate of incorporation and amended and restated bylaws require us to indemnify our directors and officers to the fullest extent permitted by Delaware law. See “Executive Compensation—Limitation on Liability and Indemnification Matters.”

 

Policies and Procedures for Related Party Transactions

 

Our audit committee has adopted a formal written policy providing that our audit committee is responsible for reviewing “related party transactions,” which are transactions (i) in which we were, are or will be a participant, (ii) in which the aggregate amount involved exceeds or may be expected to exceed $50,000, and (iii) in which a related person had, has or will have a direct or indirect material interest. For purposes of this policy, a related person is defined as a director, nominee for director, executive officer, or greater than 5% beneficial owner of our common stock and their immediate family members. Under this policy, all related party transactions may be consummated or continued only if approved or ratified by our audit committee. In determining whether to approve or ratify any such proposal, our audit committee will take into account, among other factors it deems appropriate, (i) whether the transaction is on terms no less favorable than terms generally

 

154

---

Table of Contents

available to an unaffiliated third party under the same or similar circumstances and (ii) the extent of the related party’s interest in the transaction. The policy grants standing pre-approval of certain transactions, including (i) certain compensation arrangements of executive officers, (ii) certain director compensation arrangements, (iii) transactions with another company at which a related party’s only relationship is as a non-executive employee, director or beneficial owner of less than 10% of that company’s shares and the aggregate amount involved does not exceed the greater of $500,000 or 2% of the company’s total annual revenue, (iv) transactions where a related party’s interest arises solely from the ownership of our common stock and all holders of our common stock received the same benefit on a pro rata basis, and (v) transactions available to all U.S. employees generally.

 

155

---

Table of Contents

PRINCIPAL AND SELLING STOCKHOLDERS

 

The following table sets forth certain information with respect to the beneficial ownership of our common stock as of January 31, 2014, as adjusted to reflect the sale of common stock in this offering, for:

 

•

each of our directors;

 

•

each of our executive officers, including our named executive officers;

 

•

all of our current directors and executive officers as a group;

 

•

each person, or group of affiliated persons, known to us to beneficially own more than 5% of our common stock; and

 

•

all selling stockholders.

 

We have determined beneficial ownership in accordance with the rules of the SEC, and the information is not necessarily indicative of beneficial ownership for any other purpose. Except as indicated by the footnotes below, we believe, based on information furnished to us, that the persons and entities named in the table below have sole voting and sole investment power with respect to all shares of common stock that they beneficially owned, subject to applicable community property laws.

 

Applicable percentage ownership prior to this offering is based on 138,626,261 shares of common stock outstanding as of January 31, 2014. For purposes of the table below, we have assumed that 144,208,476 shares of common stock will be outstanding upon completion of this offering. In computing the number of shares of common stock beneficially owned by a person and the percentage ownership of such person, we deemed to be outstanding all shares of common stock subject to options held by such person that are currently exercisable or exercisable within 60 days of January 31, 2014 and all shares of common stock issuable pursuant to restricted stock units held by such person that are subject to vesting conditions expected to occur within 60 days of January 31, 2014. However, we did not deem such shares outstanding for the purpose of computing the percentage ownership of any other person.

 

Unless otherwise indicated, the address of each beneficial owner listed in the table below is c/o FireEye, Inc., 1440 McCarthy Blvd., Milpitas, CA 95035.

 

Name of Beneficial Owner+		Beneficial Ownership Prior to this Offering								Shares Being Offered				Beneficial Ownership After this Offering
		Number				Percent								Number				Percent
5% Stockholders:
Sequoia Capital Entities(1)			21,622,411				15.6	%			—				21,622,411				15.0	%
Norwest Venture Partners Entities(2)			20,843,865				15.0	%			2,008,213				18,835,652				13.1	%
Ashar Aziz(3)			10,835,000				7.8	%			1,043,904				9,791,096				6.8	%
DAG Ventures Entities(4)			10,488,156				7.6	%			1,010,485				9,477,671				6.6	%
JAFCO Technology Partners Entities(5)			7,581,860				5.5	%			730,477				6,851,383				4.8	%
Directors and Executive Officers, including our Named Executive Officers
David G. DeWalt(6)			5,205,228				3.8	%			485,656				4,719,572				3.3	%
Ashar Aziz(3)			10,835,000				7.8	%			1,043,904				9,791,096				6.8	%
Kevin R. Mandia(7)			3,251,226				2.4	%			227,586				3,023,640				2.1	%
Michael J. Sheridan(8)			1,213,498				*				121,733				1,091,765				*
Jeffrey C. Williams(9)			1,996,719				1.4	%			197,192				1,799,527				1.2	%
Alexa King(10)			350,000				*				38,500				311,500				*
Bahman Mahbod(11)			1,257,659				*				125,987				1,131,672				*
Gaurav Garg(12)			1,708,720				1.2	%			164,627				1,544,093				1.1	%

 

156

---

Table of Contents

Name of Beneficial Owner+		Beneficial Ownership Prior to this Offering								Shares Being Offered				Beneficial Ownership After this Offering
		Number				Percent								Number				Percent
Promod Haque(13)			20,843,865				15.0	%			2,008,213				18,835,652				13.1	%
Ronald E.F. Codd(14)			250,000				*				9,000				241,000				*
William M. Coughran Jr.(15)			—				—				—				—				—
Robert F. Lentz(16)			430,382				*				41,466				388,916				*
Enrique Salem(17)			200,000				*				19,269				180,731				*
All current directors and executive officers as a group (13 persons)(18)			47,542,297				34.3	%			4,483,133				43,059,164				29.8	%
Other Selling Stockholders:
SVB Entities(19)			6,424,003				4.6	%			588,888				5,835,115				4.1	%
One Equity Entities(20)			5,591,913				4.0	%			391,434				5,200,479				3.6	%
KPCB Holdings, Inc.(21)			3,273,004				2.4	%			229,110				3,043,894				2.1	%
CPMG Entities(22)			1,449,113				1.1	%			104,938				1,394,175				*
Travis Michael Reese(23)			786,380				*				71,479				714,901				*
Osman Ismael(24)			634,806				*				63,087				571,719				*
David Charles Merkel(25)			534,855				*				40,000				494,855				*
Muhammad Amin(26)			510,514				*				49,868				460,646				*
Manish Gupta(27)			450,000				*				46,920				403,080				*
Anthony Kolish(28)			400,000				*				39,502				360,498				*
Jayaraman Manni(29)			395,808				*				20,000				375,808				*
Trellus Entities(30)			473,642				*				33,153				440,489				*
Kara Wilson(31)			332,757				*				32,757				300,000				*
Ken Gonzalez(32)			325,000				*				32,276				292,724				*
Barbara Massa(33)			250,000				*				25,000				225,000				*
Craig Martin(34)			250,000				*				25,050				224,950				*
Adam Usdan(35)			249,547				*				17,468				232,079				*
WMP, LLC(36)			243,772				*				17,064				226,708				*
Gregory J. Snyder(37)			217,779				*				10,000				207,779				*
William Hau(38)			200,000				*				19,269				180,731				*
Thomas J. Plombon(39)			172,187				*				19,269				152,918				*
Danielle L. Metzler(40)			169,678				*				13,563				156,115				*
Michael E. Malin(41)			162,514				*				9,724				152,790				*
Paul Davis(42)			162,500				*				19,269				143,231				*
Sridhar Jayanthi(43)			150,000				*				15,415				134,585				*
Lennart Van Den Ende(44)			142,187				*				15,415				126,772				*
Alex Lanstein(45)			141,869				*				13,669				128,200				*
Mumtaz Siddiqui(46)			138,891				*				13,722				125,169				*
Gregory Enriquez(47)			128,218				*				15,170				113,048				*
All other Selling Stockholders (25 Persons)(48)			1,379,320				*				201,211				1,178,109				*

 

*

Represents beneficial ownership of less than one percent (1%).

+

Certain options to purchase shares of our capital stock included in this table are early exercisable, and to the extent such shares are unvested as of a given date, such shares will remain subject to a right of repurchase held by us.

(1)

Consists of (i) 18,961,167 shares held of record by Sequoia Capital XI, LP, (ii) 2,062,304 shares held of record by Sequoia Capital XI Principals Fund, LLC, and (iii) 598,940 shares held of record by Sequoia Technology Partners XI, LP (collectively referred to as the “Sequoia Capital Funds”). SC XI Management, LLC is the general partner of Sequoia Capital XI, LP and Sequoia Technology Partners XI, LP and is the managing member of Sequoia Capital XI Principals Fund, LLC. The managing members of SC XI Management, LLC are Michael Goguen, Douglas Leone and Michael Moritz. As a

 

157

---

Table of Contents

result, and by virtue of the relationships described in this footnote, each of the managing members of SC XI Management, LLC may be deemed to share voting and investment power over the shares held by the Sequoia Capital Funds. Messrs. Goguen, Leone and Moritz disclaim beneficial ownership of the shares held of record by the Sequoia Capital Entities. The address of each of the entities identified in this footnote is 3000 Sand Hill Road, Suite 4-250, Menlo Park, CA 94025.

(2)

Consists of (i) 3,070,548 shares held of record by Norwest Venture Partners VIII, LP and (ii) 17,773,317 shares held of record by Norwest Venture Partners IX, LP (collectively referred to as the “Norwest Venture Partners Entities”). NVP Associates, LLC, or NVP, is the managing member of the general partners of the Norwest Venture Partners Entities, and may be deemed to share voting and investment power over the shares held by Norwest Venture Partners Entities. Promod Haque, Jeffrey Crowe and Matthew Howard, as co-chief executive officers of NVP and members of the general partners, may be deemed to share voting and investment power with respect to the shares held of record by the Norwest Venture Partners Entities. The address for the Norwest Venture Partners Entities is 525 University Avenue, #800, Palo Alto, CA 94301. Promod Haque is a member of our board of directors.

(3)

Consists of 10,835,000 shares held of record by Mr. Aziz, as Trustee of the Ashar Aziz Family Trust dated March 16, 2012, 522,448 of which were issued upon early exercise of stock options and remained subject to further vesting as of 60 days following January 31, 2014. Shares issued upon early exercise of stock options remain subject to the vesting schedule applicable to the exercised stock options, and we have a right to repurchase any unvested shares at the original exercise price if Mr. Aziz ceases to provide services to us prior to the date on which all such shares have vested. Mr. Aziz, as trustee, has sole voting and investment power with respect to the shares held of record by the Ashar Aziz Family Trust dated March 16, 2012. In connection with a personal loan, Mr. Aziz has entered into a Security and Pledge Agreement, pursuant to which Mr. Aziz has granted to the lender a security interest in all of the shares of our common stock held by Mr. Aziz, as Trustee of the Ashar Aziz Family Trust dated March 16, 2012.

(4)

Consists of (i) 8,791 shares held of record by DAG Ventures GP Fund III, LLC, (ii) 8,920,335 shares held of record by DAG Ventures III-QP, L.P., (iii) 839,090 shares held of record by DAG Ventures III, L.P., and (iv) 719,940 shares held of record by DAG Ventures III-A, LLC (collectively referred to as the “DAG Ventures Entities”). DAG Ventures Management III, LLC is the Managing Member of each of DAG Ventures GP Fund III, LLC and DAG Ventures III-A, LLC and is the general partner of each of DAG Ventures III-QP, L.P. and DAG Ventures III, L.P. R. Thomas Goodrich and John J. Cadeddu, the managing members of DAG Ventures Management III, LLC, may be deemed to share voting and investment power with respect to the shares held of record by the DAG Ventures Entities. The address for these entities is 251 Lytton Avenue, Suite 200, Palo Alto, CA 94301.

(5)

Consists of (i) 7,267,503 shares held of record by JAFCO Technology Partners, L.P. and (ii) 314,357 shares held of record by JAFCO Technology Partners II, L.P. (collectively referred to as the “JAFCO Technology Partners Entities”). JTP Management Associates, L.L.C. (“JTPMA I”) is the general partner of JAFCO Technology Partners, L.P., and JTM Management Associates II, L.L.C. (“JTPMA II”) is the general partner of JAFCO Technology Partners II, L.P. Joseph Horowitz, Thomas Mawhinney and Tsunesaburo Sugaya are the managing members of JTPMA I and JTPMA II and may be deemed to share voting and investment power with respect to the shares held of record by the JAFCO Technology Partners Entities. The address for these entities is 505 Hamilton Avenue, Palo Alto, CA 94301.

(6)

Consists of (i) 4,498,950 shares held of record by Mr. DeWalt, 2,092,108 of which were issued upon early exercise of stock options and remained subject to further vesting as of 60 days following January 31, 2014 and 210,581 of which were issued pursuant to a stock grant and remained subject to further vesting as of 60 days following January 31, 2014, (ii) 180,944 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 60,314 shares were fully vested as of such date, (iii) 219,000 shares held of record by David G. DeWalt and Mary Kathleen DeWalt, trustees of David G. DeWalt 2009 Irrevocable Trust, (iv) 219,000 shares held of record by David G. DeWalt and Mary Kathleen DeWalt, trustees of Mary Kathleen DeWalt 2009 Irrevocable Trust and (v) 87,334 shares held of record by U.S. Bank National Association as

 

158

---

Table of Contents

escrow agent under the merger agreement governing our acquisition of Mandiant. Shares issued upon early exercise of stock options remain subject to the vesting schedule applicable to the exercised stock options. We have a right to repurchase any unvested shares issued upon early exercise of stock options at the original exercise price if Mr. DeWalt ceases to provide services to us prior to the date on which all such shares have vested. The unvested shares issued pursuant to the stock grant are subject to forfeiture if Mr. DeWalt ceases to provide services to us prior to the date on which all such shares have vested. Mr. DeWalt shares voting and investment power with respect to the shares held of record by David G. DeWalt and Mary Kathleen DeWalt, trustees of the David G. DeWalt 2009 Irrevocable Trust and David G. DeWalt and Mary Kathleen DeWalt, trustees of the Mary Kathleen DeWalt 2009 Irrevocable Trust.

(7)

Consists of (i) 2,523,316 shares held of record by Mr. Mandia, of which 169,813 shares were issued subject to a consideration holdback agreement and remained subject to further vesting as of 60 days following January 31, 2014 and 137,029 shares were issued pursuant to a stock grant and remained subject to further vesting as of 60 days following January 31, 2014, (ii) 277,832 shares held of record by the Kevin R. Mandia 2011 Irrevocable Trust dated July 29, 2011 and (iii) 450,078 shares held of record by U.S. Bank National Association as escrow agent under the merger agreement governing our acquisition of Mandiant. Mr. Mandia’s spouse, as trustee, has shared voting and investment power with respect to the shares held of record by the Kevin R. Mandia 2011 Irrevocable Trust dated July 29, 2011. Mr. Mandia disclaims beneficial ownership of such shares.

(8)

Consists of (i) 1,207,498 shares held of record by Mr. Sheridan, 381,406 of which were issued pursuant to a restricted stock purchase agreement and remained subject to further vesting as of 60 days following January 31, 2014 and (ii) 6,000 shares held of record by Mr. Sheridan, as custodian for the benefit of his minor children. We have a right to repurchase, at the original purchase price, any unvested shares issued pursuant to the restricted stock purchase agreement if Mr. Sheridan ceases to provide services to us prior to the date on which all such shares have vested.

(9)

Consists of (i) 10,000 shares held of record by Mr. Williams, (ii) 500,000 shares held of record by Mr. Williams and Robin Williams as community property and (iii) 1,486,719 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 1,480,989 were fully vested as of such date.

(10)

Consists of 350,000 shares held of record by Ms. King and David Yamamoto as community property with the right of survivorship, 182,293 of which were issued upon early exercise of stock options and remained subject to further vesting as of 60 days following January 31, 2014. Shares issued upon early exercise of stock options remain subject to the vesting schedule applicable to the exercised stock options, and we have a right to repurchase any unvested shares at the original exercise price if Ms. King ceases to provide services to us prior to the date on which all shares have vested. Ms. King has shared voting and investment power with respect to the shares held of record by Ms. King and David Yamamoto as community property with the right of survivorship.

(11)

Consists of (i) 866,659 shares held of record by Mr. Mahbod and (ii) 391,000 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 270,145 were fully vested as of such date.

(12)

Consists of (i) 725,944 shares held of record by the Gaurav Garg and Komal Shah Trust dated April 27, 2000 (the “Trust”), 134,870 of which were issued upon early exercise of stock options and remained subject to further vesting as of 60 days following January 31, 2014, (ii) 228,134 shares held of record by Gaurav Garg and Komal Shah, Trustees of the Garg/Shah GRAT Number One (“Grat No. 1”), (iii) 228,133 shares held of record by Gaurav Garg and Komal Shah, Trustees of the Garg/Shah GRAT Number Two (“Grat No. 2”), (iv) 507,515 shares held of record by Hilltop Family Partnership, and (v) 18,994 shares held of record by Alameda Alpha, LLC. Mr. Garg and Komal Shah are the general partners of Hilltop Family Partnership and share voting and investment power with respect to the shares held of record by such entity. Mr. Garg and J. Peter Wagner are the general partners of Alameda Alpha, LLC and share voting and investment power with respect to the shares held of record by such entity. Mr. Garg, as trustee, has shared voting and investment power with respect to the shares held of record by the Trust, Grat No. 1 and Grat No. 2. Shares issued upon early

 

159

---

Table of Contents

exercise of stock options remain subject to the vesting schedule applicable to the exercised stock options, and we have a right to repurchase any unvested shares at the original exercise price if Mr. Garg ceases to provide services to us prior to the date on which all such shares have vested.

(13)

Consists of 20,843,865 shares held by the Norwest Venture Partners Entities described in footnote (2) above. Mr. Haque is a member of the general partners of Norwest Venture Partners VIII, LP and Norwest Venture Partners IX, LP (Itasca VC Partners VIII, LLP and Genesis VC Partners IX, LLC, respectively). Mr. Haque is also an officer of NVP Associates, LLC, the managing member of Norwest Venture Partners VIII, LP and Norwest Venture Partners IX, LP and a limited partner of such funds, and as such may be deemed to share voting and investment power with respect to all shares held by such entities.

(14)

Consists of (i) 125,000 shares held of record by the Codd Revocable Trust Dtd March 6, 1998, 20,834 of which were issued upon early exercise of stock options and remained subject to further vesting as of 60 days following January 31, 2014, and (ii) 125,000 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, none of which were vested as of such date. Shares issued upon early exercise of stock options remain subject to the vesting schedule applicable to the exercised stock options, and we have a right to repurchase any unvested shares at the original exercise price if Mr. Codd ceases to provide services to us prior to the date on which all such shares have vested. Mr. Codd, as trustee, has shared voting and investment power with respect to the shares held of record by the Codd Revocable Trust Dtd March 6, 1998.

(15)

Excludes shares held of record by the Sequoia Capital Entities.

(16)

Consists of 430,382 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, all of which were fully vested as of such date.

(17)

Consists of 200,000 shares held of record by Enrique Salem, 95,833 of which were issued upon early exercise of stock options and remained subject to further vesting as of 60 days following January 31, 2014. Shares issued upon early exercise of stock options remain subject to the vesting schedule applicable to the exercised stock options, and we have a right to repurchase any unvested shares at the original exercise price if Mr. Salem ceases to provide services to us prior to the date on which all such shares have vested.

(18)

Consists of (i) 44,928,253 shares beneficially owned by our current directors and executive officers, of which 3,724,767 remained subject to further vesting within 60 days of January 31, 2014; and (ii) 2,614,045 shares issuable pursuant to stock options exercisable within 60 days of January 31, 2014, of which 2,241,830 were fully vested as of such date.

(19)

Consists of (i) warrants to purchase 311,747 shares held by SVB Financial Group (ii) 3,056,128 shares held of record by Silicon Valley BancVentures, L.P. and (iii) 3,056,128 shares held of record by SVB Capital Partners II, L.P. (collectively referred to as the “SVB Entities”). SVB Financial Group is the controlling stockholder of Silicon Valley BancVentures, Inc., the general partner of Silicon Valley BancVentures, L.P. and is also the managing member of SVB Capital Partners II, LLC, which is the general partner of SVB Capital Partners II, L.P. SVB Financial Group is a reporting company listed on NASDAQ Global market. Through the authority delegated by SVB Financial Group’s Finance Committee of the Board of Directors, Michael D. Kruse, Treasurer of SVB Financial Group, has voting and investment power over the warrants and underlying shares held by SVB Financial Group. The Silicon Valley BancVentures, L.P. and SVB Capital Partners II, L.P. investment committees each (i) have voting and investment power over the shares held by Silicon Valley BancVentures, L.P. and SVB Capital Partners II, L.P. and (ii) are comprised of senior investment professionals employed by an affiliate of SVB Financial Group. SVB Financial Group, Silicon Valley BancVentures, L.P. and SVB Capital Partners II, L.P. are affiliates of a broker-dealer. At the time of issuance, each of SVB Financial Group, Silicon Valley BancVentures, L.P. and SVB Capital Partners II, L.P. represented to us that each entity acquired the securities as an investment, purchased the shares to be sold in the ordinary course of business and, at the time of the purchase, had no agreements or understandings, directly or indirectly with any person to distribute shares. The address of SVB Financial Group’s headquarters is 3003 Tasman Drive, Santa Clara, CA 95054.

 

160

---

Table of Contents

(20)

Consists of (i) 4,062,929 shares held of record by One Equity Partners IV, L.P., a Cayman Islands limited partnership (“OEP IV”), (ii) 716,987 shares held of record by OEP II Partners Co-Invest, L.P., a Cayman Islands limited partnership (“OEP II Co-Invest”) (collectively referred to as the “One Equity Entities”), and (iii) 811,997 shares held of record by U.S. Bank National Association as escrow agent under the merger agreement governing our acquisition of Mandiant. The general partner of OEP IV is OEP General Partner IV, L.P., a Cayman Islands limited partnership (“OEP GP IV”), of which the sole general partner is OEP Parent LLC, a Delaware limited liability company (“OEP Parent”), of which the sole member is OEP Holding Corporation, a Delaware Corporation, of which the sole stockholder is JPMorgan Capital Corporation, a Delaware corporation, of which the sole stockholder is Banc One Financial LLC, a Delaware limited liability company, of which the sole member is JPMorgan Chase & Co., a Delaware corporation. All dispositions and acquisitions by OEP II Co-Invest occur contractually through a co-investment agreement pursuant to which OEP II Co-Invest acts in lock-step with OEP IV. Decisions regarding the voting or disposition of the shares held by OEP IV and OEP II Co-Invest are made by an investment committee. The current voting members of this committee are: Richard M. Cashin, Paul C. Hennessy, Douglas B. Petno, Robert S. Rubin, Joseph M. Saad, Richard W. Smith and Kevin D. Willsey. The address for the One Equity Entities is 320 Park Ave., 18th Floor, New York, NY, 10022.

(21)

Consists of (i) 2,797,734 shares held of record by KPCB Holdings, Inc. as nominee for KPCB Digital Growth Fund, LLC and KPCB Digital Growth Founders Fund, LLC and (ii) 475,270 shares held of record by U.S. Bank National Association as escrow agent under the merger agreement governing our acquisition of Mandiant. KPCB DGF Associates, LLC is the managing member of each of KPCB Digital Growth Fund, LLC and KPCB DGF Founders Fund, LLC. John Doerr, Ted Schlein, Brook Byers, Bing Gordon and Mary Meeker are the managing members of KPCB DGF Associates, LLC and may be deemed to share voting and investment power with respect to the shares held by KPCB Holdings, Inc. The address for these entities is 2750 Sand Hill Road, Menlo Park, CA 94025.

(22)

Consists of (i) 759,184 shares held of record by Kestrel Fund, LP, (ii) 522,245 shares held of record by Willet Fund, LP (collectively referred to as the “CPMG Entities”) and (iii) 217,684 shares held of record by U.S. Bank National Association as escrow agent under the merger agreement governing our acquisition of Mandiant. CPMG, Inc. is the general partner of each of the CPMG Entities. John E. Bateman is the president and chief operating officer of CPMG, Inc. and may be deemed to hold voting and investment power with respect to the shares held by the CPMG Entities. The address for the CPMG Entities is 2000 McKinney Avenue, Suite 2125, Dallas, TX 75201.

(23)

Consists of (i) 266,182 shares held of record by Mr. Reese, 35,235 of which were issued pursuant to a stock grant and remained subject to further vesting as of 60 days following January 31, 2014, (ii) 480,967 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, all of which were fully vested as of such date and (iii) 39,231 shares held of record by U.S. Bank National Association as escrow agent under the merger agreement governing our acquisition of Mandiant. The unvested shares issued pursuant to the stock grant are subject to forfeiture if Mr. Reese ceases to provide services to us prior to the date on which all such shares have vested.

(24)

Consists of (i) 217,000 shares held of record by Mr. Ismael and (ii) 417,806 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 387,806 were fully vested as of such date.

(25)

Consists of (i) 371,951 shares held of record by Mr. Merkel, 35,235 of which were issued pursuant to a stock grant and remained subject to further vesting as of 60 days following January 31, 2014, (ii) 105,706 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, all of which were fully vested as of such date and (iii) 57,198 shares held of record by U.S. Bank National Association as escrow agent under the merger agreement governing our acquisition of Mandiant. The unvested shares issued pursuant to the stock grant are subject to

 

161

---

Table of Contents

forfeiture if Mr. Merkel ceases to provide services to us prior to the date on which all such shares have vested.

(26)

Consists of (i) 346,194 shares held of record by Mr. Amin and (ii) 164,320 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 133,590 were fully vested as of such date.

(27)

Consists of (i) 18,382 shares held of record by Manish Gupta and Ritu Gupta, Trustees of the Gupta Trust Dated 1/6/2005 and (ii) 431,618 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 112,868 were fully vested as of such date.

(28)

Consists of 400,000 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 133,333 were fully vested as of such date.

(29)

Consists of (i) 342,892 shares held of record by Mr. Manni and (ii) 52,916 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 27,916 were fully vested as of such date.

(30)

Consists of (i) 310,314 shares held of record by Trellus Partners, LP, (ii) 94,551 shares held of record by Trellus Small Cap Opportunity Fund, LP (collectively referred to as the “Trellus Entities”) and (iii) 68,777 shares held of record by U.S. Bank National Association as escrow agent under the merger agreement governing our acquisition of Mandiant. Trellus Co. LLC is the general partner of each of the Trellus Entities. Adam Usdan is the managing member of Trellus Co. LLC and may be deemed to hold voting and investment power with respect to the shares held by the Trellus Entities. The address for the Trellus Entities is 767 Third Avenue, 32nd Floor, New York, NY 10017.

(31)

Consists of (i) 300,000 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, none of which were vested as of such date and (ii) 32,757 restricted stock units, which will vest upon the effectiveness of this registration statement.

(32)

Consists of (i) 69,638 shares held of record by Ken and Liz Gonzalez Trustees of Ken Gonzalez and Liz Gonzalez Revocable Trust Dated February 8, 2013 and (ii) 255,362 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 25,153 were fully vested as of such date.

(33)

Consists of 250,000 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 94,166 were fully vested as of such date.

(34)

Consists of 250,000 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 98,958 were fully vested as of such date.

(35)

Consists of (i) 213,311 shares held of record by Mr. Usdan and (ii) 36,236 shares held of record by U.S. Bank National Association as escrow agent under the merger agreement governing our acquisition of Mandiant.

(36)

Consists of (i) 208,374 shares held of record by WMP, LLC and (ii) 35,398 shares held of record by U.S. Bank National Association as escrow agent under the merger agreement governing our acquisition of Mandiant. Andrew J. Gessow is the managing member of WMP, LLC and may be deemed to hold voting and investment power with respect to the shares held by WMP, LLC. The address for WMP, LLC is 545 Albion Avenue, Woodside, CA 94062.

(37)

Consists of (i) 87,779 shares held of record by Mr. Snyder, (ii) 22,00 held of record by Gregory Snyder and Sarah Finlay as community property with right of survivorship, and (iii) 108,000 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 15,916 were fully vested as of such date.

(38)

Consists of 200,000 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 58,332 were fully vested as of such date.

(39)

Consists of (i) 150,000 shares held of record by Mr. Plombon, 5,209 of which were issued upon early exercise of stock options and remained subject to further vesting as of 60 days following January 31, 2014, and (ii) 22,187 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 14,687 were fully vested as of such date. Shares issued upon early exercise of stock options remain subject to the vesting schedule applicable to the exercised stock options, and we have a right to repurchase any unvested shares at the original

 

162

---

Table of Contents

exercise price if Mr. Plombon ceases to provide services to us prior to the date on which all such shares have vested.

(40)

Consists of (i) 45,146 shares held of record by Ms. Metzler, (ii) 116,865 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, all of which were fully vested as of such date and (iii) 7,667 shares held of record by U.S. Bank National Association as escrow agent under the merger agreement governing our acquisition of Mandiant.

(41)

Consists of (i) 138,916 shares held of record by Mr. Malin and (ii) 23,598 shares held of record by U.S. Bank National Association as escrow agent under the merger agreement governing our acquisition of Mandiant.

(42)

Consists of (i) 133,333 shares held of record by Mr. Davis and (ii) 29,167 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, all of which were fully vested as of such date.

(43)

Consists of 150,000 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 43,750 were fully vested as of such date.

(44)

Consists of (i) 78,333 shares held of record by Mr. Van Den Ende and Yuki Van Den Ende as community property with right of survivorship and (ii) 63,854 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 11,354 were fully vested as of such date.

(45)

Consists of (i) 121,868 shares held of record by Mr. Lanstein and (ii) 20,001 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 8,542 were fully vested as of such date.

(46)

Consists of 138,891 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, of which 123,891 were fully vested as of such date.

(47)

Consists of 128,218 shares issuable pursuant to outstanding stock options exercisable within 60 days of January 31, 2014, all of which were fully vested as of such date.

(48)

Represents shares held by 25 selling stockholders not listed above who, as a group, own less than 1% of our outstanding common stock prior to this offering. Of these selling stockholders, 18 are current employees of our company.

 

163

---

Table of Contents

DESCRIPTION OF CAPITAL STOCK

 

General

 

The following is a summary of the rights of our common stock and preferred stock and certain provisions of our amended and restated certificate of incorporation and amended and restated bylaws. This summary does not purport to be complete and is qualified in its entirety by the provisions of our amended and restated certificate of incorporation and amended and restated bylaws, copies of which have been filed as exhibits to the registration statement of which this prospectus is a part.

 

Our authorized capital stock consists of 1,100,000,000 shares, with a par value of $0.0001 per share, of which:

 

•

1,000,000,000 shares are designated as common stock; and

 

•

100,000,000 shares are designated as preferred stock.

 

As of December 31, 2013, there were 138,554,358 shares of our common stock outstanding, held by approximately 352 stockholders of record, and no shares of preferred stock. In addition, as of December 31, 2013, there were outstanding options to acquire 26,657,087 shares of our common stock, 1,757,031 shares of common stock issuable pursuant to outstanding restricted stock units and outstanding warrants to purchase 311,747 shares of our common stock.

 

Common Stock

 

The holders of common stock are entitled to one vote per share on all matters submitted to a vote of our stockholders and do not have cumulative voting rights. Accordingly, holders of a majority of the shares of common stock entitled to vote in any election of directors may elect all of the directors standing for election. Subject to preferences that may be applicable to any preferred stock outstanding at the time, the holders of outstanding shares of common stock are entitled to receive ratably any dividends declared by our board of directors out of assets legally available. See the section entitled “Dividend Policy.” Upon our liquidation, dissolution, or winding up, holders of our common stock are entitled to share ratably in all assets remaining after payment of liabilities and the liquidation preference of any then outstanding shares of preferred stock. Holders of common stock have no preemptive or conversion rights or other subscription rights. There are no redemption or sinking fund provisions applicable to the common stock.

 

Preferred Stock

 

No shares of preferred stock are outstanding. Pursuant to our amended and restated certificate of incorporation, our board of directors has the authority, without further action by the stockholders, to issue from time to time up to 100,000,000 shares of preferred stock in one or more series. Our board of directors may designate the rights, preferences, privileges, and restrictions of the preferred stock, including dividend rights, conversion rights, voting rights, redemption rights, liquidation preference, sinking fund terms, and the number of shares constituting any series or the designation of any series. The issuance of preferred stock could have the effect of restricting dividends on the common stock, diluting the voting power of the common stock, impairing the liquidation rights of the common stock, or delaying, deterring, or preventing a change in control. Such issuance could have the effect of decreasing the market price of the common stock. We currently have no plans to issue any shares of preferred stock.

 

Warrants

 

As of December 31, 2013, warrants to purchase 311,747 shares of our common stock at a weighted-average exercise price of $0.72 per share were outstanding. Each of these warrants has a net exercise provision under which its holder may, in lieu of payment of the exercise price in cash, surrender the warrant and receive a net

 

164

---

Table of Contents

amount of shares based on the fair market value of the underlying shares at the time of exercise of the warrant after deduction of a number of shares equal in value to the aggregate exercise price. Each warrant contains provisions for the adjustment of the exercise price and the number of shares issuable upon the exercise of the warrant in the event of certain stock dividends, stock splits, reorganizations, reclassifications and consolidations. The holders of the shares issuable upon exercise of our warrants are entitled to registration rights with respect to such shares as described in greater detail below under the heading “—Registration Rights.”

 

Registration Rights

 

Following the completion of this offering, the holders of shares of our common stock (i) issued upon the conversion of our convertible preferred stock, (ii) issued upon the exercise of outstanding warrants and (iii) issued in connection with our acquisition of Mandiant, or their permitted transferees, will be entitled to rights with respect to the registration of these shares under the Securities Act. These rights are provided under the terms of an amended and restated investors’ rights agreement between us and the holders of these shares, which was originally entered into in connection with our convertible preferred stock financings and amended and restated in connection with our acquisition of Mandiant. Such rights include demand registration rights, piggyback registration rights, and Form S-3 registration rights. In any registration made pursuant to such amended and restated investors’ rights agreement, all expenses (other than underwriting discounts and commissions and stock transfer taxes applicable to the securities registered by the selling stockholders) of underwritten registrations will be borne by us. These registration rights terminate on September 25, 2016.

 

Demand Registration Rights

 

Following the completion of this offering, the holders of an aggregate of 84,310,480 shares of our common stock (including 311,747 shares of our common stock issuable upon the exercise of warrants that were outstanding as of December 31, 2013), or their permitted transferees, will be entitled to demand registration rights. Under the terms of the amended and restated investors’ rights agreement, we will be required, upon the written request of holders of at least 30% of the shares that are entitled to registration rights under the investors’ rights agreement, to register, as soon as practicable, all or a portion of these shares for public resale. We are required to effect only two registrations pursuant to this provision of the investors’ rights agreement. We will not be required to effect a demand registration prior to March 18, 2014, which is 180 days after the effectiveness of our initial public offering. Such request for registration must cover that number of shares with an anticipated aggregate offering price of $15,000,000. We will not be required to effect a demand registration during the period beginning 60 days prior to our good faith estimate of the date of the filing of, and 180 days following the effective date of, a registration statement relating to a public offering of our securities. We may defer the filing of a registration statement once during any 12 month period for a period of not more than 90 days, if we provide a certificate stating that in the good faith judgment of our board of directors, it would be seriously detrimental to us and our stockholders for the registration statement to be effected at that time; provided that, during such 90 day period, we do not register any securities for our own account or any other stockholder.

 

Piggyback Registration Rights

 

Following the completion of this offering, the holders of an aggregate of 84,310,480 shares of our common stock (including 311,747 shares of our common stock issuable upon the exercise of warrants that were outstanding as of December 31, 2013), or their permitted transferees, will be entitled to piggyback registration rights. If we register any of our securities for our own account, after the completion of this offering, the holders of these shares will be entitled to include their shares in the registration. The underwriters of any underwritten offering have the right to limit the number of shares registered by these holders for marketing reasons, subject to limitations set forth in the investors’ rights agreement.

 

Form S-3 Registration Rights

 

Following the completion of this offering, the holders of an aggregate of 84,310,480 shares of our common stock (including 311,747 shares of our common stock issuable upon the exercise of warrants that were

 

165

---

Table of Contents

outstanding as of December 31, 2013) or their permitted transferees will also be entitled to Form S-3 registration rights. If we are eligible to file a registration statement on Form S-3, and have not done so within the preceding 12 month period, these holders have the right, upon written request from holders of at least 30% of the shares that are entitled to registration rights under the amended and restated investors’ rights agreement, to have such shares registered by us if the proposed aggregate offering price of the shares to be registered by the holders requesting registration is at least $5,000,000, subject to exceptions set forth in the investors’ rights agreement. We may defer the filing of the Form S-3 registration statement once during any 12 month period for a period of not more than 90 days, if we provide a certificate stating that in the good faith judgment of our board of directors, it would be seriously detrimental to us and our stockholders for the registration statement to be effected at that time; provided that, during such 90 day period, we do not register any securities for our own account or any other stockholder.

 

Resale Rights for Former Stockholders of Mandiant

 

Pursuant to the terms of our amended and restated investors’ rights agreement, as soon as practicable following April 15, 2014, we have agreed to file with the SEC a registration statement on Form S-1 covering the resale of all 12,471,437 shares of common stock held by former stockholders of Mandiant after the completion of the offering, and we have further agreed to use commercially reasonable efforts to cause such registration statement to be declared effective by the SEC by May 8, 2014 or as soon as practicable thereafter and, subject to certain exceptions, cause such registration statement to remain effective through June 30, 2014.

 

Anti-Takeover Effects of Delaware Law and Our Amended and Restated Certificate of Incorporation and Amended and Restated Bylaws

 

Our amended and restated certificate of incorporation and amended and restated bylaws contain provisions that could have the effect of delaying, deferring, or discouraging another party from acquiring control of us. These provisions and certain provisions of Delaware law, which are summarized below, could discourage takeovers, coercive or otherwise. These provisions are also designed, in part, to encourage persons seeking to acquire control of us to negotiate first with our board of directors. We believe that the benefits of increased protection of our potential ability to negotiate with an unfriendly or unsolicited acquirer outweigh the disadvantages of discouraging a proposal to acquire us.

 

Undesignated Preferred Stock. As discussed above under “—Preferred Stock,” our board of directors has the ability to designate and issue preferred stock with voting or other rights or preferences that could deter hostile takeovers or delay changes in our control or management.

 

Limits on Ability of Stockholders to Act by Written Consent or Call a Special Meeting. Our amended and restated certificate of incorporation provides that our stockholders may not act by written consent. This limit on the ability of stockholders to act by written consent may lengthen the amount of time required to take stockholder actions. As a result, the holders of a majority of our capital stock are not able to amend the amended and restated bylaws or remove directors without holding a meeting of stockholders called in accordance with the amended and restated bylaws.

 

In addition, our amended and restated bylaws provide that special meetings of the stockholders may be called only by our board of directors, the chairperson of our board of directors, our chief executive officer or our president (in the absence of a chief executive officer). A stockholder may not call a special meeting, which may delay the ability of our stockholders to force consideration of a proposal or for holders controlling a majority of our capital stock to take any action, including the removal of directors.

 

Requirements for Advance Notification of Stockholder Nominations and Proposals. Our amended and restated bylaws contain advance notice procedures with respect to stockholder proposals and the nomination of candidates for election as directors, other than nominations made by or at the direction of our board of directors or a committee of the board of directors. These advance notice procedures may have the effect of precluding the

 

166

---

Table of Contents

conduct of certain business at a meeting if the proper procedures are not followed and may also discourage or deter a potential acquirer from conducting a solicitation of proxies to elect its own slate of directors or otherwise attempt to obtain control of our company.

 

Board Classification. Our board of directors is divided into three classes. The directors in each class serve for a three-year term, one class being elected each year by our stockholders. This system of electing and removing directors may discourage a third party from making a tender offer or otherwise attempting to obtain control of us, because it generally makes it more difficult for stockholders to replace a majority of the directors.

 

Delaware Anti-Takeover Statute. We are subject to the provisions of Section 203 of the Delaware General Corporation Law regulating corporate takeovers. In general, Section 203 prohibits a publicly held Delaware corporation from engaging, under certain circumstances, in a business combination with an interested stockholder for a period of three years following the date the person became an interested stockholder unless:

 

•

prior to the date of the transaction, our board of directors approved either the business combination or the transaction that resulted in the stockholder becoming an interested stockholder;

 

•

upon completion of the transaction that resulted in the stockholder becoming an interested stockholder, the interested stockholder owned at least 85% of the voting stock of the corporation outstanding at the time the transaction commenced, excluding for purposes of determining the voting stock outstanding but not the outstanding voting stock owned by the interested stockholder, (1) shares owned by persons who are directors and also officers and (2) shares owned by employee stock plans in which employee participants do not have the right to determine confidentially whether shares held subject to the plan will be tendered in a tender or exchange offer; or

 

•

at or subsequent to the date of the transaction, the business combination is approved by our board of directors and authorized at an annual or special meeting of stockholders, and not by written consent, by the affirmative vote of at least 66 2/3% of the outstanding voting stock that is not owned by the interested stockholder.

 

Generally, a business combination includes a merger, asset or stock sale, or other transaction resulting in a financial benefit to the interested stockholder. An interested stockholder is a person who, together with affiliates and associates, owns or, within three years prior to the determination of interested stockholder status, owned 15% or more of a corporation’s outstanding voting stock. We expect the existence of this provision to have an anti-takeover effect with respect to transactions our board of directors does not approve in advance. We also anticipate that Section 203 may discourage attempts that might result in a premium over the market price for the shares of common stock held by stockholders.

 

The provisions of Delaware law and the provisions of our amended and restated certificate of incorporation and amended and restated bylaws could have the effect of discouraging others from attempting hostile takeovers and as a consequence, they might also inhibit temporary fluctuations in the market price of our common stock that often result from actual or rumored hostile takeover attempts. These provisions might also have the effect of preventing changes in our management. It is also possible that these provisions could make it more difficult to accomplish transactions that stockholders might otherwise deem to be in their best interests.

 

Transfer Agent and Registrar

 

The transfer agent and registrar for our common stock is American Stock Transfer & Trust Company, LLC. The transfer agent’s address is 6201 15th Avenue, Brooklyn, New York 11219.

 

Exchange Listing

 

Our common stock is listed on The NASDAQ Global Select Market under the symbol “FEYE.”

 

167

---

Table of Contents

SHARES ELIGIBLE FOR FUTURE SALE

 

Future sales of substantial amounts of shares of common stock, including shares issued upon the exercise of outstanding options, in the public market after this offering, or the possibility of these sales occurring, could adversely affect the prevailing market price for our common stock or impair our ability to raise equity capital.

 

Upon the completion of this offering, a total of 144,136,573 shares of common stock will be outstanding. Of these shares, all 17,450,000 shares of common stock sold in our initial public offering, all 5,582,215 shares of common stock sold in this offering by us, all 8,417,785 shares sold in this offering by the selling stockholders, and any shares sold upon the exercise of the underwriters’ over-allotment option will be freely tradable in the public market without restriction or further registration under the Securities Act, unless these shares are held by “affiliates,” as that term is defined in Rule 144 under the Securities Act.

 

The remaining 112,686,573 shares of common stock will be “restricted securities,” as that term is defined in Rule 144 under the Securities Act. These restricted securities are eligible for public sale only if they are registered under the Securities Act or if they qualify for an exemption from registration under Rules 144 or 701 under the Securities Act, which are summarized below.

 

As a result of the lock-up agreements described below, these restricted securities will be available for sale in the public market at various times as follows, subject to the provisions of Rule 144 or 701 under the Securities Act and, where applicable, compliance with our insider trading policy:

 

•

14,664,639 shares will be eligible for sale in the public market on March 19, 2014 upon the expiration of lock-up agreements entered into in connection with our initial public offering;

 

•

95,610,568 shares will be eligible for sale in the public market upon the expiration of lock-up agreements entered into in connection with this offering, assuming the effectiveness of the resale registration statement for former stockholders of Mandiant (as described below under “—Resale Rights for Former Stockholders of Mandiant”); and

 

•

1,927 shares will be eligible for sale in the public market on June 30, 2014.

 

The remaining restricted securities will continue to be held in escrow subject to the terms and conditions of the merger agreement governing our acquisition of Mandiant.

 

Rule 144

 

In general, under Rule 144 as currently in effect, once we have been subject to public company reporting requirements for at least 90 days, a person who is not deemed to have been one of our affiliates for purposes of the Securities Act at any time during the 90 days preceding a sale and who has beneficially owned the shares proposed to be sold for at least six months, including the holding period of any prior owner other than our affiliates, is entitled to sell such shares without complying with the manner of sale, volume limitation, or notice provisions of Rule 144, subject to compliance with the public information requirements of Rule 144. If such a person has beneficially owned the shares proposed to be sold for at least one year, including the holding period of any prior owner other than our affiliates, then such person is entitled to sell such shares without complying with any of the requirements of Rule 144.

 

In general, under Rule 144, as currently in effect, our affiliates or persons selling shares on behalf of our affiliates are entitled to sell upon expiration of the lock-up agreements described below, within any three-month period, a number of shares that does not exceed the greater of:

 

•

1% of the number of shares of common stock then outstanding, which will equal approximately 1,441,366 shares immediately after this offering; or

 

•

the average weekly trading volume of the common stock during the four calendar weeks preceding the filing of a notice on Form 144 with respect to such sale.

 

168

---

Table of Contents

Sales under Rule 144 by our affiliates or persons selling shares on behalf of our affiliates are also subject to certain manner of sale provisions and notice requirements and to the availability of current public information about us.

 

Rule 701

 

Rule 701 generally allows a stockholder who purchased shares of our common stock pursuant to a written compensatory plan or contract and who is not deemed to have been an affiliate of our company during the immediately preceding 90 days to sell these shares in reliance upon Rule 144 but without being required to comply with the public information, holding period, volume limitation, or notice provisions of Rule 144. Rule 701 also permits affiliates of our company to sell their Rule 701 shares under Rule 144 without complying with the holding period requirements of Rule 144.

 

Resale Rights for Former Stockholders of Mandiant

 

Pursuant to the terms of our amended and restated investors’ rights agreement, as soon as practicable following April 15, 2014, we have agreed to file with the SEC a registration statement on Form S-1 covering the resale of all 12,471,437 shares of common stock held by former stockholders of Mandiant upon the completion of this offering, and we have further agreed to use commercially reasonable efforts to cause such registration statement to be declared effective by the SEC by May 8, 2014 or as soon as practicable thereafter. For additional information, see “Capitalization—Registration Rights—Special Resale Registration Rights for Former Stockholders of Mandiant.”

 

Lock-Up Agreements

 

In connection with our initial public offering, we, all of our directors and executive officers, and the holders of substantially all of our common stock, or securities exercisable for or convertible into our common stock outstanding immediately prior to such offering agreed that, without the prior written consent of Morgan Stanley & Co. LLC and Goldman, Sachs & Co., on behalf of the underwriters, we and they will not, during the period through March 18, 2014:

 

•

offer, pledge, sell, contract to sell, sell any option or contract to purchase, purchase any option or contract to sell, grant any option, right or warrant to purchase, lend or otherwise transfer or dispose of, directly or indirectly, any shares of common stock or any other securities convertible into or exercisable or exchangeable for shares of common stock;

 

•

file any registration statement with the Securities and Exchange Commission relating to the offering of any shares of common stock or any securities convertible into or exercisable or exchangeable for common stock; or

 

•

enter into any swap or other arrangement that transfers to another, in whole or in part, any of the economic consequences of ownership of our common stock;

 

whether any such transaction described above is to be settled by delivery of common stock or such other securities, in cash or otherwise. This agreement is subject to certain exceptions as set forth in the section entitled “Underwriters.” Morgan Stanley & Co. LLC and Goldman, Sachs & Co., on behalf of the underwriters, have consented to the release of these lock-up restrictions with respect to 8,417,785 shares of common stock to be sold in this offering by the selling stockholders, including certain of our directors, executive officers and employees. The release will take effect on the pricing of this offering.

 

In addition, in connection with this offering, we, all of our directors and officers and certain holders of our common stock and securities exercisable for or convertible into our common stock outstanding immediately prior to this offering have agreed to extend the restricted period for an additional period ending 75 days after the date of this prospectus, as described in further detail in the section entitled “Underwriters.”

 

169

---

Table of Contents

Rule 10b5-1 Trading Plans

 

All of our executive officers and certain of our directors have adopted, and other directors may in the future adopt, written plans, known as “Rule 10b5-1 trading plans,” under which they have contracted, or may in the future contract, with a broker to buy or sell shares of our common stock on a periodic basis to diversify their assets and investments. Under these 10b5-1 trading plans, a broker may execute trades pursuant to parameters established by the executive officer or director when entering into the plan, without further direction from such officer or director. Such sales would not commence until the expiration of the applicable lock-up agreements entered into by such executive officer or director in connection with this offering.

 

Registration Rights

 

In addition to the resale rights for former stockholders of Mandiant described above, upon the completion of this offering, certain holders of shares of our common stock or their transferees will be entitled to various rights with respect to the registration of these shares under the Securities Act. Registration of these shares under the Securities Act would result in these shares becoming fully tradable without restriction under the Securities Act immediately upon the effectiveness of the registration, except for shares purchased by affiliates. See “Description of Capital Stock—Registration Rights” for additional information.

 

Registration Statements on Form S-8

 

We have filed registration statements on Form S-8 under the Securities Act to register all of the shares of common stock issued or reserved for issuance under our equity incentive plans. Shares covered by these registration statements are eligible for sale in the public market upon the expiration of, or release from, the lock-up agreements described above, subject to the vesting of such shares and compliance with our insider trading policy, where applicable.

 

170

---

Table of Contents

MATERIAL U.S. FEDERAL INCOME TAX CONSEQUENCES TO NON-U.S. HOLDERS

 

The following is a summary of the material U.S. federal income tax consequences to non-U.S. holders (as defined below) of the ownership and disposition of our common stock acquired in this offering. This summary does not purport to be a complete analysis of all the potential tax considerations relating thereto and is based upon the provisions of the Internal Revenue Code of 1986, as amended, or the Code, Treasury regulations promulgated thereunder, administrative rulings, and judicial decisions, all as of the date hereof. These authorities may be changed, possibly retroactively, so as to result in U.S. federal income tax consequences different from those set forth below. We have not sought, and will not seek, any ruling from the Internal Revenue Service, or the IRS, with respect to the tax consequences discussed herein, and there can be no assurance that the IRS will not take a position contrary to the tax consequences discussed below or that any position taken by the IRS would not be sustained.

 

This summary also does not address the tax considerations arising under the laws of any non-U.S., state or local jurisdiction, the potential application of Medicare contribution tax or any tax considerations under U.S. federal gift and estate tax laws, except to the limited extent set forth below. In addition, this discussion does not address tax considerations applicable to an investor’s particular circumstances or to investors that may be subject to special tax rules, including, without limitation:

 

•

banks, insurance companies, or other financial institutions;

 

•

persons subject to the alternative minimum tax;

 

•

tax-exempt organizations;

 

•

controlled foreign corporations, passive foreign investment companies, and corporations that accumulate earnings to avoid U.S. federal income tax;

 

•

dealers in securities or currencies;

 

•

traders in securities that elect to use a mark-to-market method of accounting for their securities holdings;

 

•

persons that own, or are deemed to own, more than five percent of our capital stock (except to the extent specifically set forth below);

 

•

certain former citizens or long-term residents of the United States;

 

•

persons who hold our common stock as a position in a hedging transaction, “straddle,” “conversion transaction,” or other risk reduction transaction;

 

•

persons who do not hold our common stock as a capital asset within the meaning of Section 1221 of the Code; or

 

•

persons deemed to sell our common stock under the constructive sale provisions of the Code.

 

In addition, if a partnership or entity classified as a partnership for U.S. federal income tax purposes holds our common stock, the tax treatment of a partner generally will depend on the status of the partner and upon the activities of the partnership. Accordingly, partnerships that hold our common stock, and partners in such partnerships, should consult their tax advisors.

 

You are urged to consult your tax advisor with respect to the application of the U.S. federal income tax laws to your particular situation, as well as any tax consequences of the purchase, ownership, and disposition of our common stock arising under the U.S. federal estate or gift tax rules or under the laws of any state, local, non-U.S., or other taxing jurisdiction or under any applicable tax treaty.

 

171

---

Table of Contents

Non-U.S. Holder Defined

 

For purposes of this discussion, you are a non-U.S. holder if you are any holder other than:

 

•

a partnership or entity classified as a partnership for U.S. federal-tax purposes;

 

•

an individual citizen or resident of the United States (for tax purposes);

 

•

a corporation or other entity taxable as a corporation created or organized in the United States or under the laws of the United States or any political subdivision thereof;

 

•

an estate whose income is subject to U.S. federal income tax regardless of its source; or

 

•

a trust (x) whose administration is subject to the primary supervision of a U.S. court and which has one or more U.S. persons who have the authority to control all substantial decisions of the trust or (y) which has made an election to be treated as a U.S. person.

 

Distributions

 

We have not made any distributions on our common stock and do not intend to do so in the foreseeable future. However, if we do make distributions on our common stock, those payments will constitute dividends for U.S. tax purposes to the extent paid from our current or accumulated earnings and profits, as determined under U.S. federal income tax principles. To the extent those distributions exceed both our current and our accumulated earnings and profits, they will constitute a return of capital and will first reduce your basis in our common stock, but not below zero, and then will be treated as gain from the sale of stock.

 

Any dividend paid to you generally will be subject to U.S. withholding tax either at a rate of 30% of the gross amount of the dividend or such lower rate as may be specified by an applicable income tax treaty. In order to receive a reduced treaty rate, you must provide us with an IRS Form W-8BEN or other applicable version of IRS Form W-8 certifying qualification for the reduced rate. If you are eligible for a reduced rate of U.S. withholding tax pursuant to an income tax treaty, you may obtain a refund of any excess amounts withheld by filing an appropriate claim for refund with the IRS. If you hold the stock through a financial institution or other agent acting on your behalf, you will be required to provide appropriate documentation to the agent, which then will be required to provide certification to us or our paying agent, either directly or through other intermediaries.

 

Dividends received by you that are effectively connected with your conduct of a U.S. trade or business (and, if required by an applicable income tax treaty, attributable to a permanent establishment maintained by you in the United States) are generally exempt from such withholding tax. In order to obtain this exemption, you must provide us with an IRS Form W-8ECI or other applicable version of IRS Form W-8 properly certifying such exemption. Such effectively connected dividends, although not subject to withholding tax, are taxed at the same graduated rates applicable to U.S. persons, net of certain deductions and credits. In addition, if you are a corporate non-U.S. holder, dividends you receive that are effectively connected with your conduct of a U.S. trade or business may also be subject to a branch profits tax at a rate of 30% or such lower rate as may be specified by an applicable income tax treaty.

 

Gain on Disposition of Common Stock

 

Subject to the discussion below regarding foreign accounts, you generally will not be required to pay U.S. federal income tax on any gain realized upon the sale or other disposition of our common stock unless:

 

•

the gain is effectively connected with your conduct of a U.S. trade or business (and, if required by an applicable income tax treaty, the gain is attributable to a permanent establishment maintained by you in the United States);

 

•

you are an individual who is present in the United States for a period or periods aggregating 183 days or more during a taxable year in which the sale or disposition occurs and certain other conditions are met; or

 

172

---

Table of Contents

•

our common stock constitutes a U.S. real property interest by reason of our status as a “United States real property holding corporation,” or USRPHC, for U.S. federal income tax purposes at any time within the shorter of the five-year period preceding your disposition of, or your holding period for, our common stock.

 

We believe that we are not currently and will not become a USRPHC. However, because the determination of whether we are a USRPHC depends on the fair market value of our U.S. real property relative to the fair market value of our other business assets, there can be no assurance that we will not become a USRPHC in the future. Even if we become a USRPHC, however, as long as our common stock is regularly traded on an established securities market, such common stock will be treated as U.S. real property interests only if you actually or constructively hold more than five percent of such regularly traded common stock at any time during the shorter of the five-year period preceding your disposition of, or your holding period for, our common stock.

 

If you are a non-U.S. holder described in the first bullet above, you will be required to pay tax on the net gain derived from the sale under regular graduated U.S. federal income tax rates, and a corporate non-U.S. holder described in the first bullet above also may be subject to the branch profits tax at a 30% rate, or such lower rate as may be specified by an applicable income tax treaty. If you are an individual non-U.S. holder described in the second bullet above, you will be required to pay a flat 30% tax on the gain derived from the sale. The amount of the gain subject to tax may be offset by U.S. source capital losses for the year. You should consult any applicable income tax or other treaties that may provide for different rules.

 

U.S. Federal Estate Tax

 

Our common stock beneficially owned by an individual who is not a citizen or resident of the United States (as defined for U.S. federal estate tax purposes) at the time of death will generally be includable in the decedent’s gross estate for U.S. federal estate tax purposes, unless an applicable estate tax treaty provides otherwise.

 

Backup Withholding and Information Reporting

 

Generally, we must report annually to the IRS the amount of dividends paid to you, your name and address, and the amount of tax withheld, if any. A similar report will be sent to you. Pursuant to applicable income tax treaties or other agreements, the IRS may make these reports available to tax authorities in your country of residence.

 

Payments of dividends or of proceeds on the disposition of stock made to you may be subject to information reporting and backup withholding at a current rate of 28% unless you establish an exemption, for example, by properly certifying your non-U.S. status on a Form W-8BEN or other applicable version of IRS Form W-8. Notwithstanding the foregoing, backup withholding and information reporting may apply if either we or our paying agent has actual knowledge, or reason to know, that you are a U.S. person.

 

Backup withholding is not an additional tax; rather, the U.S. income tax liability of persons subject to backup withholding will be reduced by the amount of tax withheld. If withholding results in an overpayment of taxes, a refund, or credit may generally be obtained from the IRS, provided that the required information is furnished to the IRS in a timely manner.

 

Foreign Accounts

 

A U.S. federal withholding tax of 30% may apply to dividends on, and the gross proceeds of a disposition of, our common stock, paid to a “foreign financial institution” (as specially defined under these rules), unless such institution enters into an agreement with the U.S. government to withhold on certain payments and to collect and provide to the U.S. tax authorities certain information regarding the U.S. account holders of such institution (which includes certain equity and debt holders of such institution, as well as certain account holders

 

173

---

Table of Contents

that are foreign entities with U.S. owners). A U.S. federal withholding tax of 30% may also generally apply to dividends and the gross proceeds of a disposition of our common stock paid to a non-financial foreign entity unless such entity provides the withholding agent with a certification identifying the direct and indirect U.S. owners of the entity (or certifying that it does not have any “substantial U.S. owners”). The withholding provisions described above generally apply to dividends paid on our common stock after June 30, 2014, and to the gross proceeds from the sale or other disposition of our common stock after December 31, 2016. Under certain circumstances, a non-U.S. holder might be eligible for refunds or credits of such taxes. Prospective investors are encouraged to consult with their own tax advisors regarding the possible implications of these foreign account rules on their investment in our common stock.

 

Each prospective investor should consult its own tax advisor regarding the particular U.S. federal, state and local and non-U.S. tax consequences of purchasing, holding and disposing of our common stock, including the consequences of any proposed change in applicable laws.

 

174

---

Table of Contents

UNDERWRITERS

 

Under the terms and subject to the conditions contained in an underwriting agreement dated the date of this prospectus, the underwriters named below, for whom Morgan Stanley & Co. LLC, Barclays Capital Inc., J.P. Morgan Securities LLC and Goldman, Sachs & Co. are acting as representatives, have severally agreed to purchase, and we have agreed to sell to them, severally, the number of shares indicated below:

 

Name		Number of Shares
Morgan Stanley & Co. LLC
Barclays Capital Inc.
J.P. Morgan Securities LLC
Goldman, Sachs & Co.
UBS Securities LLC
Deutsche Bank Securities Inc.
Citigroup Global Markets Inc.
Pacific Crest Securities LLC
Nomura Securities International, Inc.
Total:

 

The underwriters and the representatives are collectively referred to as the “underwriters” and the “representatives,” respectively. The underwriters are offering the shares of common stock subject to their acceptance of the shares from us and subject to prior sale. The underwriting agreement provides that the obligations of the several underwriters to pay for and accept delivery of the shares of common stock offered by this prospectus are subject to the approval of certain legal matters by their counsel and to certain other conditions. The underwriters are obligated to take and pay for all of the shares of common stock offered by this prospectus if any such shares are taken. However, the underwriters are not required to take or pay for the shares covered by the underwriters’ over-allotment option described below.

 

The underwriters initially propose to offer part of the shares of common stock directly to the public at the offering price listed on the cover page of this prospectus and part to certain dealers, at such offering price less a selling concession not in excess of $             per share. After the initial offering of the shares of common stock, the offering price, and other selling terms may from time to time be varied by the representatives. The offering of the shares by the underwriters is subject to receipt and acceptance and subject to the underwriters’ right to reject any order in whole or in part.

 

We have granted to the underwriters an option, exercisable for 30 days from the date of this prospectus, to purchase up to 2,100,000 additional shares of common stock at the public offering price listed on the cover page of this prospectus, less underwriting discounts and commissions. The underwriters may exercise this option solely for the purpose of covering over-allotments, if any, made in connection with the offering of the shares of common stock offered by this prospectus. To the extent the option is exercised, each underwriter will become obligated, subject to certain conditions, to purchase about the same percentage of the additional shares of common stock as the number listed next to the underwriter’s name in the preceding table bears to the total number of shares of common stock listed next to the names of all underwriters in the preceding table.

 

The following table shows the per share and total public offering price, underwriting discounts and commissions, and proceeds before expenses to us. These amounts are shown assuming both no exercise and full exercise of the underwriters’ over-allotment option to purchase up to an additional 2,100,000 shares of our common stock.

 

Total

Per Share

No Exercise

Full Exercise

Public offering price

$

$

$

Underwriting discounts and commissions paid by us

Proceeds, before expenses, to us

 

175

---

Table of Contents

The estimated offering expenses payable by us, exclusive of the underwriting discounts and commissions, are approximately $1.9 million, which includes legal, accounting and printing costs, and various other fees associated with the registration and listing of our common stock. We have agreed to reimburse the underwriters for certain FINRA related expenses incurred by them in connection with the offering, up to $                     as set forth in the underwriting agreement.

 

The underwriters have informed us that they do not intend sales to discretionary accounts to exceed 5% of the total number of shares of common stock offered by them.

 

Our common stock is listed on The NASDAQ Global Select Market under the trading symbol “FEYE.”

 

In connection with our initial public offering, we, all of our directors and executive officers, and the holders of substantially all of our common stock, or securities exercisable for or convertible into our common stock outstanding immediately prior to such offering agreed, subject to certain customary exceptions, not to offer, sell or agree to sell, directly or indirectly, any shares of common stock without the permission of the representatives of the underwriters for a period of 180 days from the date of our initial public offering. Morgan Stanley & Co. LLC and Goldman, Sachs & Co., on behalf of the underwriters, have consented to the release of these lock-up restrictions with respect to 8,417,785 shares of common stock to be sold in this offering by the selling stockholders, including certain of our directors, executive officers and employees. The release will take effect on the pricing of this offering.

 

We, all of our directors and officers, and certain holders of our common stock and securities exercisable for or convertible into our common stock outstanding immediately prior to this offering have agreed that, without the prior written consent of Morgan Stanley & Co. LLC and Goldman, Sachs & Co. on behalf of the underwriters, we and they will not, during the period ending 75 days after the date of this prospectus (the “restricted period”):

 

•

offer, pledge, sell, contract to sell, sell any option or contract to purchase, purchase any option or contract to sell, grant any option, right or warrant to purchase, lend or otherwise transfer or dispose of, directly or indirectly, any shares of common stock or any securities convertible into or exercisable or exchangeable for shares of common stock;

 

•

file any registration statement with the Securities and Exchange Commission relating to the offering of any shares of common stock or any securities convertible into or exercisable or exchangeable for common stock; or

 

•

enter into any swap or other arrangement that transfers to another, in whole or in part, any of the economic consequences of ownership of our common stock.

 

whether any such transaction described above is to be settled by delivery of common stock or such other securities, in cash or otherwise. In addition, we and each such person agrees that, without the prior written consent of Morgan Stanley & Co. LLC and Goldman, Sachs & Co. on behalf of the underwriters, we or such other person will not, during the restricted period, make any demand for, or exercise any right with respect to, the registration of any shares of common stock or any security convertible into or exercisable or exchangeable for common stock.

 

The restrictions described in the immediately preceding paragraph to do not apply to:

 

•

the sale of shares of common stock (including upon the exercise of options) pursuant to the terms of the underwriting agreement;

 

•

the transfer of shares of common stock or any securities convertible into or exercisable or exchangeable for common stock by a security holder (i) to an immediate family member or to a trust formed for the benefit of such security holder or of an immediate family member of such security holder, (ii) by bona fide gift, will or intestacy, (iii) if the security holder is a corporation, partnership, limited liability company or other business entity (A) to another corporation, partnership, limited

 

176

---

Table of Contents

liability company or other business entity that controls, is controlled by or is under common control with the security holder or (B) as part of a disposition, transfer or distribution by the security holder to its equity holders, or (iv) if the security holder is a trust, to a trustor or beneficiary of the trust; provided that in the case of any transfer or distribution pursuant to this clause (b), (i) each transferee, donee or distributee shall sign and deliver a lock-up agreement prior to or upon such transfer or distribution, and (ii) no filing under Section 16(a) of the Exchange Act, reporting a reduction of beneficial ownership of shares of common stock, shall be required or shall be voluntarily made during the restricted period;

 

•

(i) the issuance by us of shares of common stock upon the exercise of options, insofar as such option is outstanding as of the date of this prospectus, or (ii) the transfer of shares of common stock or any securities convertible into common stock to us upon a vesting event of our securities or upon the exercise of options or warrants to purchase our securities on a “cashless” or “net exercise” basis to cover tax withholding obligations of a security holder in connection with such vesting or exercise, provided that in the case of either (i) or (ii), no filing under Section 16(a) of the Exchange Act shall be required or shall be voluntarily made within 30 days after the date of this prospectus, and after such 30th day, any filing under Section 16(a) of the Exchange Act shall clearly indicate in the footnotes thereto that (a) the filing relates to the circumstances described in (i) or (ii), as the case may be, (b) no shares were sold by the reporting person and (c) in the case of (i), the shares received upon exercise of the option are subject to a lock-up agreement with the underwriters;

 

•

the transfer of shares of common stock or any security convertible into or exercisable or exchangeable for common stock to us pursuant to agreements under which the shares were issued and we have the option to repurchase such shares or securities or a right of first refusal with respect to transfers of such shares or securities, provided that no filing under Section 16(a) of the Exchange Act shall be required or shall be voluntarily made within 30 days after the date of this prospectus, and after such 30th day, any filing under Section 16(a) of the Exchange Act shall clearly indicate in the footnotes thereto that (i) the filing relates to the transfer of such shares or securities to us pursuant to such repurchase option or right of first refusal, as the case may be, and (b) no shares were sold by the reporting person;

 

•

the establishment of a trading plan pursuant to Rule 10b5-1 under the Exchange Act for the transfer of shares of common stock, provided that (i) such plan does not provide for the transfer of common stock during the restricted period and (ii) to the extent a public announcement or filing under the Exchange Act, if any, is required of or voluntarily made by or on behalf of the security holder or us regarding the establishment of such plan, such announcement or filing shall include a statement to the effect that no transfer of common stock may be made under such plan during the restricted period;

 

•

the transfer of shares of common stock or any security convertible into or exercisable or exchangeable for common stock that occurs solely by operation of law or by order of a court of competent jurisdiction, provided that the transferee shall sign and deliver a lock-up agreement; and

 

•

the disposition by a security holder of shares of common stock purchased from us pursuant to any employee stock purchase plan described in this prospectus after completion of this offering, provided that no filing under Section 16(a) of the Exchange Act shall be required or shall be voluntarily made on or before May 15, 2014.

 

Morgan Stanley & Co. LLC and Goldman, Sachs & Co. in their sole discretion may release the common stock and other securities subject to the lock-up agreements described above in whole or in part at any time with or without notice.

 

In order to facilitate the offering of the common stock, the underwriters may engage in transactions that stabilize, maintain, or otherwise affect the price of the common stock. Specifically, the underwriters may sell more shares than they are obligated to purchase under the underwriting agreement, creating a short position. A short sale is covered if the short position is no greater than the number of shares available for purchase by the underwriters under the over-allotment option. The underwriters can close out a covered short sale by exercising the over-allotment option or purchasing shares in the open market. In determining the source of shares to close out a covered

 

177

---

Table of Contents

short sale, the underwriters will consider, among other things, the open market price of shares compared to the price available under the over-allotment option. The underwriters may also sell shares in excess of the over-allotment option, creating a naked short position. The underwriters must close out any naked short position by purchasing shares in the open market. A naked short position is more likely to be created if the underwriters are concerned that there may be downward pressure on the price of the common stock in the open market after pricing that could adversely affect investors who purchase in this offering. As an additional means of facilitating this offering, the underwriters may bid for, and purchase, shares of common stock in the open market to stabilize the price of the common stock. The underwriters may also impose a penalty bid. This occurs when a particular underwriter repays to the underwriters a portion of the underwriting discount received by it because the representatives have repurchased shares sold by or for the account of such underwriter in stabilizing or short covering transactions.

 

These activities may raise or maintain the market price of the common stock above independent market levels or prevent or retard a decline in the market price of the common stock. The underwriters are not required to engage in these activities and may end any of these activities at any time.

 

We and the underwriters have agreed to indemnify each other against certain liabilities, including liabilities under the Securities Act.

 

A prospectus in electronic format may be made available on Websites maintained by one or more underwriters, or selling group members, if any, participating in this offering. The representatives may agree to allocate a number of shares of common stock to underwriters for sale to their online brokerage account holders. Internet distributions will be allocated by the representatives to underwriters that may make Internet distributions on the same basis as other allocations.

 

Goldman Sachs Bank USA, an affiliate of Goldman, Sachs & Co., has entered into a term (committed loan) loan agreement with Ashar Aziz, our Vice Chairman of the Board, Chief Technology Officer and Chief Strategy Officer, individually and as trustee of the Ashar Aziz Family Trust, or the Trust. Under the loan agreement, Goldman Sachs Bank USA has agreed to make loans up to an aggregate amount of $10 million to Mr. Aziz and the Trust, subject to certain conditions. As of February 28, 2014, a total of $9,999,500 was outstanding under the loan. Goldman Sachs Bank USA received customary fees and expense reimbursements in connection with this loan. As a regulated entity, Goldman Sachs Bank USA makes decisions regarding making and managing its loans independent of Goldman, Sachs & Co. This loan is secured under a security and pledge agreement by a pledge of all of the shares of our common stock currently owned by Mr. Aziz and the Trust. We are not a party to the loan or the security and pledge agreement. The terms of this loan were negotiated directly between Mr. Aziz and Goldman Sachs Bank USA. Subject to certain narrow exceptions (e.g. personal bankruptcy), the maturity date of the loan is the earliest to occur of (i) June 30, 2014 and (ii) the later of (A) the date that is 10 days after the expiration of the 180-day lockup period following the completion of our initial public offering or (B) if the shares pledged as security are then subject to limitation on public sale pursuant to our insider trading policy, the date on which such limitation expires. In the case of nonpayment or another event of default (including but not limited to the inability to satisfy any margin call in the event of a significant decline in our common stock price), Goldman Sachs Bank USA may exercise its rights under the loan agreements to obtain or sell shares pledged to cover the amount due under the loan. The lock-up agreements between the underwriters and Mr. Aziz includes an exception to allow for the transfer of shares of our common stock held by Mr. Aziz to Goldman Sachs Bank USA (or its assigns or affiliates) in connection with the exercise of its rights under the security and pledge agreement. Goldman Sachs Bank USA has agreed with us, Mr. Aziz and certain stockholders that any pledged shares acquired from Mr. Aziz upon foreclosure during the 180 days following the completion of our initial public offering will remain subject to the terms of the underwriter lock-up agreement until the expiration of such 180-day period. Any transfers or sales of such common stock to satisfy the obligations under the loan agreement may cause the price of our common stock to decline. Goldman Sachs Bank USA and Goldman, Sachs & Co. have both executed a lock-up agreement with respect to all of the shares pledged by Mr. Aziz and the Trust in connection with the loan agreement, whereby they have agreed that, to the extent any such shares are acquired or beneficially owned by Goldman Sachs Bank USA or Goldman, Sachs & Co., such shares shall not be sold during

 

178

---

Table of Contents

the offering, or sold, transferred, assigned, pledged, or hypothecated, or be the subject of any hedging, short sale, derivative, put, or call transaction that would result in the effective economic disposition of the securities by any person for a period of 180 days immediately following the date of effectiveness or commencement of sales of our initial public offering, subject to the exceptions provided in FINRA Rule 5110(g)(2).

 

In January 2013, GS Direct, L.L.C., an affiliate of Goldman, Sachs & Co., purchased 403,631 shares of our Series F preferred stock at a purchase price per share of approximately $10.53 in our Series F preferred stock financing. All such shares are subject to the 180-day lock-up restrictions described above. These 403,631 shares are considered underwriting compensation and are therefore subject to certain lock-up restrictions pursuant to FINRA Rule 5110(g)(1). GS Direct, L.L.C. and Goldman, Sachs & Co. have also both executed a lock-up agreement with respect to the 403,631 shares purchased by GS Direct, L.L.C., whereby they have agreed such shares shall not be sold during the offering, or sold, transferred, assigned, pledged, or hypothecated, or be the subject of any hedging, short sale, derivative, put, or call transaction that would result in the effective economic disposition of the securities by any person for a period of 180 days immediately following the date of effectiveness or commencement of sales of our initial public offering, subject to the exceptions provided in FINRA Rule 5110(g)(2).

 

J.P. Morgan Securities LLC is an affiliate of both One Equity Partners IV, L.P. and OEP II Partners Co-Invest, L.P., or the OEP Entities, through the common control of a shared parent company, J.P. Morgan Chase & Co. The OEP entities intend to offer for sale up to an aggregate of 391,434 shares of our common stock in this offering.

 

Selling Restrictions

 

European Economic Area

 

In relation to each Member State of the European Economic Area which has implemented the Prospectus Directive (each, a “Relevant Member State”), an offer to the public of any shares of our common stock may not be made in that Relevant Member State, except that an offer to the public in that Relevant Member State of any shares of our common stock may be made at any time under the following exemptions under the Prospectus Directive, if they have been implemented in that Relevant Member State:

 

•

to any legal entity which is a qualified investor as defined in the Prospectus Directive;

 

•

to fewer than 100 or, if the Relevant Member State has implemented the relevant provision of the 2010 PD Amending Directive, 150, natural or legal persons (other than qualified investors as defined in the Prospectus Directive), as permitted under the Prospectus Directive, subject to obtaining the prior consent of the representatives for any such offer; or

 

•

in any other circumstances falling within Article 3(2) of the Prospectus Directive, provided that no such offer of shares of our common stock shall result in a requirement for the publication by us or any underwriter of a prospectus pursuant to Article 3 of the Prospectus Directive.

 

For the purposes of this provision, the expression an “offer to the public” in relation to any shares of our common stock in any Relevant Member State means the communication in any form and by any means of sufficient information on the terms of the offer and any shares of our common stock to be offered so as to enable an investor to decide to purchase any shares of our common stock, as the same may be varied in that Member State by any measure implementing the Prospectus Directive in that Member State, the expression “Prospectus Directive” means Directive 2003/71/EC (and amendments thereto, including the 2010 PD Amending Directive, to the extent implemented in the Relevant Member State), and includes any relevant implementing measure in the Relevant Member State, and the expression “2010 PD Amending Directive” means Directive 2010/73/EU.

 

179

---

Table of Contents

United Kingdom

 

Each underwriter has represented and agreed that:

 

•

it has only communicated or caused to be communicated and will only communicate or cause to be communicated an invitation or inducement to engage in investment activity (within the meaning of Section 21 of the Financial Services and Markets Act 2000, as amended (the “FSMA”)) received by it in connection with the issue or sale of the shares of our common stock in circumstances in which Section 21(1) of the FSMA does not apply to us; and

 

•

it has complied and will comply with all applicable provisions of the FSMA with respect to anything done by it in relation to the shares of our common stock in, from or otherwise involving the United Kingdom.

 

Hong Kong

 

The shares may not be offered or sold by means of any document other than (i) in circumstances which do not constitute an offer to the public within the meaning of the Companies Ordinance (Cap.32, Laws of Hong Kong), or (ii) to “professional investors” within the meaning of the Securities and Futures Ordinance (Cap.571, Laws of Hong Kong) and any rules made thereunder, or (iii) in other circumstances which do not result in the document being a “prospectus” within the meaning of the Companies Ordinance (Cap.32, Laws of Hong Kong), and no advertisement, invitation, or document relating to the shares may be issued or may be in the possession of any person for the purpose of issue (in each case whether in Hong Kong or elsewhere), which is directed at, or the contents of which are likely to be accessed or read by, the public in Hong Kong (except if permitted to do so under the laws of Hong Kong) other than with respect to shares which are or are intended to be disposed of only to persons outside Hong Kong or only to “professional investors” within the meaning of the Securities and Futures Ordinance (Cap. 571, Laws of Hong Kong) and any rules made thereunder.

 

Singapore

 

This prospectus has not been registered as a prospectus with the Monetary Authority of Singapore. Accordingly, this prospectus and any other document or material in connection with the offer or sale, or invitation for subscription or purchase, of the shares may not be circulated or distributed, nor may the shares be offered or sold, or be made the subject of an invitation for subscription or purchase, whether directly or indirectly, to persons in Singapore other than (i) to an institutional investor under Section 274 of the Securities and Futures Act, Chapter 289 of Singapore (the “SFA”), (ii) to a relevant person, or any person pursuant to Section 275(1A), and in accordance with the conditions, specified in Section 275 of the SFA, or (iii) otherwise pursuant to, and in accordance with the conditions of, any other applicable provision of the SFA.

 

Where the shares are subscribed or purchased under Section 275 by a relevant person which is: (a) a corporation (which is not an accredited investor) the sole business of which is to hold investments and the entire share capital of which is owned by one or more individuals, each of whom is an accredited investor; or (b) a trust (where the trustee is not an accredited investor) whose sole purpose is to hold investments and each beneficiary is an accredited investor, shares, debentures and units of shares, and debentures of that corporation, or the beneficiaries’ rights and interest in that trust shall not be transferable for six months after that corporation or that trust has acquired the shares under Section 275 except: (1) to an institutional investor under Section 274 of the SFA or to a relevant person, or any person pursuant to Section 275(1A), and in accordance with the conditions, specified in Section 275 of the SFA; (2) where no consideration is given for the transfer; or (3) by operation of law.

 

Japan

 

The securities have not been and will not be registered under the Financial Instruments and Exchange Law of Japan (the Financial Instruments and Exchange Law) and each underwriter has agreed that it will not offer or sell any securities, directly or indirectly, in Japan or to, or for the benefit of, any resident of Japan (which term as used

 

180

---

Table of Contents

herein means any person resident in Japan, including any corporation or other entity organized under the laws of Japan), or to others for re-offering or resale, directly or indirectly, in Japan or to a resident of Japan, except pursuant to an exemption from the registration requirements of, and otherwise in compliance with, the Financial Instruments and Exchange Law and any other applicable laws, regulations and ministerial guidelines of Japan.

 

Notice to Prospective Investors in Switzerland

 

The shares may not be publicly offered in Switzerland and will not be listed on the SIX Swiss Exchange (“SIX”) or on any other stock exchange or regulated trading facility in Switzerland. This document has been prepared without regard to the disclosure standards for issuance prospectuses under art. 652a or art. 1156 of the Swiss Code of Obligations or the disclosure standards for listing prospectuses under art. 27 ff. of the SIX Listing Rules or the listing rules of any other stock exchange or regulated trading facility in Switzerland. Neither this document nor any other offering or marketing material relating to the shares or the offering may be publicly distributed or otherwise made publicly available in Switzerland.

 

Neither this document nor any other offering or marketing material relating to the offering, the Company, the shares have been or will be filed with or approved by any Swiss regulatory authority. In particular, this document will not be filed with, and the offer of shares will not be supervised by, the Swiss Financial Market Supervisory Authority FINMA (FINMA), and the offer of shares has not been and will not be authorized under the Swiss Federal Act on Collective Investment Schemes (“CISA”). The investor protection afforded to acquirers of interests in collective investment schemes under the CISA does not extend to acquirers of shares.

 

Notice to Prospective Investors in the Dubai International Financial Centre

 

This prospectus relates to an Exempt Offer in accordance with the Offered Securities Rules of the Dubai Financial Services Authority (“DFSA”). This prospectus is intended for distribution only to persons of a type specified in the Offered Securities Rules of the DFSA. It must not be delivered to, or relied on by, any other person. The DFSA has no responsibility for reviewing or verifying any documents in connection with Exempt Offers. The DFSA has not approved this prospectus nor taken steps to verify the information set forth herein and has no responsibility for the prospectus. The shares to which this prospectus relates may be illiquid and/or subject to restrictions on their resale. Prospective purchasers of the shares offered should conduct their own due diligence on the shares. If you do not understand the contents of this prospectus you should consult an authorized financial advisor.

 

Notice to Prospective Investors in Australia

 

No placement document, prospectus, product disclosure statement or other disclosure document has been lodged with the Australian Securities and Investments Commission (“ASIC”), in relation to the offering. This prospectus does not constitute a prospectus, product disclosure statement or other disclosure document under the Corporations Act 2001 (the “Corporations Act”), and does not purport to include the information required for a prospectus, product disclosure statement or other disclosure document under the Corporations Act.

 

Any offer in Australia of the shares may only be made to persons (the “Exempt Investors”) who are “sophisticated investors” (within the meaning of section 708(8) of the Corporations Act), “professional investors” (within the meaning of section 708(11) of the Corporations Act) or otherwise pursuant to one or more exemptions contained in section 708 of the Corporations Act so that it is lawful to offer the shares without disclosure to investors under Chapter 6D of the Corporations Act.

 

The shares applied for by Exempt Investors in Australia must not be offered for sale in Australia in the period of 12 months after the date of allotment under the offering, except in circumstances where disclosure to investors under Chapter 6D of the Corporations Act would not be required pursuant to an exemption under

 

181

---

Table of Contents

section 708 of the Corporations Act or otherwise or where the offer is pursuant to a disclosure document which complies with Chapter 6D of the Corporations Act. Any person acquiring shares must observe such Australian on-sale restrictions.

 

This prospectus contains general information only and does not take account of the investment objectives, financial situation or particular needs of any particular person. It does not contain any securities recommendations or financial product advice. Before making an investment decision, investors need to consider whether the information in this prospectus is appropriate to their needs, objectives and circumstances, and, if necessary, seek expert advice on those matters.

 

182

---

Table of Contents

LEGAL MATTERS

 

The validity of the shares of common stock offered hereby will be passed upon for us by Wilson Sonsini Goodrich & Rosati, Professional Corporation, Palo Alto, California. Cooley LLP, Palo Alto, California, is acting as counsel to the underwriters in connection with this offering.

 

EXPERTS

 

The consolidated financial statements of FireEye, Inc. as of December 31, 2012 and 2013, and for each of the three years in the period ended December 31, 2013, appearing in this prospectus and registration statement have been audited by Deloitte & Touche LLP, independent registered public accounting firm, as stated in its report appearing herein. Such financial statements are included in reliance upon the report of such firm given upon its authority as an expert in accounting and auditing.

 

The consolidated financial statements of Mandiant Corporation as of December 31, 2011 and 2012, and for each of the two years in the period ended December 31, 2012, appearing in this prospectus and registration statement have been audited by PricewaterhouseCoopers LLP, independent accountants, as stated in its report appearing herein. Such financial statements are included in reliance upon the report of such firm given upon its authority as an expert in accounting and auditing.

 

WHERE YOU CAN FIND ADDITIONAL INFORMATION

 

We have filed with the SEC a registration statement on Form S-1 under the Securities Act with respect to the shares of common stock offered by this prospectus. This prospectus, which constitutes a part of the registration statement, does not contain all of the information set forth in the registration statement, some of which is contained in exhibits to the registration statement as permitted by the rules and regulations of the SEC. For further information with respect to us and our common stock, we refer you to the registration statement, including the exhibits filed as a part of the registration statement. Statements contained in this prospectus concerning the contents of any contract or any other document is not necessarily complete. If a contract or document has been filed as an exhibit to the registration statement, please see the copy of the contract or document that has been filed. Each statement in this prospectus relating to a contract or document filed as an exhibit is qualified in all respects by the filed exhibit. You may obtain copies of this information by mail from the Public Reference Section of the SEC, 100 F Street, N.E., Room 1580, Washington, D.C. 20549, at prescribed rates. You may obtain information on the operation of the public reference rooms by calling the SEC at 1-800-SEC-0330. The SEC also maintains an Internet Website that contains reports, proxy statements, and other information about issuers, like us, that file electronically with the SEC. The address of that Website is www.sec.gov.

 

We are subject to the information and reporting requirements of the Securities Exchange Act of 1934 and, in accordance with this law, are required to file periodic reports, proxy statements, and other information with the SEC. These periodic reports, proxy statements, and other information are available for inspection and copying at the SEC’s public reference facilities and the Website of the SEC referred to above. We also maintain a Website at www.fireeye.com. You may access these materials free of charge as soon as reasonably practicable after they are electronically filed with, or furnished to, the SEC. Information contained on our Website is not a part of this prospectus and the inclusion of our Website address in this prospectus is an inactive textual reference only.

 

183

---

Table of Contents

INDEX TO CONSOLIDATED FINANCIAL STATEMENTS

 

FIREEYE, INC.
Report of Independent Registered Public Accounting Firm			F-2
Consolidated Balance Sheets			F-3
Consolidated Statements of Operations			F-4
Consolidated Statements of Stockholders’ Equity (Deficit)			F-5
Consolidated Statements of Cash Flows			F-6
Notes to Consolidated Financial Statements			F-7
MANDIANT CORPORATION
Independent Auditor’s Report			F-40
Consolidated Balance Sheets			F-41
Consolidated Statements of Comprehensive Income			F-42
Consolidated Statements of Stockholders’ Equity			F-43
Consolidated Statements of Cash Flows			F-44
Notes to Consolidated Financial Statements			F-45

 

INDEX TO UNAUDITED PRO FORMA CONDENSED COMBINED FINANCIAL STATEMENTS

 

Unaudited Pro Forma Condensed Combined Statement of Operations			F-63
Notes to Unaudited Pro Forma Condensed Combined Financial Statements			F-64

 

F-1

---

Table of Contents

REPORT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTING FIRM

 

The Board of Directors and Stockholders:

FireEye, Inc.

Milpitas, California

 

We have audited the accompanying consolidated balance sheets of FireEye, Inc. and its subsidiaries (the “Company”) as of December 31, 2012 and 2013, and the related consolidated statements of operations, stockholders’ equity (deficit) and cash flows for each of the three years in the period ended December 31, 2013. These financial statements are the responsibility of the Company’s management. Our responsibility is to express an opinion on these financial statements based on our audits.

 

We conducted our audits in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. The Company is not required to have, nor were we engaged to perform an audit of its internal control over financial reporting. Our audits included consideration of internal control over financial reporting as a basis for designing audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the Company’s internal control over financial reporting. Accordingly, we express no such opinion. An audit also includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements, assessing the accounting principles used and significant estimates made by management, and evaluating the overall financial statement presentation. We believe that our audits provide a reasonable basis for our opinion.

 

In our opinion, such consolidated financial statements referred to above present fairly, in all material respects, the consolidated financial position of FireEye, Inc. and subsidiaries as of December 31, 2012 and 2013, and the consolidated results of their operations and their cash flows for each of the three years in the period ended December 31, 2013, in conformity with accounting principles generally accepted in the United States of America.

 

/s/ DELOITTE & TOUCHE LLP

 

San Jose, California

March 2, 2014

 

F-2

---

Table of Contents

FIREEYE, INC.

 

Consolidated Balance Sheets

(In thousands, except per share data)

 

		As of December 31,
		2012				2013
ASSETS
Current assets:
Cash and cash equivalents		$	60,200			$	173,918
Accounts receivable			30,133				95,772
Inventories			2,340				5,663
Deferred costs of revenue, current portion			837				2,030
Deferred tax assets, current portion			—				14,584
Prepaid expenses and other current assets			10,731				23,200
Total current assets			104,241				315,167
Deferred costs of revenue, non-current portion			674				1,071
Property and equipment, net			13,536				64,765
Goodwill			1,274				706,327
Intangible assets			4,194				281,377
Deposits and other long-term assets			1,354				7,606
TOTAL ASSETS		$	125,273			$	1,376,313
LIABILITIES AND STOCKHOLDERS’ EQUITY
Current liabilities:
Accounts payable		$	15,653				34,128
Accrued liabilities			1,174				9,489
Accrued compensation			8,271				41,625
Long-term debt, current portion			1,231				—
Proceeds from early exercise of stock awards			2,001				8,188
Deferred revenue, current portion			43,750				110,535
Total current liabilities			72,080				203,965
Long-term debt, non-current portion			10,916				—
Deferred revenue, non-current portion			32,656				76,979
Preferred stock warrant liability			3,529				—
Deferred tax liabilities, non-current portion			—				45,147
Other long-term liabilities			702				2,120
Total liabilities			119,883				328,211
Commitments and contingencies (Note 7)
Stockholders’ equity:
Convertible preferred stock, par value of $0.0001 per share; 65,326 shares authorized, 64,115 issued and outstanding with liquidation preference of $96,746 as of December 31, 2012; 100,000 shares authorized, none issued and outstanding as of December 31, 2013			6				—
Common stock, par value of $0.0001 per share; 130,000 shares authorized, 22,435 shares issued and outstanding as of December 31, 2012; 1,000,000 shares authorized, 137,758 shares issued and outstanding as of December 31, 2013			2				14
Additional paid-in capital			109,252				1,271,590
Notes receivable from stockholders			(1,003	)			—
Accumulated deficit			(102,867	)			(223,502	)
Total stockholders’ equity			5,390				1,048,102
TOTAL LIABILITIES AND STOCKHOLDERS’ EQUITY		$	125,273			$	1,376,313

 

See notes to these consolidated financial statements.

 

F-3

---

Table of Contents

FIREEYE, INC.

 

Consolidated Statements of Operations

(In thousands, except per share data)

 

		Year Ended December 31,
		2011				2012				2013
Revenue:
Product		$	24,888			$	52,265			$	88,253
Subscription and services			8,770				31,051				73,299
Total revenue			33,658				83,316				161,552
Cost of revenue:
Product			5,690				14,467				28,912
Subscription and services			1,590				3,163				18,853
Total cost of revenue			7,280				17,630				47,765
Total gross profit			26,378				65,686				113,787
Operating expenses:
Research and development			7,275				16,522				66,036
Sales and marketing			30,389				67,562				167,466
General and administrative			4,428				15,221				52,503
Total operating expenses			42,092				99,305				286,005
Operating loss			(15,714	)			(33,619	)			(172,218	)
Interest income			3				7				68
Interest expense			(194	)			(537	)			(525	)
Other expense, net			(806	)			(2,572	)			(7,257	)
Loss before income taxes			(16,711	)			(36,721	)			(179,932	)
Provision for (benefit from) income taxes			71				(965	)			(59,297	)
Net loss attributable to common stockholders		$	(16,782	)		$	(35,756	)		$	(120,635	)
Net loss per share attributable to common stockholders, basic and diluted		$	(1.99	)		$	(3.28	)		$	(2.66	)
Weighted-average shares used to compute net loss per share attributable to common stockholders, basic and diluted			8,447				10,917				45,271

 

See notes to these consolidated financial statements.

 

F-4

---

Table of Contents

FIREEYE, INC.

 

Consolidated Statements of Stockholders’ Equity (Deficit)

(In thousands)

 

		Convertible Preferred Stock								Common Stock								Additional Paid-In Capital				Notes Receivable  from Stockholders				Accumulated Deficit				Total Stockholders’ Equity (Deficit)
		Shares				Amount				Shares				Amount
Balance as of December 31, 2010			59,841				5				9,761				1				51,671				—				(50,329	)			1,348
Additional issuance cost of Series E convertible preferred stock			—				—				—				—				(3	)			—				—				(3	)
Issuances of common stock upon stock option exercises			—				—				816				—				62				—				—				62
Issuance of restricted stock			—				—				1,220				—				—				—				—				—
Vesting of stock options exercised with notes receivable			—				—				—				—				144				(144	)			—				—
Accrued interest for notes receivable from stockholders			—				—				—				—				7				(7	)			—				—
Vesting of early exercise of equity awards			—				—				—				—				9				—				—				9
Stock-based compensation			—				—				—				—				715				—				—				715
Net loss and total comprehensive loss																											(16,782	)			(16,782	)
Balance as of December 31, 2011			59,841				5				11,797				1				52,605				(151	)			(67,111	)			(14,651	)
Net proceeds from issuance of Series F convertible preferred stock			4,274				1				—				—				44,778				—				—				44,779
Issuance of common stock related to Tall Maple Systems, Inc. acquisition			—				—				150				—				816				—				—				816
Issuance of common stock related to Ensighta Security, Inc. acquisition			—				—				423				—				2,300				—				—				2,300
Issuance of common stock upon stock option exercises with notes receivable			—				—				4,260				—				—				—				—				—
Vesting of stock options exercised with notes receivable			—				—				—				1				816				(817	)			—				—
Issuances of common stock upon stock option exercises			—				—				3,212				—				716				—				—				716
Accrued interest for notes receivable from stockholders			—				—				—				—				35				(35	)			—				—
Issuance of restricted stock			—				—				2,686				—				—				—				—				—
Repurchase of unvested restricted common stock			—				—				(93	)			—				(214	)			—				—				(214	)
Vesting of early exercise of equity awards			—				—				—				—				557				—				—				557
Stock-based compensation			—				—				—				—				6,843				—				—				6,843
Net loss and total comprehensive loss																											(35,756	)			(35,756	)
Balance as of December 31, 2012			64,115			$	6				22,435			$	2			$	109,252			$	(1,003	)		$	(102,867	)		$	5,390
Issuance of common stock in connection with initial public offering, net of offering costs			—				—				17,450				2				320,977				—				—				320,979
Conversion of convertible preferred stock to common stock in connection with initial public offering			(64,590	)			(6	)			74,222				7				(1	)			—				—				—
Conversion of preferred stock warrant to common stock in connection with initial public offering			—				—				—				—				10,067				—				—				10,067
Issuance of common stock related to the acquisition of Secure DNA Managed Services, Inc.			—				—				50				—				800				—				—				800
Issuance of common stock related to the acquisition of Mandiant, Inc.			—				—				16,921				2				791,115				—				—				791,117
Payment of note receivables from stockholder, net of early exercises			—				—				—				—				828				1,003				—				1,831
Net proceeds from issuance of Series F convertible preferred stock			475				—				—				—				4,994				—				—				4,994
Issuance of common stock for equity awards, net of repurchases			—				—				6,680				1				2,393				—				—				2,394
Vesting of early exercise of equity awards			—				—				—				—				2,307				—				—				2,307
Stock-based compensation			—				—				—				—				28,858				—				—				28,858
Net loss and total comprehensive loss			—				—				—				—				—				—				(120,635	)			(120,635	)
Balance as of December 31, 2013			—			$	—				137,758			$	14			$	1,271,590			$	—			$	(223,502	)		$	1,048,102

 

See notes to these consolidated financial statements.

 

F-5

---

Table of Contents

FIREEYE, INC.

 

Consolidated Statements of Cash Flows

(In thousands)

 

		Year Ended December 31,
		2011				2012				2013
CASH FLOWS FROM OPERATING ACTIVITIES:
Net loss		$	(16,782	)		$	(35,756	)		$	(120,635	)
Adjustments to reconcile net loss to net cash provided by (used in) operating activities:
Depreciation and amortization			3,272				6,917				20,758
Stock-based compensation expense			715				6,843				28,858
Change in fair value of preferred stock warrant liability			805				2,535				6,538
Loss on disposal of property and equipment			201				197				110
Release of deferred tax valuation allowance			—				(1,241	)			(61,028	)
Changes in operating assets and liabilities, net of assets acquired and liabilities assumed in business combinations:
Accounts receivable, net			(13,540	)			(10,106	)			(35,145	)
Inventories			(658	)			(817	)			(3,089	)
Prepaid expenses and other assets			(187	)			(3,084	)			(15,629	)
Deferred costs of revenue			(742	)			(669	)			(1,590	)
Accounts payable			5,400				6,189				11,504
Accrued liabilities			284				511				(18,488	)
Accrued compensation			2,446				3,165				19,381
Deferred revenue			23,836				46,303				95,010
Other long-term liabilities			61				513				3,683
Net cash provided by (used in) operating activities			5,111				21,500				(69,762	)
CASH FLOWS FROM INVESTING ACTIVITIES:
Acquisition of business, net of cash acquired			—				(889	)			(89,240	)
Purchase of property and equipment and demonstration units			(5,217	)			(18,848	)			(57,560	)
Lease deposits			(7	)			(478	)			(1,669	)
Net cash used in investing activities			(5,224	)			(20,215	)			(148,469	)
CASH FLOWS FROM FINANCING ACTIVITIES:
Net proceeds from initial public offering			—				—				321,389
Borrowing from line of credit			2,381				7,619				10,000
Repayment of line of credit			(2,322	)			—				(20,000	)
Borrowing of term loan			2,750				—				—
Repayment of term loan			(557	)			(1,405	)			(2,150	)
Net proceeds from issuance of convertible preferred stock			(3	)			39,785				9,988
Proceeds from exercise of equity awards			875				2,454				5,428
Repayment of notes receivable from stockholders			—				—				7,294
Repurchase of common stock			—				(214	)			—
Net cash provided by financing activities			3,124				48,239				331,949
Net change in cash and cash equivalents			3,011				49,524				113,718
Cash and cash equivalents, beginning of year			7,665				10,676				60,200
Cash and cash equivalents, end of year		$	10,676			$	60,200			$	173,918
SUPPLEMENTAL DISCLOSURE OF CASH FLOW INFORMATION:
Cash paid for income taxes		$	2			$	22			$	474
Cash paid for interest		$	194			$	508			$	578
SUPPLEMENTAL DISCLOSURE OF NONCASH INVESTING AND FINANCING ACTIVITIES:
Deferred initial public offering costs in accounts payable and accrued liabilities		$	—			$	—			$	412
Common stock issued in connection with acquisitions		$	—			$	3,116			$	791,917
Conversion of preferred stock warrants to common stock warrants		$	—			$	—			$	10,067
Purchases of property and equipment and demonstration units in accounts payable		$	117			$	2,874			$	6,435
Proceeds receivable from issuance of convertible preferred stock		$	—			$	4,994			$	—

 

 

See notes to consolidated financial statements.

 

F-6

---

Table of Contents

FIREEYE, INC.

Notes to Consolidated Financial Statements

 

1. Description of Business and Summary of Significant Accounting Policies

 

Description of Business

 

FireEye, Inc., with principal executive offices located in Milpitas, California, was incorporated as NetForts, Inc. on February 18, 2004, under the laws of the State of Delaware, and changed its name to FireEye, Inc. on September 7, 2005.

 

FireEye, Inc. and its wholly owned subsidiaries (collectively, the “Company”, “we”, “us” or “our”) is a leader in stopping advanced cyber attacks that use advanced malware, zero-day exploits, and APT (“Advanced Persistent Threat”) tactics. Our solutions supplement traditional and next-generation firewalls, IPS (“Intrusion Prevention Systems”), anti-virus, and gateways, which cannot stop advanced threats, leaving security holes in networks. We offer a solution that detects and blocks attacks across both Web and email threat vectors as well as latent malware resident on file shares. Our solutions address all stages of an attack lifecycle with a signature-less engine utilizing stateful attack analysis to detect zero-day threats.

 

In September 2013, we completed our initial public offering (“IPO”) in which we issued and sold 17,450,000 shares of common stock (inclusive of 2,275,000 shares of common stock from the full exercise of the over-allotment option granted to the underwriters) at a price of $20.00 per share. We received aggregate proceeds of $324.6 million from the sale of shares of common stock, net of underwriters’ discounts and commissions, but before deducting paid and unpaid offering expenses of approximately $3.6 million. Immediately prior to the closing of the IPO, all shares of our outstanding convertible preferred stock automatically converted into 74,221,533 shares of common stock.

 

We sell the majority of our products, subscriptions and services to end-customers through distributors, resellers, and strategic partners, with a lesser percentage of sales directly to end-customers.

 

Basis of Presentation and Consolidation

 

The consolidated financial statements include the accounts of FireEye, Inc. and its wholly owned subsidiaries and have been prepared in conformity with accounting principles generally accepted in the United States of America (“U.S. GAAP”). All intercompany balances and transactions have been eliminated in consolidation.

 

Use of Estimates

 

The preparation of consolidated financial statements in conformity U.S. GAAP requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities and disclosure of contingent assets and liabilities at the date of the consolidated financial statements and the reported amounts of revenue and expenses during the reporting period. Such management estimates include, but are not limited to, the best estimate of selling price for our products and services, commissions expense, future taxable income, contract manufacturer liabilities, litigation and settlement costs and other loss contingencies, fair value of our common and preferred stock, stock options and preferred stock warrant liability, and the purchase price allocation of acquired businesses. We base our estimates on historical experience and also on assumptions that we believe are reasonable. Changes in facts or circumstances may cause us to change our assumptions and estimates in future periods, and it is possible that actual results could differ from current or revised future estimates.

 

F-7

---

Table of Contents

Concentrations

 

Financial instruments that subject us to concentrations of credit risk consist primarily of cash, cash equivalents, and accounts receivable. We maintain a substantial portion of our cash and cash equivalents in money market funds invested in U.S. Treasury related obligations. Management believes that the financial institutions that hold our investments are financially sound and, accordingly, are subject to minimal credit risk. Deposits held with banks may exceed the amount of insurance provided on such deposits.

 

Our accounts receivables are primarily derived from our customers representing various geographical locations. We perform ongoing credit evaluations of our customers and generally do not require collateral on accounts receivable. We maintain an allowance for doubtful accounts for estimated potential credit losses.

 

Summarized below are individual customers whose revenue or account receivable balances were 10% or higher than the respective total consolidated amounts:

 

		Year Ended December 31,
		2011				2012				2013
Percentage of Revenue:
Accuvant			12	%			10	%			11	%
Carahsoft Technology Corporation			*				*				11	%

 

		At December 31,
		2012				2013
Percentage of Accounts Receivable:
Accuvant			14	%			12	%
Scalar Decisions			10	%			*

 

*

Less than 10%

 

We rely primarily on a single contract manufacturer to assemble our products. In some cases we rely on sole suppliers for a certain number of our components.

 

Foreign Currency Translation and Transactions

 

The functional currency of our foreign subsidiaries is the U.S. dollar. We translate all monetary assets and liabilities denominated in foreign currencies into U.S. dollars using the exchange rates in effect at the balance sheet dates and other assets and liabilities using historical exchange rates.

 

Foreign currency denominated revenue and expenses have been re-measured using the average exchange rates in effect during each period. Foreign currency re-measurement gains and losses have been included in other income (expense) and have not been significant for the years ended December 31, 2011, 2012, and 2013.

 

Cash and Cash Equivalents

 

We consider all highly liquid investments held at financial institutions, such as money market funds with original maturities of three months or less at date of purchase, to be cash equivalents.

 

Fair Value of Financial Instruments

 

We define fair value as the price that would be received from selling an asset or paid to transfer a liability in an orderly transaction between market participants at the measurement date. When determining the fair value measurements for assets and liabilities which are required to be recorded at fair value, we consider the principal or most advantageous market in which to transact and the market-based risk. We apply fair value accounting for all financial assets and liabilities that are recognized or disclosed at fair value in the financial statements on a recurring basis. The carrying amounts reported in the consolidated financial statements approximate the fair value for cash and

 

F-8

---

Table of Contents

cash equivalents, accounts receivable, accounts payable, and accrued liabilities, due to their short-term nature. The carrying amount of our preferred stock warrant liability represents their fair value and the long term debt is stated at the carrying value as the stated interest rate approximates the market rate currently available to us.

 

Accounts Receivable

 

Trade accounts receivable are recorded at the invoiced amount, net of allowances for doubtful accounts. The allowance for doubtful accounts is based on our assessment of the collectability of accounts. Management regularly reviews the adequacy of the allowance for doubtful accounts by considering the age of each outstanding invoice, each partner’s expected ability to pay, and the collection history with each partner, when applicable, to determine whether a specific allowance is appropriate. Accounts receivable deemed uncollectible are charged against the allowance for doubtful accounts when identified. As of December 31, 2012 and 2013, the allowance for doubtful accounts was not significant.

 

Inventories

 

Inventories are stated at lower of cost or market. Provisions have been made to reduce all slow-moving, obsolete or unusable inventories to their net realizable values. We purchase completed units from contract manufacturers. Accordingly, substantially all inventories are finished goods with an immaterial balance of replacement parts. As of December 31, 2012 and 2013, the provisions for excess and obsolete inventories were not significant.

 

Deferred Costs of Revenue

 

Deferred cost of revenue consists of direct and incremental costs related to product revenue deferred in accordance with the Company’s revenue recognition policy. Deferred cost of revenue that will be realized within the succeeding 12 month period is classified as current and the remaining is classified as non-current.

 

Property and Equipment

 

Property and equipment are recorded at cost. Depreciation is computed using the straight-line method over the estimated useful lives of the assets, generally two to five years.

 

The estimated useful lives of property and equipment are described below:

 

Property and Equipment		Useful Life
Computer equipment and software		2 to 5 years
Leasehold improvements		Shorter of estimated useful life or remaining lease term
Furniture and fixtures		5 years
Machinery and equipment		2 to 5 years

 

Demonstration Units

 

Product demonstration units are included in prepaid and other current assets on the consolidated balance sheets. Demonstration units are recorded at cost and are amortized over the estimated useful life from the date of transfer from inventory, generally 12 months. We generally do not resell units that have been used for demonstration purposes.

 

Impairment of Long-Lived Assets

 

We evaluate events and changes in circumstances that could indicate carrying amounts of long-lived assets may not be recoverable. When such events or changes in circumstances occur, we assess the recoverability of long-lived assets by determining whether or not the carrying value of such assets will be recovered through undiscounted expected future cash flows. If the total of the future undiscounted cash flows is less than the

 

F-9

---

Table of Contents

carrying amount of an asset, we record an impairment charge for the amount by which the carrying amount of the assets exceeds the fair value of the asset. Through December 31, 2013 we have not written down any of our long-lived assets as a result of impairment.

 

Acquisitions

 

We have accounted for all of our acquisitions using the purchase method as required under the provisions of FASB ASC 805, Business Combinations, or ASC 805. The total purchase price is allocated to the assets acquired and liabilities assumed based on fair values at the date of acquisition.

 

Goodwill

 

Goodwill represents the excess of the aggregate purchase price paid over the fair value of the net tangible assets acquired. Goodwill is not amortized and is tested for impairment at least annually or whenever events or changes in circumstances indicate that the carrying value may not be recoverable. The Company has determined that it operates as one reporting unit and has selected December 1 as the date to perform its annual impairment test. In the valuation of its goodwill, the Company must make assumptions regarding estimated future cash flows to be derived from the Company. If these estimates or their related assumptions change in the future, the Company may be required to record impairment for these assets. The first step of the impairment test involves comparing the fair value of the reporting unit to its net book value, including goodwill. If the net book value exceeds its fair value, then the Company would perform the second step of the goodwill impairment test to determine the amount of the impairment loss. The impairment loss would be calculated by comparing the implied fair value of the Company to its net book value. In calculating the implied fair value of the Company’s goodwill, the fair value of the Company would be allocated to all of the other assets and liabilities based on their fair values. The excess of the fair value of the Company over the amount assigned to its other assets and liabilities is the implied fair value of goodwill. An impairment loss would be recognized when the carrying amount of goodwill exceeds its implied fair value. There was no impairment of goodwill recorded for the years ended December 31, 2011, 2012 and 2013.

 

Warranties

 

We generally provide a one-year warranty on hardware. We do not accrue for potential warranty claims as a component of cost of product revenue as all product warranty claims are satisfied under our support and maintenance contracts.

 

Deferred Revenue

 

Deferred revenue consists of amounts that have been invoiced but that have not been recognized as revenue. Deferred revenue that will be realized during the succeeding 12 month period is recorded as current, and the remaining deferred revenue is recorded as non-current.

 

Contract Manufacturer Liabilities

 

We outsource most of our manufacturing, repair, and supply chain management operations to our independent contract manufacturers, and payments to such manufacturers are a significant portion of our product cost of revenue. Although we could be contractually obligated to purchase manufactured products, we generally do not own the manufactured products. Product title transfers from our independent contract manufacturers to us and to our partners upon shipment. Our independent contract manufacturers assemble our products using design specifications, quality assurance programs, and standards that we establish, and they procure components and assemble our products based on our demand forecasts. These forecasts represent our estimates of future demand for our products based upon historical trends and analysis from our sales and product management functions as adjusted for overall market conditions. If the actual component usage and product demand are significantly lower than forecast, we may accrue for costs for contractual manufacturing commitments in excess of our forecasted demand, including costs for excess components or for carrying costs incurred by our contract manufacturers. To date, we have not accrued any significant costs associated with this exposure.

 

F-10

---

Table of Contents

Preferred Stock Warrant Liability

 

The preferred stock warrant liability is measured and recognized in the financial statements at its fair value because the warrants contain anti-dilution provisions which require us to lower the exercise price of the warrants upon any future down-round financing. The fair value of the warrants is estimated using the Monte Carlo model at each reporting date. The change in fair value of the warrants is recognized in the consolidated statements of operations as other expense. We adjusted the liability quarterly for changes in fair value using a Monte Carlo model until the completion of the IPO in September 2013. Upon conversion of the underlying preferred stock to common stock, the related warrant liability was remeasured to fair value and the remaining liability was reclassified to additional paid-in capital.

 

Revenue Recognition

 

We generate revenue from the sales of products, subscriptions, support and maintenance, and other services primarily through our indirect relationships with our partners as well as end customers through our direct sales force. Our products include operating system software that is integrated into the appliance hardware and is deemed essential to its functionality. As a result, we account for revenue in accordance with Accounting Standards Codification 605, Revenue Recognition, and all related interpretations as all our security appliance deliverables include proprietary operating system software, which together deliver the essential functionality of our products.

 

Revenue is recognized when all of the following criteria are met:

 

•

Persuasive Evidence of an Arrangement Exists. We rely upon non-cancelable sales agreements and purchase orders to determine the existence of an arrangement.

 

•

Delivery has Occurred. We use shipping documents or transmissions of service contract registration codes to verify delivery.

 

•

The Fee is Fixed or Determinable. We assess whether the fee is fixed or determinable based on the payment terms associated with the transaction.

 

•

Collectability is Reasonably Assured. We assess collectability based on credit analysis and payment history.

 

Our products include three principal security product families that address critical vectors of attack, including Web, email and file shares. Our Web Threat Prevention, File Threat Prevention, Forensic Analysis System and Central Management System appliance and subscription services qualify as separate units of accounting. Therefore, Web Threat Prevention, File Threat Prevention, Forensic Analysis System and Central Management System appliance product revenue is recognized at the time of shipment. However, our Email Threat Prevention cannot function without the use of our subscription services. As such, our Email Threat Prevention products and related services do not have stand-alone value and do not qualify as separate units of accounting. Therefore, Email Threat Prevention product revenue is recognized ratably over the longer of the contractual term of the subscription services or the estimated period the customer is expected to benefit from the product, provided that all other revenue recognition criteria have been met. Because we have only been selling our Email Threat Prevention since April 2011, we have a limited history with respect to subscription renewals for such product. As a result, revenue from all Email Threat Prevention products sold by us through December 31, 2013 has been recognized ratably over the contractual term of the subscription services.

 

At the time of shipment, product revenue meets the criteria for fixed or determinable fees. In addition, payment from our partners is not contingent on the partners, collection from their end-customers. Our partners do not stock products and do not have any stock rotation rights. We recognize subscription and support and maintenance service revenue ratably over the contractual service period, which is typically one or three years. Other services revenue is recognized as the services are rendered and has not been significant to date.

 

Most of our arrangements, other than renewals of subscriptions and support and maintenance services, are multiple-element arrangements with a combination of product, subscriptions, support and maintenance, and other

 

F-11

---

Table of Contents

services. For multiple-element arrangements, we allocate revenue to each unit of accounting based on an estimated selling price at the arrangement inception. The estimated selling price for each element is based upon the following hierarchy: vendor-specific objective evidence (“VSOE”) of selling price, if available, third-party evidence (“TPE”) of selling price, if VSOE of selling price is not available, or best estimate of selling price (“BESP”), if neither VSOE of selling price nor TPE of selling price are available. The total arrangement consideration is allocated to each separate unit of accounting using the relative estimated selling prices of each unit based on the aforementioned selling price hierarchy. We limit the amount of revenue recognized for delivered elements to an amount that is not contingent upon future delivery of additional products or services or meeting of any specified performance conditions.

 

To determine the estimated selling price in multiple-element arrangements, we seek to establish VSOE of selling price using the prices charged for a deliverable when sold separately and, for subscriptions and support and maintenance, based on the renewal rates and discounts offered to partners. If VSOE of selling price cannot be established for a deliverable, we seek to establish TPE of selling price by evaluating similar and interchangeable competitor products or services in standalone arrangements with similarly situated partners. However, as our products contain a significant element of proprietary technology and offer substantially different features and functionality from our competitors, we are unable to obtain comparable pricing of our competitors’ products with similar functionality on a standalone basis. Therefore, we have not been able to obtain reliable evidence of TPE of selling price. If neither VSOE nor TPE of selling price can be established for a deliverable, we establish BESP primarily based on historical transaction pricing. Historical transactions are segregated based on our pricing model and our go-to-market strategy, which include factors such as type of sales channel (reseller, distributor, or end-customer), the geographies in which our products and services were sold (domestic or international), offering type (products, subscriptions or services), and whether or not the opportunity was identified by our sales force or by our partners. In analyzing historical transaction pricing, we evaluate whether a majority of the prices charged for a product, as represented by a percentage of list price, fall within a reasonable range. To further support the best estimate of selling price as determined by the historical transaction pricing or when such information is unavailable, such as when there are limited sales of a new product, we consider the same factors we have established through our pricing model and go-to-market strategy. The determination of BESP is made through consultation with and approval by our management. We have established the estimated selling price of all of our deliverables using BESP.

 

Shipping charges billed to partners are included in revenue and related costs are included in cost of revenue. Sales commissions and other incremental costs to acquire contracts are also expensed as incurred and are recorded in sales and marketing expense. After receipt of a partner order, any amounts billed in excess of revenue recognized are recorded as deferred revenue.

 

Advertising Costs

 

Advertising costs, which are expensed and included in sales and marketing expense when incurred, were $171,000, $1.1 million and $766,000 during the years ended December 31, 2011, 2012 and 2013, respectively.

 

Software Development Costs

 

The costs to develop software have not been capitalized as we believe our current software development process is essentially completed concurrent with the establishment of technological feasibility. As such, all software development costs are expensed as incurred and included in research and development expense on the consolidated statements of operations.

 

Stock-Based Compensation

 

Compensation expense related to stock-based transactions, including employee and non-employee director awards and our 2013 Employee Stock Purchase Plan (the “ESPP”), is measured and recognized in the financial

 

F-12

---

Table of Contents

statements based on fair value. The fair value of each option award is estimated on the grant date using the Black-Scholes option-pricing model and a single option award approach. This model requires that at the date of grant we determine the fair value of the underlying common stock, the expected term of the award, the expected volatility of the price of our common stock, risk-free interest rates, and expected dividend yield of our common stock. The stock-based compensation expense, net of forfeitures, is recognized using a straight-line basis over the requisite service periods of the awards, which is generally four years. We estimate a forfeiture rate to calculate the stock-based compensation for our awards. Our forfeiture rate is based on an analysis of our actual historical forfeitures.

 

We account for stock options issued to nonemployees based on the fair value of the awards determined using the Black-Scholes option-pricing model. The fair value of stock options granted to nonemployees is remeasured as the stock options vest, and the resulting change in value, if any, is recognized in the statement of operations during the period the related services are rendered.

 

Income Taxes

 

We account for income taxes using the asset and liability method, which requires the recognition of deferred tax assets and liabilities for the expected future tax consequences of events that have been recognized in our financial statements or tax returns. In addition, deferred tax assets are recorded for the future benefit of utilizing net operating losses and research and development credit carryforwards. Valuation allowances are provided when necessary to reduce deferred tax assets to the amount expected to be realized.

 

We apply the authoritative accounting guidance prescribing a threshold and measurement attribute for the financial recognition and measurement of a tax position taken or expected to be taken in a tax return. We recognize liabilities for uncertain tax positions based on a two-step process. The first step is to evaluate the tax position for recognition by determining if the weight of available evidence indicates that it is more likely than not that the position will be sustained on audit, including resolution of related appeals or litigation processes, if any. The second step requires us to estimate and measure the tax liability as the largest amount that is more likely than not to be realized upon ultimate settlement. We recognize interest and penalties related to unrecognized tax benefits within the income tax expense line in the accompanying Consolidated Statements of Operations. Accrued interest and penalties are included within other long-term liabilities in the Consolidated Balance Sheets.

 

Net Loss Per Share Attributable to Common Stockholders

 

We calculate our basic and diluted net loss per share attributable to common stockholders in conformity with the two-class method required for companies with participating securities. Under the two-class method, in periods when the Company has net income, net income attributable to common stockholders is determined by allocating undistributed earnings, calculated as net income less current period convertible preferred stock non-cumulative dividends, between common stock and the convertible preferred stock. In computing diluted net income attributable to common stockholders, undistributed earnings are re-allocated to reflect the potential impact of dilutive securities. The Company’s basic net loss per share attributable to common stockholders is calculated by dividing the net loss attributable to common stockholders by the weighted-average number of shares of common stock outstanding for the period. The diluted net loss per share attributable to common stockholders is computed by giving effect to all potential dilutive common stock equivalents outstanding for the period. For purposes of this calculation, options to purchase common stock and convertible preferred stock warrants are considered common stock equivalents but have been excluded from the calculation of diluted net loss per share attributable to common stockholders as their effect is antidilutive.

 

Recent Accounting Pronouncements

 

In June 2011, the Financial Accounting Standards Board, (“FASB”) issued authoritative guidance that addresses the presentation of comprehensive income for annual reporting of financial statements was issued. The guidance is

 

F-13

---

Table of Contents

intended to improve the comparability, consistency and transparency of financial reporting and to increase the prominence of items reported in other comprehensive income by eliminating the option to present components of other comprehensive income as part of the statement of changes in stockholders’ equity. Such changes in the stockholders’ equity will be required to be disclosed in either a single continuous statement of comprehensive income or in two separate but consecutive statements. The guidance is effective for fiscal years beginning after December 15, 2011, and should be applied retrospectively for all periods presented. Early adoption is permitted. This new guidance impacts how the Company reports comprehensive income, and did not have any effect on the Company’s results of operations, financial position or liquidity upon its required adoption on January 1, 2012.

 

Additionally, in May 2011, updated authoritative guidance to amend existing requirements for fair value measurements and disclosures was issued. The guidance expands the disclosure requirements around fair value measurements categorized in Level 3 of the fair value hierarchy and requires disclosure of the level in the fair value hierarchy of items that are not measured at fair value but whose fair value must be disclosed. It also clarifies and expands upon existing requirements for fair value measurements of financial assets and liabilities as well as instruments classified in stockholders’ equity. The guidance was effective for the year ended December 31, 2012 and was applied prospectively. This new guidance impacts how the Company reports on fair value measurements only, and had no effect on the Company’s results of operations, financial position or liquidity upon the Company’s adoption on January 1, 2012.

 

In February 2013, the FASB issued guidance which addresses the presentation of amounts reclassified from accumulated other comprehensive income. This guidance does not change current financial reporting requirements, instead an entity is required to cross-reference to other required disclosures that provide additional detail about amounts reclassified out of accumulated other comprehensive income. In addition, the guidance requires an entity to present significant amounts reclassified out of accumulated other comprehensive income by line item of net income if the amount reclassified is required to be reclassified to net income in its entirety in the same reporting period. Adoption of this standard is required for periods beginning after December 15, 2012 for public companies. This new guidance impacts how the Company reports comprehensive income and has had no effect on the Company’s results of operations, financial position or liquidity for the year ended December 31, 2013.

 

2. Fair Value Measurements

 

We categorize assets and liabilities recorded at fair value on our consolidated balance sheets based upon the level of judgment associated with inputs used to measure their fair value. The categories are as follows:

 

•

Level 1—Inputs are unadjusted quoted prices in active markets for identical assets or liabilities.

 

•

Level 2—Inputs are quoted prices for similar assets and liabilities in active markets or inputs other than quoted prices that are observable for the assets or liabilities, either directly or indirectly through market corroboration, for substantially the full term of the financial instruments.

 

•

Level 3—Inputs are unobservable inputs based on our own assumptions used to measure assets and liabilities at fair value. The inputs require significant management judgment or estimation.

 

The following table presents the fair value of our financial assets and liabilities using the above input categories (in thousands):

 

		As of December 31, 2012
Description		Level 1				Level 2				Level 3				Fair Value
Money market funds		$	5,893			$	—			$	—			$	5,893
Preferred stock warrant liability			—				—				3,529				3,529
Total assets and liabilities measured at fair value		$	5,893			$	—			$	3,529			$	9,422

 

F-14

---

Table of Contents

		As of December 31, 2013
Description		Level 1				Level 2				Level 3				Fair Value
Money market funds		$	132,518			$	—			$	—			$	132,518
Total assets measured at fair value		$	132,518			$	—			$	—			$	132,518

 

Level 1 investments consist solely of money market funds, included in cash and cash equivalents, valued at amortized cost which approximates fair value. Level 1 liabilities consist of long-term debt. Level 3 instruments consist solely of our preferred stock warrant liability in which the fair value was measured upon issuance and at each period end. Inputs used to determine the estimated fair value of the warrant liability as of the valuation date included remaining contractual term of the warrants, the risk-free interest rate, volatility of our comparable public companies over the remaining term, and the fair value of underlying shares. The significant unobservable inputs used in the fair value measurement of the preferred stock warrant liability were the fair value of the underlying stock at the valuation date and the estimated term of the warrants. Generally, increases (decreases) in the fair value of the underlying stock and estimated term would result in a directionally similar impact to the fair value measurement.

 

The following table sets forth a summary of the changes in the fair value of our Level 3 financial instruments as follows (in thousands):

 

		Preferred Stock Warrant Liability
Balance as of December 31, 2011		$	994
Change in fair value of preferred stock warrant liability			2,535
Balance as of December 31, 2012			3,529
Change in fair value of preferred stock warrant liability			6,538
Reclassification of preferred stock warrants to common stock warrants upon IPO			(10,067	)
Balance as of December 31, 2013		$	—

 

The gains and losses from remeasurement of Level 3 financial liabilities are recorded through the other expenses, net in the statements of operations.

 

3. Balance Sheet Components

 

Property and Equipment

 

Property and equipment, net consisted of the following (in thousands):

 

		As of December 31,
		2012				2013
Computer equipment and software		$	12,115			$	57,403
Leasehold improvements			2,668				15,660
Furniture and fixtures			1,822				6,035
Machinery and equipment			19				756
Total property and equipment			16,624				79,854
Less: accumulated depreciation and amortization			(3,088	)			(15,089	)
Total property and equipment, net		$	13,536			$	64,765

 

Depreciation and amortization expense related to property and equipment and demonstration units during the years ended December 31, 2011, 2012 and 2013 was $3.3 million, $6.9 million and $19.2 million, respectively.

 

F-15

---

Table of Contents

4. Business Combinations

 

Acquisitions in 2013

 

On December 30, 2013, we acquired privately held Mandiant Corporation (“Mandiant”), a leading provider of advanced end point security products and security incident response management solutions. We believe this acquisition creates an advanced threat protection vendor with the ability to find and stop attacks at every stage of the attack life cycle.

 

At the closing on December 30, 2013, we acquired all the outstanding shares of capital stock of Mandiant for 16,123,011 shares of our common stock and $106.5 million in cash. Under the terms and conditions of the Merger Agreement, each outstanding share of Mandiant common stock was converted into the right to receive (a) $5.22 in cash, without interest, and subject to applicable withholding tax, and (b) 0.8126 of a share of our common stock. This transaction is referred to herein as the merger. In connection with the merger, all of the outstanding stock options and restricted stock awards of Mandiant were converted into stock options and restricted stock awards, respectively, denominated in shares of our common stock. The common stock issued, along with the estimated fair value of vested equity awards assumed and cash payment, resulted in a preliminary estimated purchase price of $897.7 million for accounting purposes. The total preliminary estimated purchase consideration is as follows (in thousands):

 

		Amount
Cash		$	106,538
Fair value of common stock			704,414
Estimated fair value of equity awards assumed			86,703
Total preliminary estimated purchase consideration		$	897,655

 

The acquisition of Mandiant was accounted for in accordance with the acquisition method of accounting for business combinations with FireEye as the accounting acquirer. We expensed the related acquisition costs in the amount of $8.5 million in general and administrative expenses. Under the purchase method of accounting, the total purchase price as shown in the table above is allocated to the preliminary tangible and identifiable intangible assets acquired and liabilities assumed based on their estimated fair values. The total purchase price was allocated using the information currently available. As a result, we may continue to adjust the preliminary estimated purchase price allocation after obtaining more information regarding asset valuations, liabilities assumed, and revisions of preliminary estimates. The purchase price allocations will be finalized in calendar 2014. Total preliminary allocation of the estimated purchase consideration is as follows (in thousands):

 

		Amount
Net tangible assets		$	9,629
Intangible assets			275,500
Deferred tax liability			(90,105	)
Goodwill			702,631
Total preliminary purchase price allocation		$	897,655

 

As noted above in connection with the acquisition, we also assumed and exchanged Mandiant’s outstanding and stock options and restricted stock awards. The assumed options and restricted stock awards continue to have the same terms and conditions as set forth in the original stock option and restricted stock award agreements. The fair values of the equity awards assumed were estimated using a Black-Scholes-Merton option-pricing model. The estimated fair values of unvested equity awards of $122.6 million will be recorded as operating expense over the remaining requisite service periods as they relate to post combination services, while the fair values of vested equity based awards of $86.7 million will be included in total purchase price as they relate to pre combination services.

 

F-16

---

Table of Contents

None of the goodwill recorded as part of the Mandiant acquisition will be deductible for U.S. federal income tax purposes.

 

Intangible assets consist primarily of developed technology, content, customer relationship and other intangible assets. Content intangibles represent threat intelligence, which is continually gathered from ongoing monitoring of endpoints and by incident response and remediation teams. The intangible assets attributable to customer relationships relate to Mandiant’s ability to sell existing, in-process and future versions of its products and services to its existing customers. Developed technology intangibles includes a combination of patented and unpatented technology, trade secrets, and computer software and processes that represent the foundation for planned new products and services. The preliminary estimated useful life and fair values of the identifiable intangible assets are as follows (in thousands):

 

		Preliminary Estimated Useful Life (in years)				Amount
Developed technology			4 - 6			$	54,600
In-process research and development			N/A				1,400
Content			10				128,500
Customer relationships			8				66,000
Contract backlog			1 - 3				12,600
Trade names			4				12,400
Total						$	275,500

 

The results of operations of Mandiant have been included in our consolidated statements of operations from the acquisition date although Mandiant’s operations made no material contribution to our revenue or expenses for the year ended December 31, 2013. The following table presents pro forma results of operations of the Company and Mandiant as if the companies had been combined as of January 1, 2012 and includes pro forma adjustments related to the amortization of acquired intangible assets and share-based compensation expense. Direct and incremental transaction costs are excluded from the year ended December 31, 2013 pro forma condensed combined financial information presented below, and included in year period ended December 31, 2012 pro forma condensed combined financial information presented below. The tax benefit of $28.0 million that resulted from the acquisition is recorded in the year ended December 31, 2012 pro-forma period. The pro forma condensed combined financial information is presented for informational purposes only. The unaudited pro forma results of operations are not necessarily indicative of results that would have occurred had the acquisition taken place at the beginning of the earliest period presented, or of future results. Included in the pro forma results are fair value adjustments based on the fair values of assets acquired and liabilities assumed as of the acquisition date. Pro-forma results include amortization of intangible assets related to the acquisition, acquisition related costs associated with the purchases and income tax effects. Supplemental information on an unaudited pro forma basis, as if the Mandiant acquisition had been consummated on January 1, 2012, is presented as follows (in thousands):

 

		2012				2013
Pro forma revenue		$	157,555			$	266,458
Pro forma loss from operations			(130,885	)			(296,476	)
Pro forma net loss			(77,935	)			(223,740	)

 

On September 3, 2013, we acquired all outstanding shares of Secure DNA Managed Services, Inc. and certain affiliated entities (collectively, “Secure DNA”), a security solutions provider based in Honolulu, Hawaii, focused on network monitoring and management, secured hosting, cloud e-mail protection, incident response and other network security related services. The acquisition of Secure DNA provides us with the developed technology platform that will facilitate the delivery of the advanced security services for all our products.

 

We accounted for the acquisition of Secure DNA as a purchase of a business. We expensed the related acquisition costs, consisting primarily of legal expenses in the amount of $0.2 million, and these expenses were

 

F-17

---

Table of Contents

presented as general and administrative expenses on the consolidated statements of operations for the year ended December 31, 2013. Under the purchase method of accounting, the total purchase price was allocated to the tangible and identifiable intangible assets acquired and liabilities assumed.

 

The total preliminary purchase consideration of $4.9 million consisted of $4.1 million in cash and the issuance of 50,000 shares of our common stock with a fair value of $16.00 per share on the acquisition date. We also assumed deferred tax liabilities related to the fair value of the developed technology and customer relationships we obtained in the acquisition as well as other assumed liabilities related to normal operations. Primarily as a result of the deferred tax liabilities assumed in the acquisition, we recognized goodwill of $2.3 million equal to the excess of the purchase consideration over the fair value of the assets acquired and the liabilities assumed. None of the goodwill is expected to be deductible for income tax purposes.

 

The acquisition also includes a contingent obligation of up to $3.0 million, consisting of 190,000 shares of our common stock with a fair value of $16.00 per share on the acquisition date, to certain employees from Secure DNA, if specified product and service milestones are met within the two years of the acquisition date. As the obligation is contingent upon their continuous employment with us, the contingent obligation is being recorded as compensation expense ratably over the respective service periods. As of December 31, 2013, certain milestones were achieved, as a result, 81,699 shares of common stock were vested.

 

The following table summarizes the consideration paid and the fair values of the assets acquired and liabilities assumed at the acquisition date for the Secure DNA acquisition (in thousands):

 

		Amount
Developed technology		$	1,300
Customer relationships			1,900
Deferred tax liabilities			(1,290	)
Net assets acquired			665
Goodwill			2,302
Fair value of total consideration transferred		$	4,877

 

The results of operations of Secure DNA have been included in our consolidated statements of operations from the acquisition date. Pro Forma results of operations have not been presented because the acquisitions were not material to our results of operations.

 

Acquisitions in 2012

 

On December 14, 2012, we acquired certain assets of Tall Maple Systems, Inc. (“Tall Maple”), a software platform provider that developed software applications to simplify the development cycle and reduce the time to market of Linux-based Internet appliances. We accounted for the acquisition of Tall Maple as a purchase of a business. We expensed the related acquisition costs, consisting primarily of legal expenses in the amount of $19,000 during the year ended December 31, 2012. These legal expenses were presented as general and administrative expenses on the consolidated statements of operations for the year ended December 31, 2012. The total purchase consideration of $816,000 consisted of the issuance of 150,000 shares of our common stock with a fair value of $5.44 per share on the acquisition date. The acquisition of Tall Maple provided us with developed technology. We determined that the fair value of the developed technology was approximately equal to the purchase consideration and that no other identifiable intangible or tangible assets were acquired and no liabilities were assumed. Accordingly, we did not recognize any goodwill with the acquisition of Tall Maple.

 

On December 20, 2012, we acquired all outstanding shares of Ensighta Security, Inc. (“Ensighta”), a company that develops a software application that enables automatic security analysis of mobile apps on android based mobile devices. We accounted for the acquisition of Ensighta as a purchase of a business. We expensed the related acquisition costs, consisting primarily of legal expenses in the amount of $328,000 during the year ended December 31, 2012. These legal expenses were presented as general and administrative expenses on the

 

F-18

---

Table of Contents

consolidated statements of operations for the year ended December 31, 2012. The total purchase consideration of $3.2 million consisted of $888,000 in cash and the issuance of 422,668 shares of our common stock with a fair value of $5.44 per share on the acquisition date. The acquisition of Ensighta provided us with developed technology and allowed us to enhance our workforce. We also assumed deferred tax liabilities related to the fair value of the developed technology we obtained in the acquisition as well as other assumed liabilities related to normal operations. Primarily as a result of the deferred tax liabilities assumed in the acquisition, we recognized goodwill of $1.3 million which represents the excess of the purchase consideration over the fair value of the assets acquired and the liabilities assumed. None of the goodwill is expected to be deductible for income tax purposes.

 

The following table summarizes the consideration paid and the fair values of the assets acquired and liabilities assumed at the acquisition date for the Ensighta acquisition (in thousands):

 

		Amount
Developed technology			3,378
Deferred tax liabilities			(1,274	)
Net assets acquired			(190	)
Goodwill			1,274
Fair value of total consideration transferred		$	3,188

 

The results of operations of Tall Maple, Ensighta and Secure DNA have been included in our consolidated statements of operations from the acquisition date. Pro Forma results of operations have not been presented because the acquisitions were not material to our results of operations.

 

Goodwill and Purchased Intangible Assets

 

The changes in the carrying amount of goodwill for the years ended December 31, 2012 and 2013 are as following (in thousands):

 

		Goodwill
Balance as of December 31, 2011		$	—
Goodwill acquired			1,274
Balance as of December 31, 2012			1,274
Goodwill acquired			705,053
Balance as of December 31, 2013		$	706,327

 

Intangible assets consist of the following (in thousands):

 

		As of December 31, 2012				As of December 31, 2013
Developed technology		$	4,194			$	60,093
In-process research and development			—				1,400
Content			—				128,500
Customer relationships			—				67,900
Contract backlog			—				12,600
Trade names			—				12,400
Less: accumulated amortization			—				(1,516	)
Net acquired intangible assets		$	4,194			$	281,377

 

F-19

---

Table of Contents

The developed technology, content and contract backlog will be amortized to cost of sales over the economic life of the related assets which, was estimated to be three to ten years as of the acquisition date. The customer relationships and trade names will be amortized to sales and marketing expense over the economic life of the related assets, which was estimated to be four to eight years as of the acquisition date. Amortization expense of intangible assets for the years ended December 31, 2011, 2012 and 2013 was zero, zero and $1.5 million, respectively.

 

The expected annual amortization expense of intangible assets as of December 31, 2013 is presented below (in thousands):

 

Years Ending December 31,		Intangible Assets
2014		$	42,855
2015			42,056
2016			41,444
2017			35,891
2018			24,950
2019 and thereafter			92,781
Total intangible assets subject to amortization		$	279,977
Total intangible assets with indefinite lives			1,400
Total		$	281,377

 

5. Deferred Revenue

 

Deferred revenue consists of the following (in thousands):

 

		As of December 31,
		2012				2013
Product, current		$	6,570			$	13,823
Subscription and services, current			37,180				96,712
Total deferred revenue, current			43,750				110,535
Product, non-current			3,888				6,711
Subscription and services, non-current			28,768				70,268
Total deferred revenue, non-current			32,656				76,979
Total deferred revenue		$	76,406			$	187,514

 

6. Long-term Debt

 

In August 2005, we entered into a loan agreement (the “First Loan Agreement”) with two lenders that provided for borrowings under an equipment facility and a growth capital facility. The First Loan Agreement provided for advances under the equipment facility up to $1.0 million in $50,000 increments through the termination date on December 31, 2006 and advances under the growth capital facility up to $3.0 million in $1.0 million increments through the termination date on December 31, 2006. Outstanding borrowings under the equipment facility were due in 36 equal monthly payments of principal and interest following the month of borrowing, with a final payment on the maturity date equal to 2.5% of the drawn down principal. Outstanding borrowings under the growth capital facility were due in 36 monthly payments of principal and interest beginning January 1, 2007. There were no prepayment penalties for either the equipment facility or the growth capital facility. There were no amounts outstanding under the First Loan Agreement as of December 31, 2012 and 2013.

 

In June 2010, the Company entered into a second loan agreement (the “Second Loan Agreement”) with a lender that provides for: (1) a revolving line of credit facility, (2) an equipment facility and (3) a term loan. In

 

F-20

---

Table of Contents

addition, this loan agreement was amended in August 2011 to provide for additional borrowings under a (4) growth facility. The Second Loan Agreement provides certain financial-related covenants, among others, relating to delivery of audited financial statements to the lender. We were in compliance with all financial-related covenants under the Second Loan Agreement as of December 31, 2012 and 2013.

 

Line of Credit

 

Under the terms of the Second Loan Agreement, we are able to borrow up to $3.0 million under a revolving line of credit. The line of credit carries a floating interest rate equal to prime plus 1.5% and was to mature in June 2012. Borrowings under the line of credit were collateralized by all of the Company’s assets, excluding intellectual property, and the availability of borrowings under the line of credit were subject to certain borrowing base limitations around our outstanding accounts receivable. In August 2011, the Second Loan Agreement was amended to increase the amounts available under the line of credit to $10.0 million. In December 2012, the Second Loan Agreement was amended to increase the amounts available under the line of credit to $25.0 million, extend the maturity date to December 31, 2014 and add a supplemental equipment line of $15.0 million, which has a maturity date in September 2016. As of December 31, 2012 and 2013, there were no amounts outstanding under the supplemental equipment line. We drew down $2.4 million, $7.6 million and $10.0 million under the line of credit during the years ended December 31, 2011, 2012 and 2013, respectively. In October 2013, we repaid the outstanding borrowings in the amount of $20.0 million under the revolving line of credit facility under the Second Loan Agreement. We have not cancelled the revolving line of credit facility. Borrowings under the revolving line of credit consist of the following (in thousands):

 

		December 31,
		2012				2013
Second Loan Agreement—revolving line of credit		$	10,000			$	—

 

Term Loans

 

Under the terms of the Second Loan Agreement, the Company was able to borrow up to $750,000 under the equipment facility. The equipment facility carries a fixed interest rate equal to 7.0% and requires payments of principal and interest due in 36 equal monthly installments beginning the month following any borrowings. Borrowings under the equipment facility were collateralized by all of our assets, excluding intellectual property. There are no prepayment penalties for the equipment facility. We borrowed $564,000 under the equipment facility during the year ended December 31, 2010 and paid off the balance during the year ended December 31, 2013.

 

Under the terms of the Second Loan Agreement, we borrowed $1.0 million under the term loan during the year ended December 31, 2010. The term loan carries a fixed interest rate equal to 8.0% and requires payments of principal and interest in 36 equal monthly installments beginning July 2010. Borrowings under the term loan were collateralized by all of our assets, excluding intellectual property. There are no prepayment penalties for the term loan. We paid off the balance during the year ended December 31, 2013.

 

Under the terms of the Second Loan Agreement, as amended in August 2011, we borrowed $2.75 million under a growth facility during the year ended December 31, 2011. The borrowings under the growth facility in the amount of $1.0 million was available until October 2011, and the remaining $1.75 million was available through the maturity date in December 2014. The growth facility carries a fixed interest rate equal to 6.5% and requires payments of principal and interest in 36 equal monthly installments beginning the month following any borrowings. Borrowings under the growth facility were collateralized by all of the Company’s assets, excluding intellectual property. There are no prepayment penalties for the growth facility. We paid off the balance during the year ended December 31, 2013.

 

F-21

---

Table of Contents

Outstanding borrowings under our debt agreements consist of the following (in thousands):

 

		December 31,
		2012
Second Loan Agreement—equipment facility		$	132
Second Loan Agreement—growth capital facility			1,832
Second Loan Agreement—term loan			183
			2,147
Less current portion			(1,231	)
Total		$	916

 

There were no outstanding balances under the term loan as of December 31, 2013.

 

Warrants

 

Under the terms of the First Loan Agreement during the years ended December 31, 2005, 2006, 2007 and 2008, we issued to the two lenders fully vested warrants to purchase an aggregate of 245,899 shares of Series A-2 convertible preferred stock and an aggregate of 118,942 shares of Series B convertible preferred stock. The Series A-2 warrants have an exercise price of $0.61 per share and a contractual term of 10 years. The Series B warrants have an exercise price of $1.32 per share and a contractual term of 10 years. The fair value of the warrants upon issuance, which was $4,000 in the aggregate, was recorded as debt issuance costs and a warrant liability. The shares underlying these warrants were converted from preferred stock to common stock upon the closing of our initial public offering in September 2013.

 

Under the terms of the Second Loan Agreement, we issued to the lender a fully vested warrant to purchase 100,000 shares of Series D convertible preferred stock during the year ended December 31, 2010. The Series D warrant has an exercise price of $0.39 per share and expires in June 2015. The fair value upon issuance in the amount of $12,000 was determined utilizing the Monte Carlo model with the following assumptions: contractual term of 10 years, expected volatility of 79%, risk-free rate of 2.2%, control premium of 30%, change of control probability of 50% and IPO threshold of $500 million. The fair value of the warrant upon issuance was recorded as debt issuance costs and a warrant liability. The shares underlying this warrant were converted from preferred stock to common stock upon the closing of our initial public offering in September 2013.

 

Under the terms of the Second Loan Agreement, we also issued to the lender a fully vested warrant to purchase 60,661 shares of Series E convertible preferred stock during the year ended December 31, 2011. The Series E warrant has an exercise price of $1.36 per share and expires in August 2016. The fair value upon issuance in the amount of $56,000 was determined utilizing the Monte Carlo model with the following assumptions: contractual term of 10 years, expected volatility of 79%, risk-free rate of 1.6%, control premium of 40%, change of control probability of 50% and IPO threshold of $500 million. The fair value of the warrant upon issuance was recorded as debt issuance costs and a warrant liability. The shares underlying this warrant were converted from preferred stock to common stock upon the closing of our initial public offering in September 2013.

 

7. Commitments and Contingencies

 

Leases

 

We lease our facilities under various non-cancelable operating leases, which expire through the year ending December 31, 2024. Rent expense is recognized using the straight-line method over the term of the lease. Rent expense was $324,000, $796,000 and $3.7 million during the years ended December 31, 2011 2012 and 2013 respectively.

 

F-22

---

Table of Contents

The aggregate future non-cancelable minimum rental payments on our operating leases, as of December 31, 2013, are as follows (in thousands):

 

Years Ending December 31,		Amount
2014		$	8,283
2015			8,201
2016			6,009
2017			5,175
2018			3,009
2019 and thereafter			9,759
Total		$	40,436

 

Contract Manufacturer Commitments

 

Our independent contract manufacturers procure components and assemble our products based on our forecasts. These forecasts are based on estimates of future demand for our products, which are in turn based on historical trends and an analysis from our sales and product marketing organizations, adjusted for overall market conditions. In order to reduce manufacturing lead times and plan for adequate supply, we may issue forecasts and orders for components and products that are non-cancelable. As of December 31, 2012 and December 31, 2013, we had $3.3 million and $16.7 million, respectively, of non-cancellable open orders. As of December 31, 2012 and December 31, 2013, we have not accrued any significant cost associated with the excess of our forecasted demand including costs for excess components or for carrying costs incurred by our independent contract manufacturers.

 

Litigation

 

We accrue for contingencies when we believe that a loss is probable and that we can reasonably estimate the amount of any such loss. We have made an assessment of the probability of incurring any such losses and whether or not those losses are estimable.

 

We are subject to legal proceedings, claims and litigation, including intellectual property litigation, arising in the ordinary course of business. Such matters are subject to many uncertainties and outcomes and are not predictable with assurance.

 

To the extent there is a reasonable possibility that a loss exceeding amounts already recognized may be incurred and the amount of such additional loss would be material, we will either disclose the estimated additional loss or state that such an estimate cannot be made. We do not currently believe that it is reasonably possible that additional losses in connection with litigation arising in the ordinary course of business would be material.

 

Indemnification

 

Under the indemnification provisions of our standard sales related contracts, we agree to defend our customers against third-party claims asserting infringement of certain intellectual property rights, which may include patents, copyrights, trademarks, or trade secrets, and to pay judgments entered on such claims. Our exposure under these indemnification provisions is generally limited to the total amount paid by our customer under the agreement. However, certain agreements include indemnification provisions that could potentially expose us to losses in excess of the amount received under the agreement. In addition, we indemnify our officers, directors, and certain key employees while they are serving in good faith in such capacities. Through December 31, 2013, there have been no claims under any indemnification provisions.

 

F-23

---

Table of Contents

8. Convertible Preferred Stock Warrants

 

In connection with the First Loan Agreement and Second Loan Agreement entered into or amended during the years ended December 31, 2005, 2006, 2007, 2008, 2011 and 2012 (Note 6), we issued warrants to purchase an aggregate of 525,502 shares of convertible preferred stock, all of which were exercisable upon issuance. As of December 31, 2013, all of the convertible preferred stock warrants remained outstanding as follows (in thousands, except share and per share amounts):

 

Class of Shares		Issuance Date(s)		Expiration Date(s)		No. of Shares				Exercise Price per Share				As of December 31, 2012
Series A-2		2005 and 2006		2015 and 2016			245,899			$	0.61			$	1,632
Series B		2006 through 2008		2016 through 2018			118,942			$	1.32				925
Series D		June 2010		June 2020			100,000			$	0.39				634
Series E		August 2011		August 2021			60,661			$	1.36				338
Total														$	3,529

 

Prior to our IPO, the fair value of the warrants was recorded as a warrant liability. The warrant was recorded at its estimated fair value utilizing the Monte Carlo model with changes in the fair value of the warrant liability reflected in other expense, net. Upon the completion of our IPO, the shares underlying the warrants were converted from warrants to purchase preferred stock into warrants to purchase approximately 616,000 shares of common stock, and the related balance of the preferred stock warrant liability was reclassified to additional paid-in capital, and there would be no expenses related to these warrants in future periods. In October 2013, warrants to purchase an aggregate of 304,043 shares of common stock were exercised on a cashless basis resulting in a net issuance of 299,160 shares of common stock. As of December 31, 2013, warrants to purchase 311,747 shares of common stock at a weighted average exercise price of $0.72 per share were outstanding.

 

During the years ended December 31, 2011, 2012 and 2013, we recognized charges in the amount of $805,000, $2.5 million and $6.5 million, respectively, from the remeasurement of the fair value of the warrants, which was recorded through other expense, net in the consolidated statements of operations.

 

The value of the underlying warrants were determined using the following assumptions as of December 31, 2012:

 

		As of December 31, 2012
Remaining contractual term (in years)		2.6 – 8.7
Risk-free interest rate		0.3% –1.5%
Volatility		55% –64%
Change of control probability		25% –50%
Control premium		40%
IPO threshold (in billions)		$0.6 – $1.8

 

The above assumptions were determined as follows:

 

Remaining contractual term—The remaining contractual term represents the time from the date of the valuation to the expiration of the warrant;

 

Risk-free interest rate—The risk-free interest rate is based on the U.S. Treasury yield in effect as of December 31, 2012 for zero coupon U.S. Treasury notes with maturities approximately equal to the term of the warrant;

 

F-24

---

Table of Contents

Volatility—The volatility is derived from historical volatilities of several unrelated publicly listed peer companies over a period approximately equal to the term of the warrant because the Company has limited information on the volatility of the preferred stock since there is currently no trading history. When making the selections of industry peer companies to be used in the volatility calculation, the Company considered the size, operational and economic similarities to the Company’s principle business operations;

 

Change of control probability—The change of control probability is the Board of Directors’ estimate of the probability that the Company will be involved in a change of control transaction; and

 

Control premium—The control premium represents an additional amount above the value of an entity’s common stock that an investor would be willing to pay to obtain control over that entity.

 

9. Convertible Preferred Stock

 

Immediately prior to the closing of the Company’s IPO, all of the outstanding shares of convertible preferred stock automatically converted to 74,221,553 shares of common stock. As of December 31, 2012, we had the following convertible preferred stock outstanding, all of which was converted to common stock in connection with our IPO (in thousands):

 

		December 31, 2012
		Shares Designated				Shares Issued and Outstanding				Liquidation Preference
Series A-1			1,000				1,000			$	250
Series A-2			10,410				10,164				6,200
Series B			11,104				10,985				14,500
Series C			7,049				7,049				14,604
Series D			26,331				26,231				10,187
Series E			4,632				4,412				6,000
Series F			4,800				4,274				45,005
Total			65,326				64,115			$	96,746

 

Significant terms of the convertible preferred stock were as follows:

 

Voting Rights

 

Prior to our IPO, the holders of the convertible preferred stock were entitled to one vote for each share of common stock into which their shares of convertible preferred stock would be converted, and the holders of the convertible preferred stock and common stock would have voted together on an as converted basis. For the election of the directors, and as long as 1,000,000 shares of convertible preferred stock were outstanding, the holders of the Series A-1, A-2, B, C, D and E convertible preferred stock were entitled to elect two directors. The holders of the common stock were entitled to elect two directors. A majority of the preferred stock (other than Series F convertible preferred stock) and common stock (each voting as a separate class) was required to elect any remaining directors. The holders of the Series F convertible preferred stock did not have voting rights with respect to the election of directors.

 

Dividends

 

The holders of the convertible preferred stock were entitled, when, as, and if declared by the Board of Directors, and prior and in preference to common stock, to non-cumulative dividends at the following per annum rates: $0.015 per share for Series A-1, $0.0366 per share for Series A-2, $0.0792 per share for Series B, $0.1243 per share for Series C, $0.0233014 per share for Series D, $0.0816 per share for Series E and

 

F-25

---

Table of Contents

$0.6318 per share for Series F. There were no cumulative preferred stock dividends in arrears as of December 31, 2012 and 2013. No dividends have been paid to date.

 

Liquidation

 

Prior to our IPO, in the event of any voluntary or involuntary liquidation, dissolution, or winding up of our operations, all assets available for distribution would have been distributed to the holders of convertible preferred stock based on the original issue price of the related shares as follows: $0.25 per share for Series A-1, $0.61 per share for Series A-2, $1.32 per share for Series B, $2.0717 per share for Series C, $0.3883572 per share for Series D, $1.36 per share for Series E, and $10.5294 per share for Series F, plus in each case all declared and unpaid dividends. If the available funds were insufficient to permit full payment of each Series’ original issue price, the available funds would have been allocated based on the number of shares of convertible preferred stock outstanding on a pro-rata basis. Any remaining available funds after payment to the holders of the convertible preferred stock would have been distributed to holders of common stock on a pro-rata basis, except that if the holder of convertible preferred stock would receive more funds had they converted into common stock, then the holders of convertible preferred stock would have received the amount they would have received had they converted to common stock.

 

Conversion

 

Prior to our IPO, shares of convertible preferred stock were convertible, at any time and at the option of the holder, into shares of common stock. Shares of convertible preferred stock automatically converted into shares of common stock immediately prior to the closing of the IPO. As of December 31, 2012 the conversion ratio for all series of convertible preferred stock was as follows; 1:1 for Series A-1, 1:1.1730769 for Series A-2, 1:1.4012739 for Series B, 1:1.4915047 for Series C, 1:1 for Series D, 1:1 for Series E and 1:1 for Series F.

 

Redemption

 

The convertible preferred stock was not redeemable.

 

10. Common Shares Reserved for Issuance

 

We were authorized to issue 130,000,000 and 1,000,000,000 shares, respectively, of common stock with a par value of $0.0001 per share as of December 31, 2012 and 2013, respectively. Each share of common stock is entitled to one vote. The holders of common stock are also entitled to receive dividends whenever funds are legally available and when declared by the Board of Directors, subject to the prior rights of holders of all classes of convertible preferred stock outstanding.

 

As of December 31, 2012 and 2013, we had reserved shares of common stock for issuance as follows (in thousands):

 

		As of December 31,
		2012				2013
Reserved under stock award plans			21,443				40,226
Conversion of preferred stock			73,747				—
Warrants to purchase convertible preferred stock			616				—
Warrants to purchase common stock			—				312
ESPP			—				2,500
Total			95,806				43,038

 

F-26

---

Table of Contents

11. Equity Award Plans

 

We have operated under three equity award plans, our 2004 Stock Option Plan (“2004 Plan”), our 2008 Stock Plan (“2008 Plan”), and our 2013 Equity Incentive Plan (“2013 Plan”) (collectively, the “Plans”), which were adopted by the Board of Directors and approved by the stockholders in August 2004, February 2008, and August 2013, respectively.

 

Our 2008 Plan and 2013 Plan provide for the issuance of restricted stock and the granting of options and restricted stock units to our employees, officers, directors, and consultants. Our 2004 Plan only allowed for the issuance of stock options. Awards granted under the Plans vest over the periods determined by the Board of Directors, generally four years, and expire no more than ten years after the date of grant. In the case of an incentive stock option granted to an employee who at the time of grant owns stock representing more than 10% of the total combined voting power of all classes of stock, the exercise price shall be no less than 110% of the fair value per share on the date of grant, and expire five years from the date of grant. For options granted to any other employee, the per share exercise price shall be no less than 100% of the fair value per share on the date of grant. In the case of a non-statutory stock option and options granted to consultants, the per share exercise price shall be no less than 100% of the fair value per share on the date of grant. Stock that is purchased prior to vesting is subject to our right of repurchase at any time following termination of the participant for so long as such stock remains unvested.

 

A total of 11,015,257 shares of our common stock is reserved for future grants as of December 31, 2013 under the 2013 Plan. As of January 1, 2014, an additional 6,887,875 shares of common stock became available for future grants under our 2013 Plan pursuant to provisions thereof that automatically increase the share reserve under such plan each year.

 

We terminated our 2004 Plan in 2008 and terminated our 2008 Plan upon the completion of our IPO. Awards that were outstanding upon termination remained outstanding pursuant to their original terms.

 

Mandiant Equity Awards Issued in Acquisition

 

In connection with the Mandiant acquisition, we assumed stock options and restricted stock awards covering an aggregate of 4.6 million shares of our common stock. At the date of the acquisition, 2.1 million of the stock options were vested and its fair value was recorded as part of the purchase consideration. The fair value related to the assumed 2.5 million unvested stock options are recognized as post-combination compensation costs and is being recorded as post-combination compensation expense ratably over the respective remaining service periods.

 

2013 Employee Stock Purchase Plan

 

In August 2013, our board of directors adopted, and our stockholders approved, our ESPP. The ESPP became effective upon adoption.

 

The ESPP allows eligible employees to acquire shares of our common stock at 85% of the lower of the fair market value of our common stock on the first trading of each offering period or on the exercise date. Each offering period will be approximately twelve months starting on the first trading date on or after May 15 and November 15 of each year, except for the first offering period, which commenced on September 19, 2013 and will end on the first trading day on or after May 15, 2014. Participants may purchase shares of common stock through payroll deduction of up to 15% of their eligible compensation, subject to purchase limits of 3,000 shares for each normal purchase period or $25,000 worth of stock for each calendar year.

 

A total of 2,500,000 shares of our common stock is available for sales under the ESPP. In addition, our ESPP provides for annual increases in the number of shares available for issuance on the first day of each fiscal year beginning in 2014, equal to the lesser of: 1% of the outstanding shares of our common stock on the first day of such fiscal year; 3,700,000 shares; or such other amount as may be determined by our board of directors. As of January 1, 2014, an additional 1,377,575 shares of common stock became available for future issuance under our ESPP pursuant to provisions thereof that automatically increase the share reserve under such plan each year.

 

F-27

---

Table of Contents

Stock-Based Compensation

 

We record stock-based compensation based on fair value of stock options on grant date using the Black-Scholes option-pricing model. The fair value of restricted stock units and restricted stock awards equals the market value of the underlying stock on the date of grant. The ESPP is compensatory and results in compensation expense. We determine the fair value of common shares to be issued under the ESPP using the Black-Scholes option-pricing model. We recognize such compensation expense on a straight-line basis over the employee’s requisite service period. We determined valuation assumptions as follows:

 

Fair Value of Common Stock

 

Prior to our IPO, our Board of Directors considered numerous objective and subjective factors to determine the fair value of our common stock at each meeting at which awards were approved. These factors included, but were not limited to (i) contemporaneous third-party valuations of common stock; (ii) the rights and preferences of convertible preferred stock relative to common stock; (iii) the lack of marketability of common stock; (iv) developments in the business; and (v) the likelihood of achieving a liquidity event, such as an initial public offering or sale of the Company, given prevailing market conditions. After the completion of our IPO, we have been using the listed stock price on the date of grant as the fair value of our common stock.

 

Risk-Free Interest Rate

 

We base the risk-free interest rate used in the Black-Scholes option-pricing model on the implied yield available on U.S. Treasury zero-coupon issues with an equivalent expected term of the options for each option group.

 

Expected Term

 

The expected term represents the period that our stock-based awards are expected to be outstanding. We base the expected term assumption based on our historical behavior combined with estimates of post-vesting holding period.

 

Volatility

 

We determine the price volatility factor based on the historical volatilities of our peer group as we did not have sufficient trading history for our common stock.

 

Dividend Yield

 

The expected dividend assumption is based on our current expectations about our anticipated dividend policy.

 

The following table summarizes the assumptions used in the Black-Scholes option-pricing model to determine fair value of our stock options:

 

		Year Ended December 31,
		2011		2012		2013
Fair value of common stock		$0.57 – $1.65		$1.65 – $5.44		$6.05 – $42.37
Risk-free interest rate		1.0% – 2.8%		0.2% – 3.4%		0.6% – 2.1%
Expected term (in years)		5 – 7		1 – 6		4 – 6
Volatility		51% – 52%		49% – 53%		46% – 54%
Dividend yield		—%		—%		—%

 

F-28

---

Table of Contents

The following table summarizes the assumptions used in the Black-Scholes option-pricing model to determine fair value of our common shares to be issued under the ESPP:

 

		Year Ended December 31,
		2012				2013
Fair value of common stock			NA			$20.00
Risk-free interest rate			NA			0.1%
Expected term (in years)			NA			0.7 – 1.2
Volatility			NA			42% – 45%
Dividend yield			NA			—%

 

Total stock-based compensation expense related to stock options, restricted stock units and awards, and ESPP, is included in the consolidated statements of operations as follows (in thousands):

 

		Years Ended December 31,
		2011				2012				2013
Cost of product revenue		$	31			$	115			$	469
Cost of subscription and services revenue			8				55				2,341
Research and development			148				1,465				6,958
Sales and marketing			360				1,672				10,748
General and administrative			168				3,536				8,342
Total		$	715			$	6,843			$	28,858

 

As of December 31, 2013, total compensation cost related to stock-based awards not yet recognized was $198.2 million, net of estimated forfeitures, respectively. Stock-based compensation cost is expected to be amortized on a straight-line basis over the weighted-average remaining vesting period of approximately 3 years.

 

During the year ended December 31, 2012, we modified the terms of certain stock-based awards for former employees and recorded $292,000 of additional compensation expense within general and administrative and sales and marketing expenses.

 

F-29

---

Table of Contents

Stock Option Activity

 

A summary of the activity for our stock option changes and a summary of information related to options exercisable, vested, and expected to vest are presented below (in thousands, except per share and contractual life amounts and years):

 

						Options Outstanding
		Shares Available for Grant				Number of Shares				Weighted- Average Exercise Price				Weighted- Average Grant Date Fair Value Per Share				Weighted- Average Contractual Life (years)				Aggregate Intrinsic Value
Balance—December 31, 2010			5,271				7,605			$	0.07								8.7			$	12
Additional shares authorized			2,858
Restricted stock awards and units granted			—				—				—
Option granted			(8,089	)			8,089			$	0.72			$	0.44
Options exercised			—				(816	)		$	0.22											$	547
Options canceled			167				(167	)		$	0.37
Balance—December 31, 2011			207				14,711			$	0.42								8.6			$	11,227
Additional shares authorized			16,308
Restricted stock awards and units granted			(2,335	)
Repurchases			24
Option granted			(11,341	)			11,341				1.92			$	1.35
Options exercised			—				(7,472	)			1.27											$	6,682
Options canceled			1,244				(1,244	)			1.06
Balance—December 31, 2012			4,107				17,336				0.98								8.3			$	77,250
Additional shares authorized			20,413
Restricted stock awards and units granted			(1,949	)
Restricted stock awards and units forfeited			173
Option granted			(13,182	)			13,182			$	9.57			$	5.71
Options exercised			—				(6,222	)		$	0.88											$	41,599
Options canceled			1,453				(1,453	)		$	3.60
Options assumed in acquisition			—				4,579			$	5.93
Balance—December 31, 2013			11,015				27,422			$	5.82								8.3			$	1,036,224
Options vested and expected to vest—December 31, 2013							25,905			$	5.64								8.2			$	983,507
Options exercisable—December 31, 2013							8,673			$	1.59								6.7			$	364,420

 

F-30

---

Table of Contents

Additional information regarding options outstanding as of December 31, 2013 is as follows (in thousands, except per share data and years):

 

		Options Outstanding												Options Exercisable
Exercise Price Range		Number of Shares				Weighted- Average Remaining Contractual Life (Years)				Weighted- Average Exercise Price				Number of Shares				Weighted- Average Exercise  Price
$  0.06 – $  0.06			22				2.7			$	0.06				22			$	0.06
$  0.07 – $  0.07			3,045				6.2			$	0.07				2,926			$	0.07
$  0.11 – $  0.95			3,021				5.9			$	0.55				2,392			$	0.54
$  1.06 – $  1.65			3,695				7.9			$	1.47				1,497			$	1.45
$  2.48 – $  4.68			1,946				8.5			$	3.03				553			$	3.06
$  5.44 – $  5.44			3,664				8.9			$	5.44				312			$	5.44
$  6.61 – $  7.92			2,100				8.2			$	7.03				970			$	6.91
$  7.93 – $  7.93			3,633				9.3			$	7.93				—			$	7.93
$  8.09 – $10.25			3,746				9.5			$	9.59				—			$	—
$13.00 – $13.00			1,756				9.6			$	13.00				1			$	13.00
$20.00 – $20.00			367				9.7			$	20.00				—			$	—
$38.33 – $38.86			328				9.9			$	38.52				—			$	—
$42.37 – $42.37			99				9.8			$	42.37				—			$	—
$  0.06 – $42.37			27,422				8.3			$	5.82				8,673			$	1.59

 

Restricted Common Stock, Restricted Stock Award (“RSA”) and Restricted Stock Unit (“RSU”) Activity

 

A summary of information related to restricted stock awards, restricted stock units and restricted common stock are presented below (in thousands, except per share data and years):

 

		Number of Shares
		In the Plans				Outside of the Plans				Weighted- Average Grant- Date Fair Value Per Share				Weighted- Average Contractual Life (years)				Aggregate Intrinsic Value
Unvested balance—December 31, 2010			—				—
Granted outside of the Plans			—				1,220			$	0.47
Vested			—				—
Canceled/forfeited			—				—
Unvested balance—December 31, 2011			—				1,220
Granted			2,335							$	2.31
Granted outside of the Plans			—				352			$	5.44
Vested			(440	)			(458	)
Canceled/forfeited			—				—
Unvested balance—December 31, 2012			1,895				1,114
Granted			1,949				—			$	31.59
Vested			(1,509	)			(606	)
Canceled/forfeited			(262	)			—
Granted in connection with acquisitions			—				1,021			$	37.65
Unvested balance—December 31, 2013			2,073				1,529								1.7			$	157,108
Expected to vest—December 31, 2013			1,844				1,361								1.7				139,773

 

F-31

---

Table of Contents

During the year ended December 31, 2013, we granted restricted stock units and restricted stock awards covering an aggregate of 565,500 shares of common stock to certain employees which vest upon the achievement of certain performance conditions, subject to the employees’ continued service relationship with the Company, and the completion of the Company’s initial public offering by December 31, 2014. 60,000 shares were subsequently forfeited to the Company. The grant date fair value of the restricted stock units was approximately $4.0 million, or $7.01 per share. In 2013, we recognized $1.1 million, a cumulative lump sum charge, equal to the compensation costs associated with requisite services that had been rendered as of December 31, 2013, as the performance condition was achieved. As of December 31, 2013, all restricted stock units were subject to forfeiture.

 

In December 2013, we granted 1,274,938 shares of restricted stock units to certain employees which vest upon the achievement of certain performance conditions, subject to the employees’ continued service relationship with the Company. The grant date fair value of the restricted stock units was approximately $55.7 million, or $43.69 per share. As of December 31, 2013, we did not recognize any compensation expense, as we concluded that it is not probable that the performance conditions will be achieved.

 

We will reassess the probability of vesting at each reporting period and adjust our compensation cost based on the probability assessment.

 

Restricted Stock Outside of the Plans

 

In July and August 2011, we issued and sold an aggregate of 1,220,498 shares of restricted common stock to a then new key executive for an aggregate amount equal to approximately $696,000. The shares had a purchase price per share equal to $0.57, and vest over four years, with 25% of the shares vesting on the first anniversary of the applicable vesting commencement date and 1/48 of the shares vesting monthly thereafter, subject to the employee’s continued service relationship with the Company on each applicable vesting date. The shares are subject to the terms and conditions of our 2008 Plan (even though the shares were issued outside of the shares reserved for issuance under the 2008 Plan) and the applicable stock purchase agreement. As of December 31, 2012 and 2013, 762,812 and 457,687 shares were subject to a repurchase right held by us at the original issuance price. As such, $435,000 and $260,000 were recorded in proceeds from early exercises of stock awards on the consolidated balance sheets as of December 31, 2012 and 2013, respectively.

 

In December 2012, we issued 351,953 shares of restricted common stock at $5.44 per share to certain employees which vest upon achievement of certain performance conditions as well as maximum two-year service with us from the acquisition date. As of December 31, 2013, 175,977 shares are subject to forfeiture.

 

In September 2013, we issued 222,500 shares of restricted common stock at $16.00 per share to certain employees of which 50,000 shares are considered as purchase consideration, and the rest vest upon achievement of certain performance as well as maximum two-year and one month’ service with us from the acquisition date. As of December 31, 2013, 98,326 shares are subject to forfeiture.

 

In connection with our acquisition of Mandiant in December 2013, we issued to former holders of Mandiant restricted stock an aggregate of 797,698 shares of our restricted stock at a value of $43.69 per share. The restricted stock awards continue to have the same terms and conditions as set forth in the original restricted stock award agreements, and will vest over the weighted-average remaining vesting period of approximately two years. As of December 31, 2013, 797,698 shares were subject to forfeiture.

 

F-32

---

Table of Contents

12. Income Taxes

 

Loss before provision for income taxes consisted of the following (in thousands):

 

		Year Ended December 31,
		2011				2012				2013
United States		$	(16,744	)		$	(37,316	)		$	(94,455	)
Foreign			33				595				(85,477	)
Total		$	(16,711	)		$	(36,721	)		$	(179,932	)

 

The provision for (benefit from) income taxes consisted of the following (in thousands):

 

		Year Ended December 31,
		2011				2012				2013
Federal:
Current		$	—			$	(1,181	)$			—
Deferred			—				—				(56,212	)
State:
Current			12				(62	)			86
Deferred			—				—				(4,564	)
Foreign:
Current			59				278				1,478
Deferred			—				—				(85	)
Total		$	71			$	(965	)		$	(59,297	)

 

Reconciliation of the federal statutory income tax rate to the effective tax rate is as follows:

 

		Year Ended December 31,
		2011				2012				2013
Federal statutory rate			35.0	%			35.0	%			35.0	%
Effect of:
State taxes, net of federal tax benefit			4.4				2.7				2.5
Change in valuation allowance			(39.5	)			(31.7	)			13.4
Research and development tax credit			2.8				3.0				0.8
Convertible preferred stock warrants			(1.7	)			(2.4	)			(1.3	)
Stock-based compensation			(0.8	)			(3.2	)			2.9
Foreign differential			—				—				(17.1	)
Other, net			(0.6	)			(0.8	)			(3.2	)
Total			(0.4	)%			2.6	%			33.0	%

 

F-33

---

Table of Contents

The components of the deferred tax assets and liabilities are as follows (in thousands):

 

		As of December 31,
		2012				2013
Deferred tax assets:
Net operating loss carryforwards		$	30,926			$	46,903
Accruals and reserves			2,682				6,471
Stock-based compensation			—				17,555
Fixed assets			—				752
Deferred revenue			4,358				10,546
Research and development credits			3,340				6,541
Other deferred tax assets			13				156
Gross deferred tax assets			41,319				88,924
Valuation allowance			(39,630	)			(4,186	)
Total deferred tax assets			1,689				84,738
Acquisition related intangibles			(1,275	)			(114,187	)
Fixed assets			(21	)			—
Other deferred tax liabilities			(393	)			(1,114	)
Deferred tax liabilities			(1,689	)			(115,301	)
Total		$	—			$	(30,563	)

 

A valuation allowance is provided when it is more likely than not that the deferred tax asset will not be realized. As a result of our acquisitions in 2013, we released a portion of our existing valuation allowance as the deferred tax liabilities from the acquisitions will provide a source of income for us to realize a portion of our deferred tax assets, therefore a valuation allowance is no longer needed on those deferred tax assets. The valuation allowance decreased by approximately $35.4 million during 2013.

 

As of December 31, 2013, we had federal and state net operating loss carry forwards of approximately $127.7 million and $136.7 million, respectively, available to reduce future taxable income, if any. If not utilized, the federal net operating loss carry forwards will expire from the years ending December 31, 2024 through 2033 while state net operating loss carry forwards will expire from the years ending December 31, 2014 through 2033.

 

We also have federal and state research and development tax credit carry forwards of approximately $4.2 million and $2.9 million, respectively. If not utilized, the federal credit carry forwards will expire in various amounts from the years ended December 31, 2025 through 2033. The state credit will carry forward indefinitely.

 

Utilization of the net operating loss carryforwards and credits may be subject to an annual limitation due to the ownership change limitations provided by the Internal Revenue Code of 1986, as amended, and similar state provisions. The annual limitation may result in the expiration of net operating losses and credits before utilization.

 

As a result of certain realization requirements of ASC 718, the table of deferred tax assets shown above does not include certain deferred tax assets as of December 31, 2013 that arose directly from tax deductions related to equity compensation greater than compensation recognized for financial reporting. Equity will be increased by $3.5 million if and when such deferred tax assets are ultimately realized. The Company uses ASC 740 ordering when determining when excess tax benefits have been realized.

 

As of December 31, 2013, we had $10.9 million of unrecognized tax benefits, of which $10.1 million would affect income tax expense if recognized, before consideration of our valuation allowance. As of December 31, 2013, our federal, state, and foreign returns for all years are still open to examination. We do not expect the unrecognized tax benefits to change significantly over the next 12 months. We recognize both interest and penalties associated with uncertain tax positions as a component of income tax expense. As of December 31, 2011, we have not accrued any penalties or made provisions for interest. As of December 31, 2012, we have

 

F-34

---

Table of Contents

accrued interest and penalties of $29,000. As of December 31, 2013, we have accrued interest and penalties of $71,000 and in total recognized a liability for interest and penalties of $100,000. The ultimate amount and timing of any future cash settlements cannot be predicted within reasonable certainty.

 

A reconciliation of gross unrecognized tax benefit is as follows (in thousands):

 

		Year Ended December 31,
		2011				2012				2013
Unrecognized tax benefits at the beginning of the period		$	501			$	699			$	1,172
Additions for tax positions related to the current year			198				474				8,789
Increases related to prior year tax positions			—				—				947
Decreases based on settlements with taxing authorities			—				—				(21	)
Lapse of statute of limitations			—				(1	)			—
Unrecognized tax benefits at the end of the period		$	699			$	1,172			$	10,887

 

As of December 31, 2013, we have not made any tax provision for U.S. federal and state income taxes on approximately $3.6 million of undistributed earnings in foreign subsidiaries, which we expect to reinvest outside of the U.S. indefinitely. If we were to repatriate these earnings to the U.S., we would be subject to U.S. income taxes and subject to an adjustment for foreign tax credits and foreign withholding taxes. Determination of the amount of unrecognized deferred tax liability is not practicable.

 

The benefit for income taxes for the year ended December 31, 2013 reflects an effective tax rate of 33.0%. The benefit is primarily due to a reduction of the U.S. valuation allowance resulting from recording a deferred tax liability on the acquisition-related intangibles for which no benefit will be derived partially offset by foreign and state income tax expense. The benefit for income taxes for the year ended December 31, 2012 reflects an effective rate of 2.6%. The benefit is primarily due to a reduction of the U.S. valuation allowance resulting from recording a deferred tax liability on the acquisition-related intangibles for which no benefit will be derived partially offset by foreign and state income tax expense. The provision for income taxes for the year ended December 31, 2011 differed from the U.S. federal statutory rate primarily as the result of the valuation allowances on U.S. deferred tax assets and state minimum taxes.

 

13. Net Loss per Share

 

Basic loss per share is calculated by dividing net loss by the weighted-average number of common shares outstanding during the period, less shares subject to repurchase, and excludes any dilutive effects of employee share-based awards and warrants. Diluted net income per common share is computed giving effect to all potential dilutive common shares, including common stock issuable upon exercise of stock options, and unvested restricted common stock and stock units. As we had net losses for the years ended December 31, 2011, 2012 and 2013, all potential common shares were determined to be anti-dilutive.

 

The following table sets forth the computation of net loss per common share (in thousands, except per share amounts):

 

		Year Ended December 31,
		2011				2012				2013
Numerator:
Net loss		$	(16,782	)		$	(35,756	)		$	(120,635	)
Denominator:
Weighted average number of shares outstanding—basic and diluted			8,447				10,917				45,271
Net loss per share—basic and diluted		$	(1.99	)		$	(3.28	)		$	(2.66	)

 

F-35

---

Table of Contents

The following outstanding options, unvested shares and units, ESPP shares, warrants, and convertible preferred stock were excluded (as common stock equivalents) from the computation of diluted net loss per common share for the periods presented as their effect would have been antidilutive (in thousands):

 

		As of December 31,
		2011				2012				2013
Options to purchase common stock			14,711				17,336				27,422
Unvested early exercised common shares			2,556				7,832				4,877
Unvested restricted stock awards and units			—				—				3,602
Convertible preferred stock			69,473				73,747				—
Warrants to purchase convertible preferred stock			616				616				—
Warrants to purchase common stock			—				—				312
ESPP shares			—				—				249

 

14. Employee Benefit Plan

 

We have established a 401(k) tax-deferred savings plan (the “401(k) Plan”), which permits participants to make contributions by salary deduction pursuant to Section 401(k) of the Internal Revenue Code of 1986, as amended. We are responsible for administrative costs of the 401(k) Plan and have made no contributions to the 401(k) Plan since inception.

 

15. Related Party Transactions

 

Employee Notes Receivable

 

Our former Chief Executive Officer and now Chief Technology Officer and Chief Strategy Officer and the current Chief Executive Officer have exercised stock options early in exchange for full-recourse promissory notes bearing annual interest of 1.07% to 2.72% payable to us. These notes were secured by the underlying shares purchased and such unvested shares can be repurchased by us upon employee termination at the original issuance price. The promissory notes and accrued interest become due and payable in full beginning January 29, 2015 and ending June 18, 2017, but may become due earlier if we become subject to the requirements of Section 13 of the Securities Exchange Act of 1934, have a change in control or the Chief Executive Officer terminates services.

 

Employee notes receivable as of December 31, 2012 was $7.3 million, all of which was repaid in March and April 2013.

 

In March 2013, the Company’s Chief Technology Officer repaid in full his outstanding promissory notes with us in the aggregate amount of $3.7 million, which covered all outstanding principal and accrued interest. Approximately $1.9 million is recorded as an early exercise liability, as such shares can be repurchased by us upon employee termination at the original issuance price.

 

In April 2013, our Chief Executive Officer repaid in full his outstanding promissory note with us in the amount of $3.6 million, which covered all outstanding principal and accrued interest.

 

Investor Customers

 

As of December 31, 2012, we had two customers that were also investors, owning 532,064 and 1,938,027 shares of Series C, D, E and F convertible preferred stock. As of December 31, 2013, the same two investor customers owned 556,727 and 2,415,256 shares of our common stock. Sales to these two customers accounted for $370,000, $437,000 and $269,000 of revenue during the years ended December 31, 2011, 2012 and 2013, respectively.

 

F-36

---

Table of Contents

We have not reduced revenue related to the issuance of convertible preferred stock to related parties as we believe the issuance of the convertible preferred stock does not constitute a sales incentive. The price paid for the convertible preferred stock was representative of fair value, as evidenced by the simultaneous purchase of convertible preferred stock by other, unrelated investors.

 

Acquisition of Mandiant

 

Our Chief Executive Officer (“CEO”) and Chairman of our board of directors, served as the Chairman of the board of directors of Mandiant from April 2011 to October 2013, and served as an advisor to Mandiant from October 2013 until the closing of the merger in December 2013. In addition, as of immediately prior to the completion of the merger, the CEO held 740,166 shares of Mandiant common stock, of which 328,960 shares were unvested shares subject to forfeiture in the event of his termination as a service provider to Mandiant. Pursuant to the terms of the equity agreements governing the CEO’s shares of Mandiant common stock, all of the CEO’s unvested Mandiant shares immediately vested in connection with the merger. Upon the closing of the merger, after giving effect to the vesting acceleration described in the preceding sentence, the CEO received aggregate merger consideration of approximately $28.6 million, consisting of approximately $3.9 million in cash and 601,439 shares of our common stock, of which 87,335 shares were deposited into a third-party escrow account as partial security for the indemnity obligations of Mandiant and its former stockholders.

 

16. Segment Information

 

We conduct business globally and are primarily managed on a geographic theater basis. Our chief operating decision maker reviews financial information presented on a consolidated basis accompanied by information about revenue by geographic region for purposes of allocating resources and evaluating financial performance. We have one business activity, and there are no segment managers who are held accountable for operations, operating results, and plans for levels, components, or types of products or services below the consolidated unit level. Accordingly, we are considered to be in a single reportable segment and operating unit structure.

 

Revenue by geographic region based on the billing address is as follows (in thousands):

 

		Year Ended December 31,
		2011				2012				2013
Revenue:
United States		$	30,050			$	66,556			$	116,730
EMEA			1,129				6,628				22,845
APAC			1,142				6,488				16,004
Other			1,337				3,644				5,973
Total revenue		$	33,658			$	83,316			$	161,552

 

Substantially all of our assets were attributable to operations in the United States as of December 31, 2012, and 2013.

 

17. Subsequent Event

 

In January 2014, the Company’s Board of Directors approved the filing of a follow-on offering for the sale of up to 16,100,000 shares of common stock to the public, including up to 2,100,000 additional shares the underwriters have the option to purchase to cover over-allotments.

 

F-37

---

Table of Contents

 

Mandiant Corporation

and Subsidiaries

Consolidated Financial Statements as of

December 31, 2011 and 2012 and September 30,

2013 and for the years ended December 31, 2011 and

2012 and the nine months ended September 30, 2012

and 2013

 

 

 

F-38

---

Table of Contents

Mandiant Corporation

 

Consolidated Financial Statements Index

 

Independent Auditor’s Report			F-40
Consolidated Balance Sheets			F-41
Consolidated Statements of Comprehensive Income			F-42
Consolidated Statements of Stockholders’ Equity			F-43
Consolidated Statements of Cash Flows			F-44
Notes to the Consolidated Financial Statements			F-45

 

F-39

---

Table of Contents

Independent Auditor’s Report

 

To the Board of Directors and Shareholders of Mandiant Corporation:

 

We have audited the accompanying consolidated financial statements of Mandiant Corporation and its subsidiaries, which comprise the consolidated balance sheets as of December 31, 2011 and 2012, and the related consolidated statements of comprehensive income, stockholders’ equity, and cash flows for the years ended December 31, 2011 and 2012.

 

Management’s Responsibility for the Consolidated Financial Statements

 

Management is responsible for the preparation and fair presentation of the consolidated financial statements in accordance with accounting principles generally accepted in the United States of America; this includes the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of consolidated financial statements that are free from material misstatement, whether due to fraud or error.

 

Auditor’s Responsibility

 

Our responsibility is to express an opinion on the consolidated financial statements based on our audits. We conducted our audits in accordance with auditing standards generally accepted in the United States of America. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the consolidated financial statements are free from material misstatement.

 

An audit involves performing procedures to obtain audit evidence about the amounts and disclosures in the consolidated financial statements. The procedures selected depend on our judgment, including the assessment of the risks of material misstatement of the consolidated financial statements, whether due to fraud or error. In making those risk assessments, we consider internal control relevant to the Company’s preparation and fair presentation of the consolidated financial statements in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the Company’s internal control. Accordingly, we express no such opinion. An audit also includes evaluating the appropriateness of accounting policies used and the reasonableness of significant accounting estimates made by management, as well as evaluating the overall presentation of the consolidated financial statements. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinion.

 

Opinion

 

In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of Mandiant Corporation and its subsidiaries at December 31, 2011 and 2012, and the results of its operations and its cash flows for the years ended December 31, 2011 and 2012 in accordance with accounting principles generally accepted in the United States of America.

 

Emphasis of Matter

 

As discussed in Note 2 to the financial statements, the 2012 financial statements have been restated to correct an error. Our opinion is not modified with respect to this matter.

 

/s/ PricewaterhouseCoopers LLP

McLean, Virginia

April 2, 2013, except for Note 2 as to which the date is February 1, 2014

 

F-40

---

Table of Contents

Mandiant Corporation

 

Consolidated Balance Sheets

(in thousands, except share and per share amounts)

 

		As of December 31, 2011				As of December 31, 2012				As of September 30, 2013
										(unaudited)
Assets
Current assets
Cash and cash equivalents		$	26,753			$	2,156			$	4,651
Investments			500				17,001				12,503
Accounts receivable, net			13,369				22,198				31,738
Inventory			443				588				354
Deferred income taxes			1,331				2,004				4,221
Restricted cash, current portion			—				—				2,736
Prepaid expenses and other current assets			1,728				4,286				7,121
Total current assets			44,124				48,233				63,324
Property and equipment, net			1,260				4,939				11,049
Goodwill			—				4,853				4,853
Intangible assets, net			20				4,637				3,479
Restricted cash, non-current			42				2,774				102
Deposits			223				314				315
Deferred costs			—				99				397
Total assets		$	45,669			$	65,849			$	83,519
Liabilities and stockholders’ equity
Current liabilities
Accounts payable and accrued expenses		$	1,130			$	1,760			$	3,345
Accrued salaries and related liabilities			4,346				7,224				13,129
Income taxes payable			—				59				—
Deferred revenue, current portion			3,251				8,579				16,216
Deferred rent, current portion			57				80				287
Total current liabilities			8,784				17,702				32,977
Non-current liabilities
Deferred rent, non-current			299				340				1,919
Deferred revenue, non-current			448				558				4,094
Deferred income taxes			506				3,215				3,821
Other non-current liabilities			—				859				34
Total non-current liabilities			1,253				4,972				9,868
Total liabilities			10,037				22,674				42,845
Commitments and contingencies (Note 9)
Stockholders’ equity
Convertible Series A preferred stock, $0.01 par value, 2,027,028 shares authorized, 186,072 shares issued and outstanding as of December 31, 2011, December 31, 2012 and September 30, 2013 (unaudited); liquidation preference of $130 as of December 31, 2012 and September 30, 2013 (unaudited)			2				2				2
Convertible Series B preferred stock, $0.01 par value, 5,815,500 shares authorized, 2,684,647 shares issued and outstanding as of December 31, 2011, December 31, 2012 and September 30, 2013 (unaudited); liquidation preference of $2,383 as of December 31, 2012 and September 30, 2013 (unaudited)			27				27				27
Convertible Series C preferred stock, $0.01 par value, 10,705,700 shares authorized, 10,705,632 shares issued and outstanding as of December 31, 2011, December 31, 2012 and September 30, 2013 (unaudited); liquidation preference of $69,991 as of December 31, 2012 and September 30, 2013 (unaudited)			107				107				107
Common stock, $0.01 par value, 35,000,000 shares authorized, 6,139,074, 7,487,118 and 7,473,691 shares issued and outstanding as of December 31, 2011, December 31, 2012 and September 30, 2013 (unaudited), respectively			61				75				75
Additional paid-in capital			22,419				24,762				27,505
Retained earnings			13,016				18,207				13,022
Accumulated other comprehensive income			—				(5	)			(64	)
Total stockholders’ equity			35,632				43,175				40,674
Total liabilities and stockholders’ equity		$	45,669			$	65,849			$	83,519

 

The accompanying notes are an integral part of these financial statements.

 

F-41

---

Table of Contents

Mandiant Corporation

 

Consolidated Statements of Comprehensive Income

(in thousands)

 

		Year Ended December 31,								Nine Months Ended September 30,
		2011				2012				2012				2013
										(unaudited)
Revenues
Services		$	46,715			$	71,556			$	52,291			$	71,341
Product sales			6,716				10,750				6,431				7,105
Total revenues			53,431				82,306				58,722				78,446
Operating expenses
Engineering and cost of revenues			22,582				42,512				28,973				54,709
Research and development expense			4,110				5,090				3,716				5,778
Selling, general and administrative expense			11,409				25,425				16,481				26,379
Total operating expenses			38,101				73,027				49,170				86,866
Income (loss) from operations			15,330				9,279				9,552				(8,420	)
Other income (expense)
Interest income			4				4				1				3
Interest expense			—				—				—				(5	)
Loss on disposal of property and equipment			(16	)			—				—				—
Total other income (expense)			(12	)			4				1				(2	)
Income (loss) before income taxes			15,318				9,283				9,553				(8,422	)
Income tax (expense) benefit			(5,879	)			(4,086	)			(4,240	)			3,237
Net income (loss)		$	9,439			$	5,197			$	5,313			$	(5,185	)
Other comprehensive loss, net of tax			—				(5	)			(3	)			(59	)
Total comprehensive income (loss)		$	9,439			$	5,192			$	5,310			$	(5,244	)

 

The accompanying notes are an integral part of these financial statements.

 

F-42

---

Table of Contents

Mandiant Corporation

 

Consolidated Statements of Stockholders’ Equity

(in thousands, except for share amounts)

 

		Convertible Preferred Stock																								Common Stock								Additional Paid-In Capital				Other Comprehensive Income				Retained Earnings				Total Stockholders’ Equity
		Series A								Series B								Series C
		Shares				Par Value				Shares				Par Value				Shares				Par Value				Shares				Par Value
Balance, December 31, 2010			2,027,028				20				5,815,500				58				—				—				10,060,921				101				7,515				—				4,877				12,571
Issuance of Series C convertible preferred stock			—				—				—				—				10,705,632				107				—				—				67,629				—				—				67,736
Common stock warrants issued with Series C convertible preferred stock			—				—				—				—				—				—				—				—				1,300				—				(1,300	)			—
Redemption of shares in connection with Series C convertible preferred stock			(1,373,821	)			(13	)			(3,033,131	)			(30	)			—				—				(1,725,766	)			(18	)			(38,115	)			—				—				(38,176	)
Redemption of shares of Series A and Series B convertible preferred stock			(467,135	)			(5	)			(97,722	)			(1	)			—				—				(2,682,567	)			(26	)			(20,183	)			—				—				(20,215	)
Tax benefit from redemption of shares			—				—				—				—				—				—				—				—				3,050				—				—				3,050
Tax benefit from stockholder redemption			—				—				—				—				—				—				—				—				730				—				—				730
Stock options exercised			—				—				—				—				—				—				486,486				4				230				—				—				234
Share-based compensation			—				—				—				—				—				—				—				—				263				—				—				263
Net income			—				—				—				—				—				—				—				—				—				—				9,439				9,439
Balance, December 31, 2011			186,072				2				2,684,647				27				10,705,632				107				6,139,074				61				22,419				—				13,016				35,632
Restricted share compensation			—				—				—				—				—				—				1,340,166				14				(13	)			—				—				1
Stock options exercised			—				—				—				—				—				—				84,996				1				72				—				—				73
Cancellation of stock options			—				—				—				—				—				—				—				—				(827	)			—				—				(827	)
Repurchases			—				—				—				—				—				—				(77,118	)			(1	)			(83	)			—				(6	)			(90	)
Tax benefit for cancellation of stock options			—				—				—				—				—				—				—				—				316				—				—				316
Share-based compensation			—				—				—				—				—				—				—				—				2,878				—				—				2,878
Foreign currency translation adjustment			—				—				—				—				—				—				—				—				—				(5	)			—				(5	)
Net income			—				—				—				—				—				—				—				—				—				—				5,197				5,197
Balance, December 31, 2012			186,072				2				2,684,647				27				10,705,632				107				7,487,118				75				24,762				(5	)			18,207				43,175
Stock options exercised (unaudited)			—				—				—				—				—				—				64,419				1				69				—				—				70
Cancellation of stock options (unaudited)			—				—				—				—				—				—				—				—				(960	)			—				—				(960	)
Repurchases (unaudited)			—				—				—				—				—				—				(77,846	)			(1	)			(623	)			—				—				(624	)
Tax benefit for cancellation of stock options (unaudited)			—				—				—				—				—				—				—				—				627				—				—				627
Share-based compensation (unaudited)			—				—				—				—				—				—				—				—				3,630				—				—				3,630
Foreign currency translation adjustment (unaudited)			—				—				—				—				—				—				—				—				—				(59	)			—				(59	)
Net loss (unaudited)			—				—				—				—				—				—				—				—				—				—				(5,185	)			(5,185	)
Balance, September 30, 2013 (unaudited)			186,072			$	2				2,684,647			$	27				10,705,632			$	107				7,473,691			$	75			$	27,505			$	(64	)		$	13,022			$	40,674

 

The accompanying notes are an integral part of these financial statements.

 

F-43

---

Table of Contents

Mandiant Corporation

 

Consolidated Statements of Cash Flows

(in thousands)

 

		Year Ended December 31,								Nine Months Ended September 30,
		2011				2012				2012				2013
						(Restated)				(unaudited)
Cash flows from operating activities
Net income (loss)		$	9,439			$	5,197			$	5,313			$	(5,185	)
Adjustments to reconcile net income to net cash and cash equivalents provided by operating activities
Depreciation and amortization			343				1,671				776				3,112
Loss on disposal of property and equipment			17				—				—				—
Provision for doubtful accounts			383				(141	)			(122	)			519
Deferred income taxes			(663	)			354				—				(1,611	)
Share-based compensation			263				2,878				1,935				3,630
(Increase) decrease in cash from changes in
Accounts receivable			(5,131	)			(8,663	)			(6,333	)			(10,059	)
Inventory			(247	)			(145	)			(404	)			234
Deposits			(114	)			(91	)			(444	)			(1	)
Deferred costs			29				(99	)			—				(298	)
Prepaid expenses and other current assets			(1,388	)			(2,556	)			(567	)			(2,835	)
Accounts payable and accrued expenses			471				610				317				1,239
Accrued salaries and related liabilities			2,303				3,726				1,962				5,080
Income taxes payable			(676	)			59				497				(59	)
Deferred revenue			1,425				5,363				2,339				11,173
Deferred rent			160				64				63				1,786
Net cash and cash equivalents provided by operating activities			6,614				8,227				5,332				6,725
Cash flows from investing activities
Purchase of Unveillance, Inc., net of cash acquired			—				(8,241	)			(8,241	)			—
Change in restricted cash			(1	)			(2,732	)			(2,730	)			(64	)
Purchases of investments			—				(17,001	)			(17,000	)			(6,000	)
Proceeds from maturity of investments			1,498				500				500				10,498
Purchases of property and equipment			(589	)			(4,818	)			(2,140	)			(7,718	)
Net cash and cash equivalents provided by (used in) investing activities			908				(32,292	)			(29,611	)			(3,284	)
Cash flows from financing activities
Proceeds from issuance of Series C convertible preferred stock			67,736				—				—				—
Payments from redemption of shares in connection with issuance of Series C convertible preferred stock			(38,176	)			—				—				—
Payments for stock tender in connection with redemption of Series A and Series B convertible preferred stock			(20,215	)			—				—				—
Payments for purchase of common stock			—				(90	)			(13	)			(624	)
Excess tax benefit from stock tender in connection with Series C convertible preferred stock			3,050				—				—				—
Excess tax benefit from stockholder redemption			730				—				—				—
Payments on notes payable			(23	)			—				—				—
Payments for cancellation of stock options			—				(827	)			(237	)			(960	)
Excess tax benefit for cancellation of stock options			—				316				91				627
Proceeds from stock option exercises			234				74				36				70
Net cash and cash equivalents provided by (used in) financing activities			13,336				(527	)			(123	)			(887	)
Effect of currency exchange rate changes on cash			—				(5	)			(2	)			(59	)
Net increase (decrease) in cash and cash equivalents			20,858				(24,597	)			(24,404	)			2,495
Cash and cash equivalents
Beginning of year			5,895				26,753				26,753				2,156
End of year		$	26,753			$	2,156			$	2,349			$	4,651
Supplemental information
Interest paid		$	—			$	—			$	—			$	—
Income taxes paid			3,851				4,827				2,600				—

 

The accompanying notes are an integral part of these financial statements.

 

F-44

---

Table of Contents

Mandiant Corporation

 

Notes to Consolidated Financial Statements

 

1. Organization and summary of significant accounting policies

 

Organization

 

Mandiant Corporation (the “Company”) was incorporated under the laws of the state of Delaware on January 18, 2006. The Company offers proactive and responsive security-related professional services, education, managed services, software and hardware products to the financial service sector, legal community, government agencies, and other domestic and international clients. The Company has operations in Washington D.C., New York City, Los Angeles, San Francisco, the United Kingdom and Ireland.

 

On December 30, 2013, the Company entered into a merger agreement with FireEye, Inc. (“FireEye”). See Note 16 for more information about the merger.

 

Basis of Presentation

 

The accompanying consolidated financial statements have been prepared in accordance with generally accepted accounting principles in the United States of America (“GAAP”) and consistent with Article 10 of Regulation S-X under the Securities Exchange Act of 1934, as amended. The accompanying consolidated financial statements include the accounts of the Company and its wholly-owned subsidiaries. All significant intercompany transactions and balances have been eliminated.

 

Unaudited Interim Financial Information

 

The accompanying interim consolidated balance sheet as of September 30, 2013, the related interim consolidated statements of comprehensive income and cash flows for the nine months ended September 30, 2012 and 2013, the statement of stockholders’ equity for the nine months ended September 30, 2013 and the related footnote disclosures are unaudited. These unaudited interim consolidated financial statements have been prepared in accordance with accounting principles generally accepted in the United States of America (“U.S. GAAP”), and following the requirements of the Securities and Exchange Commission (“SEC”), for interim reporting. In management’s opinion, the unaudited interim consolidated financial statements have been prepared on the same basis as the annual financial statements and include all adjustments, which include only normal recurring adjustments, necessary for the fair presentation of the financial position as of September 30, 2013 and the consolidated results of comprehensive income and cash flows for the nine months ended September 30, 2012 and 2013. The results for the nine months ended September 30, 2013 are not necessarily indicative of the results expected for the full fiscal year.

 

Use of Accounting Estimates

 

The preparation of financial statements in conformity with GAAP requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities and disclosure of contingent assets and liabilities at the date of the financial statements and the reported amounts of revenues and expenses during the reporting period. Actual results could differ from those estimates.

 

Recent Accounting Pronouncements

 

In 2013, the Financial Accounting Standards Board (“FASB”) issued new accounting guidance clarifying the accounting for the release of cumulative translation adjustment into net income when a parent either sells a part or all of its investment in a foreign entity or no longer holds a controlling financial interest in a subsidiary or

 

F-45

---

Table of Contents

group of assets that is a nonprofit activity or a business within a foreign entity. This new guidance is effective for fiscal years, and interim periods within those fiscal years, beginning on or after December 15, 2013. The Company does not anticipate that this adoption will have a significant impact on the Company’s financial position, results of operations or cash flows.

 

In 2013, the FASB also issued new accounting guidance requiring disclosure of items reclassified from other comprehensive income (loss) to net income. This guidance is effective for periods beginning after December 15, 2012. The adoption of this standard did not have any impact on the Company’s financial position, results of operations or cash flows.

 

Cash and Cash Equivalents

 

For purposes of financial statement presentation, the Company considers all highly liquid debt instruments with initial maturities of ninety days or less to be cash equivalents. The Company maintains cash balances which may exceed federally insured limits. Management does not believe that this results in any significant credit risk.

 

Investments

 

Investments consist of U.S. Treasury Bills that are classified as held-to-maturity and measured at amortized cost, which approximates fair value as of the balance sheet date.

 

Accounts Receivable

 

Accounts receivable include amounts billed and currently due from customers and unbilled costs and accrued profits primarily related to revenues that have been recognized for accounting purposes but not yet billed to customers. Accounts receivable are recognized at face value and reduced by an allowance for doubtful accounts. The allowance for doubtful accounts reflects the best estimate of probable losses determined principally on the basis of historical experience and specific allowances for known troubled accounts. All accounts or portions thereof that are deemed to be uncollectible or that require an excessive collection cost are written off to the allowance for doubtful accounts.

 

Inventory

 

Inventory consists of hardware and purchased materials and is stated at the lower of cost or market. Cost is determined using the specific identification method.

 

Property and Equipment

 

Property and equipment are recorded at original cost and are being depreciated on a straight-line basis over estimated lives of three to seven years. Leasehold improvements are amortized over the life of the assets or the remaining period of the lease, whichever is shorter. Repairs and maintenance costs are expensed as incurred.

 

Goodwill

 

Goodwill represents the excess of cost over fair value of assets acquired from the Unveillance, Inc. (“Unveillance”) transaction. Goodwill acquired in a business combination is not amortized, but instead reviewed for impairment annually, or more frequently, if impairment indicators arise.

 

Intangible Assets

 

The Company’s intangible assets consist of internally developed patents, as well as developed technology, in-process technology, a malware database, and customer relationships acquired in September 2012 with the Company’s purchase of Unveillance (Note 3). Patents consist of legal fees paid by the Company to register the patents. The Company amortizes its intangible assets on a straight-line basis over their estimated useful lives of three to five years. The Company periodically reviews intangible assets for impairment.

 

F-46

---

Table of Contents

Restricted Cash

 

Restricted cash as of December 31, 2011 consists of collateral for one of the Company’s operating leases. Restricted cash as of December 31, 2012 consists of this collateral amount, as well as amounts payable to a former stockholder of Unveillance. See Note 3 for further discussion on the acquisition of Unveillance.

 

Restricted cash as of September 30, 2013 consists of amounts payable to a former stockholder of Unveillance, which is classified as current, as well as collateral held for financial obligations in a foreign jurisdiction, which is classified as non-current.

 

Deferred Costs

 

Deferred costs represent hardware costs related to service offerings for which a separate unit of accounting has not been established. Accordingly, those costs are recognized ratably over the same period as the underlying deferred revenues, which is generally one to three years.

 

Deferred Rent

 

The Company recognizes the minimum non-contingent rents required under operating leases as rent expense on a straight-line basis over the life of the lease, with differences between amounts recognized as expense and the amounts actually paid recorded as deferred rent in the accompanying consolidated balance sheets.

 

Revenue

 

The Company’s revenues are primarily derived from product sales, maintenance on those products, and contracts to provide services. The Company recognizes revenue when persuasive evidence of an arrangement exists, delivery has occurred or services have been rendered, the fee is fixed or determinable and collection is reasonably assured. The Company considers the nature of these contracts and the types of services provided when it determines the proper accounting method for a particular contract.

 

In certain arrangements, the Company enters into contracts that include the delivery of a combination of two or more of its service offerings. Such contracts are divided into separate units of accounting and revenue is recognized separately based on relative fair value, and in accordance with the Company’s revenue recognition policy for each element. The majority of the Company’s products are software containing hardware components that operate together to provide the essential functionality of the product.

 

Product sales include revenue from the sale of perpetual software licenses and hardware sold in conjunction with such licenses. Software licenses are recognized as revenue upon the customer’s execution of a non-cancelable license agreement and delivery of the software, provided that the fee is fixed and determinable, collectability is probable, and no customization of the software is required. Customer support and maintenance revenue, such as telephone support and product enhancements, is unbundled from the software license and is recognized ratably over the maintenance period. Installation and other professional services are generally unbundled from the software license and recognized on performance.

 

Revenue from fixed-price type service contracts is recognized under the proportional performance method of accounting, with costs and estimated profits included in revenue as work is performed. Revenue from time and materials contracts is recognized as costs are incurred at amounts represented by the agreed-upon billing amounts.

 

Deferred revenue arises as a result of differences between the timing of revenue recognition and the receipt of cash from a Company’s customers. For the Company, deferred revenue generally results from the following: deferred technical and managed services support and cash received for professional services not yet rendered.

 

F-47

---

Table of Contents

Software Development Costs

 

In the course of business the Company incurs certain software product development costs on software intended for external use. Capitalization of software production costs related to external use can begin upon the establishment of technological feasibility. The Company defines the establishment of technological feasibility as the completion of a working model of the software product that has been tested to be consistent with the product design specifications and that is free of any uncertainties related to known high-risk development issues. The establishment of technological feasibility and the ongoing assessment of recoverability of capitalized software development costs require considerable judgment by management with respect to certain external factors including, but not limited to, materiality, anticipated future gross revenue, estimated economic life, and changes in software and hardware technologies.

 

During the years ended December 31, 2011 and 2012 such costs were deemed insignificant and have been charged to operations in the accompanying statements of comprehensive income. During the nine months ended September 30, 2013, $587,000 of software development costs were capitalized and are included in property and equipment in the accompanying consolidated balance sheet as of September 30, 2013.

 

Research and Development

 

Research and development costs are expensed as incurred. Costs for the development of new software products and substantial enhancements to existing software products are expensed as research and development costs as incurred until technological feasibility has been established. Upfront and milestone payments made to third-parties in connection with research and development collaborations are expensed as incurred up to the point of regulatory approval.

 

The majority of the Company’s products and product improvements have been developed internally. Total expenditures for product research and development for the years ended December 31, 2011 and 2012 were $4.1 million and $5.1 million, respectively, and $3.7 million and $5.8 million for the nine months ended September 30, 2012 and 2013, respectively.

 

Income Taxes

Current income tax expense is the amount of income taxes expected to be payable for the current year. Deferred income taxes are recognized for the tax consequences in future years of differences between the tax bases of assets and liabilities and their financial reporting amounts at each year end based on enacted tax laws and statutory tax rates applicable to the periods in which the differences are expected to affect taxable earnings. Valuation allowances are established when necessary to reduce deferred tax assets to the amount more likely than not to be realized.

 

Advertising Costs

 

The Company expenses advertising costs as incurred. Advertising expense for the years ended December 31, 2011 and 2012 was $4,000 and $801,000, respectively, and $556,000 and $387,000 for the nine months ended September 30, 2012 and 2013, respectively.

 

F-48

---

Table of Contents

Stock Based Compensation

 

The Company measures compensation expense for its stock based compensation plans based on the grant date fair value of the equity instruments, which is recognized as compensation expense ratably over the service period. Compensation expense for incentive stock options is determined using the Black-Scholes model, with the following significant assumptions:

 

		Year Ended December 31, 2011		Year Ended December 31, 2012		Nine Months Ended September  30, 2012		Nine Months Ended September  30, 2013
						(unaudited)
Volatility		55%		52%		52%		49%
Expected term		6 years		6 years		6 years		6 years
Annual dividend rate		0%		0%		0%		0%
Risk free interest rate		1.13% – 4.04%		0.75% – 1.09%		0.75% – 1.10%		0.67% – 1.84%

 

The expected life represents the period of time the stock options are expected to be outstanding and is based on the “simplified method.” Under the “simplified method,” the expected life of an option is presumed to be the mid-point between the vesting date and the end of the contractual term. The Company used the “simplified method” due to the lack of sufficient historical exercise data to provide a reasonable basis upon which to otherwise estimate the expected life of the stock options. Volatility was determined by reference to the historical volatility of comparable companies, as the Company’s own shares lack sufficient trading history to determine volatility. The expected dividends are based on management’s expectations for dividend issuances in the future. The risk free interest rate is based on the U.S. Treasury yield curve in effect at the time of grant. Forfeitures are based on the Company’s actual experience with the options awarded.

 

Fair Value Measurements

 

The carrying amounts of certain of the Company’s financial instruments, including cash and cash equivalents, accounts receivable, accounts payable and accrued expenses, approximate their respective fair values due to their short-term nature.

 

The Company uses a three-tier fair value hierarchy to classify and disclose all assets and liabilities measured at fair value on a recurring basis, as well as assets and liabilities measured at fair value on a non-recurring basis, in periods subsequent to their initial measurement. The hierarchy requires the Company to use observable inputs when available, and to minimize the use of unobservable inputs when determining fair value. The three tiers are defined as follows:

 

•

Level 1. Observable inputs based on unadjusted quoted prices in active markets for identical assets or liabilities;

 

•

Level 2. Inputs, other than quoted prices in active markets, that are observable either directly or indirectly; and

 

•

Level 3. Unobservable inputs for which there is little or no market data, which require the Company to develop its own assumptions.

 

The only applicable Level 1 assets are the investments disclosed in Note 5. The Company does not have any Level 2 or Level 3 investments.

 

Concentration of Credit Risk

 

Financial instruments that subject the Company to significant concentrations of credit risk consist primarily of cash and cash equivalents and accounts receivable. All of the Company’s cash and cash equivalents are held at financial institutions that management believes to be of high credit quality. The Company’s cash and cash equivalent accounts exceed federally insured limits at times. The Company has not experienced any losses on cash and cash equivalents to date. To manage accounts receivable risk, the Company evaluates the creditworthiness of its customers and maintains an allowance for doubtful accounts.

 

F-49

---

Table of Contents

As of December 31, 2011, two customers each represented approximately 12% of total accounts receivable. The Company did not have any one customer with a significant outstanding balance as of December 31, 2012 and September 30, 2013. Contracts with the federal government accounted for approximately 0%, 4% and 3% of total accounts receivable as of December 31, 2011 and 2012 and September 30, 2013, respectively. The Company does not require collateral or other arrangements in connection with these receivables.

 

There were no contracts that generated greater than 10% of revenue in the years ended December 31, 2011 and 2012 and the nine months ended September 30, 2012 and 2013. Contracts with the federal government accounted for 20% and 15% of the Company’s total revenue for the years ended December 31, 2011 and 2012, respectively, and 15% and 4% for the nine months ended September 30, 2012 and 2013, respectively.

 

Reclassifications

 

Certain 2011 balances have been reclassified to conform to the current period presentation.

 

2. Restatement of Prior Period Financial Statements

 

During the nine months ended September 30, 2013, the Company identified an error in the classification of changes in its restricted cash within the Statement of Cash Flows for the year ended December 31, 2012. The Company has concluded the impact of this error is material to its previously issued December 31, 2012 financial statements. As a result, the 2012 financial statements have been restated to reflect the correction of this error. The correction of this error resulted in increases in the cash provided by operating activities and cash used in investing activities; however, there was no effect on the Company’s net change in cash and cash equivalents for the year then ended. No other financial statements were affected by this error.

 

The table below summarizes the correction of each of the affected line items within the statement of cash flows (in thousands):

 

		For the year ended December 31, 2012
		As Reported				Adjustment				As Restated
Change in restricted cash		$	(2,732	)		$	2,732				—
Net cash and cash equivalents provided by operating activities			5,495				2,732				8,227
Change in restricted cash			—				(2,732	)			(2,732	)
Net cash and cash equivalents used in investing activities			(29,560	)			(2,732	)			(32,292	)

 

3. Acquisition

 

On September 10, 2012, the Company acquired Unveillance pursuant to the Stock Purchase Agreement (“Agreement”). The acquisition allowed Mandiant access to Unveillance’s malware database, and provided Mandiant with a new dimension service. The aggregate consideration paid to the stockholders of Unveillance was approximately $8.3 million, plus an additional $1.7 million (“holdback amount”) which was placed into an interest-bearing segregated bank account of the Company to satisfy potential working capital adjustments and indemnification liabilities of Unveillance and its stockholders. The holdback amount, less amounts set aside for unresolved claims, will be disbursed to the selling stockholder on September 10, 2014. The Company also entered into employment agreements with certain key employees of Unveillance that provides for retention payments in the amount of $3.0 million to be paid at the one and two-year anniversaries of the acquisition if the employees are still employed with the Company. The Company was required to place $1.0 million of the retention amount into the interest-bearing segregated bank account used for the holdback amount. As of December 31, 2012, the balance related to the holdback amount and retention amount was $2.7 million and is included in restricted cash on the consolidated balance sheets. The Company is expensing the holdback and retention bonus amounts ratably over the two years subsequent to the purchase. The acquisition was funded by cash on hand.

 

F-50

---

Table of Contents

The purchase price was allocated to underlying assets and liabilities based on their estimated fair values at the date of acquisition. The purchase price allocation includes goodwill and other intangible assets. Recognition of goodwill is largely attributed to the assembled workforce of Unveillance and other factors. None of the goodwill recognized for the Unveillance acquisition is expected to be deductible for income tax purposes. The following table represents the final purchase price allocation (in thousands):

 

Cash		$	31
Accounts receivable			25
Prepaid expenses and other current assets			2
Property and equipment			5
Goodwill			4,853
Intangibles			5,143
Accounts payable and accrued expenses			(20	)
Accrued salaries and related liabilities			(11	)
Deferred revenue			(75	)
Deferred tax liabilities			(1,682	)
Net purchase price		$	8,271

 

In allocating the purchase price, the Company considered, among other factors, analyses of historical financial performance and estimates of future performance of Unveillance’s business, as well as an analysis of the industry in which Unveillance operates. The intangible assets acquired included developed technology of $1.3 million, in-process technology of $130,000, the malware database of $3.7 million and customer relationships of $13,000.

 

During the year ended December 31, 2012, the Company expensed $42,000 in transaction costs related to the acquisition. These costs are included in selling, general and administrative expense in the accompanying consolidated statements of comprehensive income.

 

4. Accounts Receivable

 

Accounts receivable as of December 31, 2011 and 2012 and September 30, 2013 consist of amount due under contracts in progress with Federal Government agencies and commercial entities. Billed accounts receivable are expected to be collected within the following year. The components of accounts receivable are as follows as of (in thousands):

 

		December 31,								September  30, 2013
		2011				2012
										(unaudited)
Trade accounts receivable		$	10,341			$	15,799			$	26,655
Unbilled receivables			3,855				7,085				6,237
Total accounts receivable			14,196				22,884				32,892
Less: Allowance for doubtful accounts			(827	)			(686	)			(1,154	)
Accounts receivable, net of allowance for doubtful accounts		$	13,369			$	22,198			$	31,738

 

5. Investments

 

Investments are classified as held-to-maturity and consist of the following as of (in thousands):

 

		December 31,								September  30, 2013
		2011				2012
										(unaudited)
U.S. Treasury Bills		$	500			$	17,001			$	12,503

 

F-51

---

Table of Contents

Treasury bills are recorded at amortized cost. No unrealized gains or losses existed as of December 31, 2011 and 2012 and September 30, 2013. These investments are expected to mature within one year of September 30, 2013.

 

6. Property and Equipment

 

Property and equipment, net consist of the following as of (in thousands):

 

		December 31,								September  30, 2013
		2011				2012
										(unaudited)
Furniture, fixtures and equipment		$	1,765			$	4,472			$	8,683
Software			290				1,213				2,876
Leasehold improvements			340				1,518				3,671
			2,395				7,203				15,230
Less: Accumulated depreciation and amortization			(1,135	)			(2,264	)			(4,181	)
Property and equipment, net		$	1,260			$	4,939			$	11,049

 

Depreciation expense related to property and equipment for the years ended December 31, 2011 and 2012 was $329,000 and $1.1 million, respectively, and $638,000 and $1.9 million for the nine months ended September 30, 2012 and 2013, respectively.

 

7. Intangible Assets

 

Intangible assets consisted of the following as of (dollars in thousands):

 

		Useful Life (in years)				December 31,																September  30, 2013
						2011								2012
																						(unaudited)
						Cost				Accumulated Amortization				Cost				Accumulated Amortization				Cost				Accumulated Amortization
Patents			5			$	71			$	(51	)		$	71			$	(65	)		$	71			$	(68	)
Malware database			3												3,684				(409	)			3,684				(1,330	)
Developed technology			5												1,316				(88	)			1,316				(285	)
In-process technology			3												130				(14	)			130				(47	)
Customer relationships			3												13				(1	)			13				(5	)
Total						$	71			$	(51	)		$	5,214			$	(577	)		$	5,214			$	(1,735	)

 

The intangible assets have no residual value at the end of their useful lives. Amortization expense for the years ended December 31, 2011 and 2012 was $14,000 and $526,000, respectively, and $138,000 and $1.2 million for the nine months ended September 30, 2012 and 2013, respectively. Estimated amortization expense for the next five years as of September 30, 2013 is as follows (unaudited, in thousands):

 

Year Ending December 31,
2013 (for the remaining three months)		$	385
2014			1,539
2015			1,114
2016			263
2017			175

 

F-52

---

Table of Contents

8. Line of Credit

 

During the year ended December 31, 2010, the Company obtained a revolving line of credit agreement with Bank of America. Under the terms of the agreement, the Company was able to borrow up to $5.0 million, (limited by a borrowing base as defined in the agreement), with interest at the BBA LIBOR daily floating rate plus 2.25%. The line was secured by substantially all assets of the Company. The line of credit contained various financial covenants, which included a funded debt to EBITDA ratio and a basic fixed charge coverage ratio, and was subject to periodic review by the bank. The Company was in compliance with the financial covenants as of December 31, 2011. There was no outstanding balance on the line of credit as of December 31, 2011. The line of credit expired on October 31, 2012.

 

On September 21, 2012, the Company obtained a revolving line of credit from Silicon Valley Bank, which expired on September 20, 2013. Under the terms of the agreement, the Company was able to borrow up to $5.0 million, limited by a borrowing base as defined in the agreement, with interest at the Wall Street Journal prime rate. The line of credit was secured by a blanket security interest on all of the Company’s assets. The line of credit contained a minimum adjusted quick ratio covenant not to exceed 1.75:1, which the Company was in compliance with at December 31, 2012. There was no outstanding balance on the line of credit at December 31, 2012.

 

9. Income Taxes

 

For the years ended December 31, 2011 and 2012, the components of the provision of income taxes consisted of (in thousands):

 

		2011				2012
Current
Federal		$	4,987			$	2,966
State			1,555				765
			6,542				3,731
Deferred
Federal			(516	)			315
State			(147	)			40
			(663	)			355
Provision for income taxes		$	5,879			$	4,086

 

The provision for income taxes for the years ended December 31, 2011 and 2012 reflected in the accompanying financial statements varies from the amount which would have been computed using statutory rates as follows (in thousands):

 

		2011				2012
Income tax computed at the Federal statutory rate		$	4,835			$	3,169
State income tax, net of Federal income tax effects			1,372				450
Permanent differences and other			(4	)			197
Share-based compensation			—				348
R & D Credit (elected reduced credit)			(324	)			—
Domestic production activities deduction			—				(78	)
Provision for income taxes		$	5,879			$	4,086

 

F-53

---

Table of Contents

The components of the temporary differences are as follows (in thousands):

 

		2011				2012
Accrued payroll liabilities		$	1,010			$	1,422
Allowance for doubtful accounts			329				263
Depreciation and amortization			(506	)			(2,553	)
Prepaid expenses			(275	)			(223	)
Deferred rent			142				161
Deferred revenue			72				55
Share-based compensation			53				(541	)
Net operating losses			—				205
Net temporary differences		$	825			$	(1,211	)

 

The Company applies the provisions of ASC 740-10 to uncertain tax positions. ASC 740-10 clarifies accounting for income taxes by prescribing a minimum probability threshold that a tax position must meet before a financial statement benefit is recognized. If the probability for sustaining a tax position is greater than 50%, then the tax position is warranted and recognition should be at the highest amount which would be expected to be realized upon settlement. At December 31, 2012 and September 30, 2013, the Company recognized an accrual for uncertain tax positions of $129,000 and $82,000, respectively.

 

The Company recognizes penalties and interest related to unrecognized tax benefits as a component of income tax expense.

 

The Company has analyzed its filing positions in all significant federal, state and foreign jurisdictions where it is required to file income tax returns, as well as open tax years in these jurisdictions. With few exceptions, the Company is no longer subject to U.S. federal, state and local tax examinations by tax authorities for the years prior to 2010.

 

The Company permanently reinvests cumulative undistributed earnings of its non-U.S. subsidiary in non-U.S. operations. U.S. federal income taxes have not been provided for in relation to undistributed earnings to the extent that they are permanently reinvested in the Company’s non-U.S. operations. It is not practical at this time to determine the income tax liability that would result upon repatriation to the United States. As of December 31, 2012 and September 30, 2013, the undistributed earnings of the Company’s foreign subsidiary were immaterial.

 

10. Commitments and Contingencies

 

Operating Lease Commitments

 

The Company is obligated, as lessee, under non-cancellable operating leases for office space in New York, Virginia, California, New Mexico, Michigan, Ohio, Ireland and the United Kingdom.

 

The following is a schedule by years of future minimum rental payments required under the operating leases that have an initial or remaining non-cancellable lease term in excess of one year as of December 31, 2012 (in thousands):

 

Year Ending December 31,
2013		$	2,643
2014			2,775
2015			2,516
2016			1,835
2017			1,583
		$	11,352

 

F-54

---

Table of Contents

Total rent expense for the years ended December 31, 2011 and 2012 was $1.2 million and $2.0 million, respectively, and $1.4 million and $2.5 million for the nine months ended September 30, 2012 and 2013, respectively.

 

Legal Contingencies

 

The Company is a party to a variety of legal proceedings that arise in the normal course of business. While the results of such normal course legal proceedings cannot be predicted with certainty, management believes, based on current knowledge, that the final outcome of any matters will not have a material adverse effect on the Company’s business, financial position, results of operations or cash flows.

 

11. Retirement Plan

 

The Company sponsors a tax deferred retirement plan under the Internal Revenue Code to provide retirement benefits for all eligible employees. Participating employees may voluntarily contribute up to limits provided by Internal Revenue Service regulations. The Company has elected to have a safe harbor match which equals to 100% on the first 4% of compensation deferred as an elective deferral at year end. All employees are immediately vested in the safe harbor contributions. The Company contributed $631,000 and $1.2 million to the plan during the years ended December 31, 2011 and 2012, respectively, and $755,000 and $1.4 million for the nine months ended September 30, 2012 and 2013, respectively.

 

12. Stockholders’ Equity

 

The Company is authorized to issue two classes of stock to be designated common stock and preferred stock. As of September 30, 2013, the Company had one class of common stock and three separate series of preferred stock, “Series A,” “Series B,” and “Series C.” The Company is authorized to issue a total of 35,000,000 shares of common stock and 18,548,228 shares of preferred stock, of which 2,027,028 are Series A, 5,815,500 are Series B and 10,705,700 are Series C. Both the common stock and preferred stock have a par value of $0.01 per share.

 

Preferred Series C Investment

 

On April 6, 2011, the Company amended its capital structure and authorized the sale of Series C preferred stock. The Company issued 10,705,632 shares of Series C convertible preferred stock with a value of $6.54 per share, and received proceeds of $67.7 million, net of $2.3 million in closing costs. The proceeds of the issuance were to be used for redemption of outstanding shares as well as general corporate purposes.

 

In conjunction with the Series C investment the Company repurchased 6,132,718 outstanding shares, including 1,725,766 of common stock, 1,373,821 of Series A preferred and 3,033,131 of Series B preferred, for a total cost of $29.5 million, net of closing costs. The Company retired all of the repurchased shares upon repurchase.

 

In connection with the Series C preferred stock issuance, the Company issued 204,043 warrants to purchase common shares of the Company at an exercise price equal to $0.01, exercisable through April 5, 2016. The value of these warrants amounted to $1.3 million. All of these warrants remained outstanding as of September 30, 2013.

 

Prior to April 2011, the Company had two classes of common stock. As part of the Preferred Series C investment, the Company re-characterized the two classes of stock into one class.

 

Tender Offer

 

In May 2011, the Company entered into a tender offer to buy back up to 43.82% or 3,247,424 shares of vested options or shares of stock, including 2,682,567 shares of common stock, 467,135 shares of Series A, and

 

F-55

---

Table of Contents

97,722 shares of Series B. The offer was fully subscribed and the Company paid $20.2 million for the shares. The Company received a tax deduction of $9.5 million as a result of the tender offer. All of the repurchased shares were retired by the Company upon the repurchase.

 

Common Stock

 

The common stock has a par value of $0.01. The key rights of the common stock include the following:

 

•

Dividends—Common stockholders are entitled to dividends as declared by the board of directors. Dividends are subject to any preferential dividend rights of any then outstanding preferred stock.

 

•

Liquidation preference—In the event of any liquidation, dissolution, or winding up of the Company, the common stockholders are entitled to receive, after payments are made with respect to preferred stock, a ratable distribution of the remaining assets of the Company along with the preferred stockholders, subject to any preferential dividend rights of any then outstanding preferred stock.

 

•

Voting rights—The holders of common stock are entitled to one vote for each share of common stock held.

 

During 2010, the Company determined that a stockholder had issued incentive stock options to certain employees to purchase 2,315,000 shares of common stock from the stockholder. There were 575,000 and 485,000 of these options outstanding as of December 31, 2012 and September 30, 2013, respectively.

 

Convertible Preferred Stock

 

All classes of the preferred stock have a par value of $0.01. The key rights of the preferred stock include the following:

 

•

Dividends—If the board of directors shall have declared dividends with respect to the common stock, then simultaneously with the payment of such dividends with respect to the shares of common stock the Company shall pay dividends on the shares of preferred stock, on an as-if-converted to common stock basis, in an amount per share equal to the amount per share paid on each share of common stock.

 

•

Voting Rights—Each holder of outstanding shares of Series A, Series B and Series C convertible preferred stock is entitled to the number of votes equal to the number of the whole shares of common stock into which the shares of Series A, Series B and Series C preferred stock held by such holders are convertible.

 

•

Liquidation Preference—In the event of any liquidation, dissolution, or winding up of the Company, the holders of Series A, Series B and Series C preferred stock are entitled to receive, before any payments shall be made in respect to common stock, an amount per share equal to the original issue price, subject to adjustments, plus all accrued and unpaid dividends on the classes of preferred stock. Such original issue prices were $0.703 per share for the Series A preferred stock, $0.8878 per share for the Series B preferred stock and $6.53782 per share for the Series C preferred stock.

 

•

Conversion Rights—Each Series A, Series B and Series C convertible preferred share is convertible, at any time, at the option of the holder into such number of shares of common stock as determined by dividing the original issue price of preferred stock by the series preferred conversion price which shall initially be the original issue price of the preferred stock. The conversion ratio is subject to equitable adjustment for stock splits, combinations or similar transactions, common stock dividends and distributions, or the sale of shares below the respective conversion prices.

 

13. Stock Option Plan

 

The Company’s 2011 Equity Incentive Plan (the “2011 Plan”) provides for the award of stock options, stock bonuses and restricted stock awards. In addition to the 2011 Plan, the Company has one other stock option plan

 

F-56

---

Table of Contents

(the “2006 Plan”). In April of 2011, the 2006 Plan was consolidated into the 2011 plan such that all future grants will be granted under the 2011 Plan and shares that are not issued as a result of cancellation, expirations or forfeitures, will become available for grant under the 2011 Plan. Options generally become exercisable over a period of three to four years after the date of grant and expire ten years after the date of grant. The stock options will expire no later than ten years after the date of grant.

 

The 2011 Plan permits the granting of options to acquire up to 4,752,721 shares of common stock. As of December 31, 2012 and September 30, 2013, 532,426 and 282,877 shares remained available for future grant, respectively.

 

Share-based compensation expense related to stock options and restricted stock awards is included in the following line items in the accompanying consolidated statements of comprehensive income (in thousands):

 

		Year Ended December 31,								Nine Months Ended September 30,
		2011				2012				2012				2013
										(unaudited)
Engineering and cost of revenues		$	113			$	747			$	517			$	1,119
Research and development expense			—				—				—				—
Selling, general and administrative expense			150				2,131				1,418				2,511
Total		$	263			$	2,878			$	1,935			$	3,630

 

The following is a summary of the option activity:

 

		Number of Shares				Weighted- Average Exercise Price (per share)				Aggregate Intrinsic Value (in thousands)
Options outstanding December 31, 2010			1,630,581			$	0.71			$	471
Granted			1,334,750				6.19
Exercised			(486,486	)			0.48
Forfeited/cancelled			(40,222	)			0.79
Options outstanding December 31, 2011			2,438,623			$	3.75			$	6,600
Granted			1,937,246				1.99
Exercised			(1,425,162	)			6.60
Forfeited/cancelled			(235,668	)			4.40
Options outstanding December 31, 2012			2,715,039			$	4.38			$	8,262
Granted (unaudited)			1,398,991				7.64
Exercised (unaudited)			(64,419	)			0.97
Forfeited/cancelled (unaudited)			(255,993	)			3.59
Options outstanding September 30, 2013 (unaudited)			3,793,618			$	5.69			$	7,335
Exercisable at December 31, 2012			1,151,393			$	2.51			$	5,660
Vested and expected to vest at December 31, 2012			2,594,085			$	4.32			$	8,049
Exercisable at September 30, 2013 (unaudited)			1,497,272			$	3.56			$	6,056
Vested and expected to vest at September 30, 2013 (unaudited)			3,560,558			$	5.62			$	7,207

 

F-57

---

Table of Contents

The following summarizes the information about stock options outstanding at December 31, 2012:

 

		Options Outstanding												Options Exercisable
Exercise Price		Number Outstanding at 12/31/2012				Weighted- Average Remaining Contractual Life (Years)				Weighted- Average Exercise Price				Number Exercisable at 12/31/2012				Weighted- Average Exercise Price
$0.05			110,455				3.7								110,455
0.70			58,905				4.1								58,905
0.89			573,214				5.3								573,214
1.00			196,834				7.2								35,517
4.39			15,000				8.1								8,749
6.21			1,198,301				8.8								363,022
6.46			562,330				9.4								1,531
			2,715,039				7.8			$	4.38				1,151,393			$	2.51

 

A summary of changes in the Company’s non-vested options is presented below:

 

		Number of Options				Weighted- Average Grant Date Fair Value
Nonvested Options
Nonvested at January 1, 2012			1,528,074			$	5.41
Granted			597,080				6.46
Vested			(405,517	)			4.32
Forfeited			(155,991	)			6.25
Nonvested at December 31, 2012			1,563,646				6.01
Granted (unaudited)			1,398,991				3.48
Vested (unaudited)			(566,389	)			2.51
Forfeited (unaudited)			(137,402	)			3.28
Nonvested at September 30, 2013 (unaudited)			2,258,846			$	3.41

 

As of December 31, 2012, there was approximately $2.4 million of total unrecognized cost that is expected to be recognized over a weighted-average period of 2.9 years. As of September 30, 2013, there was approximately $6.3 million of total unrecognized cost that is expected to be recognized over a weighted-average period of 2.9 years.

 

The weighted-average fair value of employee options granted during the years ended December 31, 2011 and 2012 and the nine months ended September 30, 2013 was $3.40, $3.16 and $3.48, respectively. The aggregate intrinsic value of the options exercised during the years ended December 31, 2011 and 2012 and the nine months ended September 30, 2013 was $2.8 million, $509,000 and $425,000, respectively. The total fair value of shares vested during the years ended December 31, 2011 and 2012 and the nine months ended September 30, 2013 was $22,000, $1.2 million and $1.4 million, respectively.

 

Restricted Stock Awards

 

The Company began granting restricted stock awards during the year ended December 31, 2012. These restricted stock awards are subject to service based vesting and generally vest over a period of four years from the date of grant with an initial 25% vesting cliff at the end of the first year and with the remaining shares vesting monthly thereafter. Holders of restricted stock awards have the right to vote and receive dividends based on their restricted stock awards. The restricted stock awards are considered issued and outstanding at the date the award is granted.

 

F-58

---

Table of Contents

A summary of changes in the Company’s nonvested shares is presented below:

 

		Number of Restricted Shares				Weighted- Average Grant Date Fair Value
Nonvested Shares
Nonvested at January 1, 2012			—			$	—
Granted			1,340,166				6.59
Vested			(121,823	)			6.59
Forfeited			—				—
Nonvested at December 31, 2012			1,218,343				6.59
Granted (unaudited)			—				—
Vested (unaudited)			(358,948	)			6.46
Forfeited (unaudited)			—				—
Nonvested at September 30, 2013 (unaudited)			859,395			$	6.64

 

The compensation expense is recognized over the award’s vesting period. The fair value of the restricted stock awards is measured using the fair market value of the Company’s common stock on the date of grant. The total compensation expense related to restricted stock awards for the year ended December 31, 2012 and the nine months ended September 30, 2013 was $1.5 million and $2.0 million, respectively. As of December 31, 2012, there was approximately $6.8 million of total unrecognized cost that is expected to be recognized over a weighted-average period of 3.2 years. As of September 30, 2013, there was approximately $4.9 million of total unrecognized cost that is expected to be recognized over a weighted-average period of 2.6 years.

 

14. Comprehensive Income (Loss)

 

The financial positions and results of operations of the Company’s foreign subsidiaries are based on the local currency as the functional currency, and are translated to U.S. dollars for financial reporting purposes. Assets and liabilities of the subsidiaries are translated at the exchange rate in effect at the end of the respective financial reporting period. Income statement accounts are translated at the average rate of exchange prevailing during the period. Translation adjustments arising from the use of differing exchange rates from period to period are included in accumulated other comprehensive income (loss) in stockholders’ equity.

 

The Company did not have any items of comprehensive income or loss other than net income for the year ended December 31, 2011. The Company had $5,000 in comprehensive loss for the year ended December 31, 2012 related to currency translation adjustments. The Company had $3,000 and $59,000 in comprehensive loss for the nine months ended September 30, 2012 and 2013, respectively, related to currency translation adjustments.

 

15. Related Party Transaction

 

During 2012, the Company entered into an agreement to integrate the Company’s Mandiant for Security Operations™ system and FireEye, Inc.’s FireEye Malware Protection System™ (MPS). There were no revenues generated or expenses incurred related to this agreement during the year ended December 31, 2012 and during the nine months ended September 30, 2013.

 

During the nine months ended September 30, 2013, the Company recorded notes receivable from certain executives in the amount of $371,000. The notes receivable have an interest rate of 2.4% and mature within the following year. The notes receivable are included in prepaid expenses and other current assets in the accompanying consolidated balance sheet as of September 30, 2013.

 

F-59

---

Table of Contents

16. Subsequent Events

 

Management has evaluated subsequent events for disclosure in these financial statements through February 1, 2014, which is the date the financial statements are available for issuance.

 

David DeWalt resigned from the board of directors in October 2013. Mr. DeWalt continued to serve as an advisor to the Company from October 2013 until the closing of the merger with FireEye on December 30, 2013.

 

In November 2013, the board of directors approved by unanimous written consent to reserve an additional 410,598 shares for the 2011 Plan. In addition, the board of directors approved by unanimous written consent to grant 505,000 stock option awards to certain executives.

 

On December 30, 2013, FireEye acquired all the outstanding shares of the capital stock of the Company for shares of FireEye’s common stock and $106.5 million in cash. In connection with the merger, all of the outstanding stock options and restricted stock awards of the Company were converted into stock options or restricted stock awards, respectively, denominated in shares of FireEye’s common stock.

 

F-60

---

Table of Contents

UNAUDITED PRO FORMA CONDENSED COMBINED FINANCIAL STATEMENTS

 

Introduction to Unaudited Pro Forma Condensed Combined Financial Statements

 

On December 30, 2013, FireEye, Inc. (“FireEye” or the “Company”) entered into an Agreement and Plan of Reorganization (the “Merger Agreement”) with Mandiant Corporation (“Mandiant”). Mandiant is a provider of security-related professional services, education, managed service, software and hardware solutions to the financial service sector, legal community, government agencies, and other domestic and international clients.

 

At the closing on December 30, 2013, FireEye acquired all the outstanding shares of capital stock of Mandiant for 16,123,011 shares of FireEye’s common stock and $106.5 million in cash. Under the terms and conditions of the Merger Agreement, each outstanding share of Mandiant common stock was converted into the right to receive (a) $5.22 in cash, without interest, and subject to applicable withholding tax, and (b) 0.8126 of a share of the Company’s common stock. This transaction is referred to herein as the merger. In connection with the merger, all of the outstanding stock options and restricted stock awards of Mandiant were converted into stock options and restricted stock awards, respectively, denominated in shares of FireEye’s common stock. The common stock issued, along with the estimated fair value of vested equity awards assumed and cash payment, resulted in a preliminary estimated purchase price of $897.7 million for accounting purposes.

 

The terms of each assumed equity award were the same except that the number of shares subject to each equity award and the per share exercise price, if any, were adjusted by an exchange ratio formula set forth in the Merger Agreement.

 

The following unaudited pro forma condensed combined financial statements are based upon the historical consolidated financial data of FireEye and Mandiant after giving effect to the merger using the acquisition method of accounting in accordance with Accounting Standards Codification 805, Business Combinations, and after applying the assumptions, reclassifications and adjustments described in the accompanying notes based on current intentions and expectations relating to the combined business.

 

The unaudited pro forma condensed combined statements of operations for the twelve months ended December 31, 2013 is presented as if the merger had occurred on January 1, 2012. The historical consolidated financial data has been adjusted in the unaudited pro forma condensed combined financial data to give effect to events that are (1) directly attributable to the merger, (2) factually supportable, and (3) with respect to the statements of operations, expected to have a continuing impact on the combined results. The unaudited pro forma condensed combined statements of operations should be read in conjunction with the accompanying notes to the unaudited pro forma condensed combined statements of operations. In addition, the unaudited pro forma condensed combined financial information was based on and should be read in conjunction with the:

 

•

separate audited historical financial statements of FireEye as of and for the year ended December 31, 2012, and the related notes, appearing in the Prospectus filed by FireEye pursuant to Rule 424(b)(4) under the Securities Act of 1933 with the Securities and Exchange Commission (“SEC”) on September 20, 2013.

 

•

separate unaudited historical condensed consolidated financial statements of FireEye as of and for the nine months ended September 30, 2013, and the related notes, included in FireEye’s Quarterly Report on Form 10-Q for the quarterly period ended September 30, 2013, filed with the SEC on November 14, 2013.

 

•

separate audited financial statements of Mandiant as of and for the year ends December 31, 2012 and December 31, 2011, and the related notes, that are filed with this report on Form S-1.

 

•

separate unaudited financial statements of Mandiant as of September 30, 2013 and for the nine-months ended September 30, 2013 and September 30, 2012, and the related notes, that are filed with this report on Form S-1.

 

F-61

---

Table of Contents

The unaudited pro forma condensed combined statements of operations have been presented for informational purposes only. The pro forma information is not necessarily indicative of what the combined company’s financial position or results of operations actually would have been had the merger been completed as of the dates indicated. In addition, the unaudited pro forma condensed combined statements of operations do not purport to project the future financial position or operating results of the combined company.

 

Pursuant to the acquisition method of accounting, the preliminary estimated purchase price, calculated as described in Note 5 to the unaudited pro forma condensed combined statements of operations, has been allocated to net tangible and intangible assets acquired based on their respective estimated fair values. The acquisition accounting is dependent upon certain valuations and other studies that have yet to progress to a stage where there is sufficient information for a definitive measurement. We have made significant assumptions and estimates in determining the preliminary estimated purchase price and the preliminary allocation of the purchase price in the unaudited pro forma condensed combined financial statements. These preliminary estimates and assumptions are subject to change during the estimated purchase price allocation period (generally one year from the acquisition date) as we finalize the valuations of the net tangible and intangible assets. In particular, the final valuations of identifiable intangible assets and associated tax effects may change significantly from our preliminary estimates. Differences between these preliminary estimates and the final acquisition accounting could have a material impact on the accompanying unaudited pro forma condensed combined statements of operations and the combined company’s future results of operations and financial position. Accordingly, the pro forma adjustments are preliminary and have been made solely for the purpose of providing unaudited pro forma condensed combined statements of operations.

 

The unaudited pro forma condensed combined financial data does not reflect any revenue enhancements or operating synergies that the combined company may achieve as a result of the merger or the costs to integrate the operations of FireEye and Mandiant or the costs necessary to achieve these revenue enhancements and operating synergies. There were no significant intercompany transactions between FireEye and Mandiant as of the dates and for the periods of these unaudited pro forma condensed combined statements of operations.

 

F-62

---

Table of Contents

UNAUDITED PRO FORMA CONDENSED COMBINED STATEMENT OF OPERATIONS

 

For the year ended December 31, 2013

 

		Historical
		FireEye For the Year  Ended December 31, 2013				Mandiant For the  Period January 1, 2013 to September 30, 2013				Mandiant For the  Period October 1, 2013 to December 30, 2013				Pro Forma Adjustments (See Note 6)				Pro Forma Combined
		(in thousands, except per share data)
Revenue:
Product		$	88,253			$	7,105			$	3,220			$	—			$	98,578
Subscription and services			73,299				71,341				24,603				(1,363	)			167,880
Total revenue			161,552				78,446				27,823				(1,363	)			266,458
Cost of Revenue:
Product			28,912				—				—				8,782	(a)(b)			37,694
Subscription and services			18,853				—				—				58,375	(a)(b)			77,228
Total cost of revenue			47,765				—				—				67,157				114,922
Total gross profit			113,787				—				—				(68,520	)			151,536
Operating expenses:
Engineering and cost of revenues			—				54,709				20,813				(75,522	)(b)			—
Research and development			66,036				5,778				1,925				43,102	(a)(b)			116,841
Selling, general and administrative costs			—				26,379				47,191				(73,570	)(b)			—
Sales and marketing			167,466				—				—				38,129	(a)(b)			205,595
General and administrative			52,503				—				—				52,381	(a)(b)(e)			104,884
Total operating expenses			286,005				86,866				69,929				(15,480	)			427,320
Operating loss			(172,218	)			(8,420	)			(42,106	)			(53,040	)			(275,784	)
Interest income			68				3				12				—				83
Interest expense			(525	)			(5	)			—				—				(530	)
Other expense, net			(7,257	)			—				165				—				(7,092	)
Loss before income taxes			(179,932	)			(8,422	)			(41,929	)			(53,040	)			(283,323	)
Provision for (benefit from) income taxes			(59,297	)			(3,237	)			(9,561	)			(17,122	)(d)			(89,217	)
Net loss attributable to common stockholders		$	(120,635	)		$	(5,185	)		$	(32,368	)		$	(35,918	)		$	(194,106	)
Net loss per share attributable to common stockholders, basic and diluted		$	(2.66	)														$	(3.17	)
Weighted-average shares used in computing net loss per share attributable to common stockholders basic and diluted			45,271												16,035	(c)			61,306

 

The accompanying notes are an integral part of this statement.

 

F-63

---

Table of Contents

NOTES TO UNAUDITED PRO FORMA CONDENSED COMBINED FINANCIAL STATEMENTS

 

1. Description of Transaction

 

On December 30, 2013, FireEye, Inc. (“FireEye” or the “Company”) entered into an Agreement and Plan of Reorganization (the “Merger Agreement”) with Mandiant Corporation (“Mandiant”). Mandiant is a provider of security-related professional services, education, managed service, software and hardware solutions to the financial service sector, legal community, government agencies, and other domestic and international clients.

 

At the closing on December 30, 2013, FireEye acquired all the outstanding shares of capital stock of Mandiant for 16,123,011 shares of FireEye’s common stock and $106.5 million in cash. Under the terms and conditions of the Merger Agreement, each outstanding share of Mandiant common stock was converted into the right to receive (a) $5.22 in cash, without interest, and subject to applicable withholding tax, and (b) 0.8126 of a share of the Company’s common stock This transaction is referred to herein as the merger. In connection with the merger, all of the outstanding stock options and restricted stock awards of Mandiant were converted into stock options and restricted stock awards, respectively, in shares of FireEye’s common stock. The common stock issued, along with the estimated fair value of vested equity awards assumed and cash payment, resulted in a preliminary estimated purchase price of $897.7 million for accounting purposes.

 

2. Basis of Presentation

 

The merger of FireEye with Mandiant is accounted for in accordance with the acquisition method of accounting for business combinations with FireEye as the accounting acquirer. The unaudited pro forma condensed combined statements of operations were based on the historical consolidated financial statements of FireEye and Mandiant after giving effect to the cash paid and the stock issued by FireEye to consummate the acquisition, as well as certain reclassifications and pro forma adjustments. In accordance with the acquisition method of accounting for business combinations, the assets acquired and the liabilities assumed were recorded as of the completion of the merger, at their respective fair values, and added to those of FireEye. The excess purchase consideration over the fair values of assets acquired and liabilities assumed was recorded as goodwill.

 

The accounting standards define the term “fair value” and set forth the valuation requirements for any asset or liability measured at fair value, and specifies a hierarchy of valuation techniques based on the inputs used to develop the fair value measures. Fair value is defined as “the price that would be received to sell an asset or paid to transfer a liability in an orderly transaction between market participants at the measurements date.” This is an exit price concept for the valuation of the asset or liability. In addition, market participants are assumed to be buyers and sellers in the principal (or most advantageous) market for the asset or liability. Fair value measurements for an asset assume the highest and best use by these market participants. As a result, FireEye may be required to record assets which are not intended to be used or sold and/or to value assets at fair value measures that do not reflect FireEye’s intended use of those assets. Many of these fair value measurements can be highly subjective and it is also possible that other professionals, applying reasonable judgment to the same facts and circumstances, could develop and support a range of alternative estimated amounts.

 

Under the acquisition method, acquisition-related transaction costs (e.g. advisory, legal, valuation and other professional fees) are not included as consideration transferred but are accounted for as expenses in the periods in which the costs are incurred. These costs are not presented in the unaudited pro forma combined consolidated statements of operations because they will not have a continuing impact on the combined results. Total acquisition-related costs for FireEye were estimated to be $8.5 million.

 

The accompanying unaudited pro forma condensed combined statements of operations is presented for illustrative purposes only and do not reflect the costs of any integration activities or benefits that may result from realization of revenue enhancements or operating synergies expected to result from the Merger.

 

The unaudited pro forma condensed combined statements of operations for the years ended December 31, 2013 is presented as if the Merger had occurred on January 1, 2012.

 

F-64

---

Table of Contents

Pursuant to the acquisition method of accounting, the preliminary estimated purchase price, calculated as described in Note 5 to the unaudited pro forma condensed combined financial statements, has been allocated to net tangible and intangible assets acquired based on their respective estimated fair values. The acquisition accounting is dependent upon certain valuations and other studies that have yet to progress to a stage where there is sufficient information for a definitive measurement. We have made significant assumptions and estimates in determining the preliminary estimated purchase price and the preliminary allocation of the estimated purchase price in the unaudited pro forma condensed combined financial statements. These preliminary estimates and assumptions are subject to change during the purchase price allocation period (generally one year from the acquisition date) as we finalize the valuations of the net tangible and intangible assets. In particular, the final valuations of identifiable intangible assets and associated tax effects may change significantly from our preliminary estimates. Differences between these preliminary estimates and the final acquisition accounting could have a material impact on the accompanying unaudited pro forma condensed combined financial statements and the combined company’s future results of operations and financial position. Accordingly, the pro forma adjustments are preliminary and have been made solely for the purpose of providing the unaudited pro forma condensed combined statements of operations.

 

3. Accounting Policies

 

FireEye has not completed its review of Mandiant’s accounting policies. As FireEye completes its review, it may become necessary to harmonize the combined entity’s financial statements to conform to those accounting policies that are determined to be more appropriate for the combined entity. At this time, FireEye is not aware of any differences that would have a material impact on the combined statements of operations. The unaudited pro forma condensed combined statements of operations do not assume any differences in accounting policies. However, certain allocations and reclassifications were made to Mandiant balances to conform to FireEye’s statements of operations, as described in the accompanying notes.

 

4. Preliminary Purchase Price

 

The following is a preliminary estimate of consideration transferred to effect the acquisition of Mandiant (in thousands):

 

Purchase consideration:
Cash		$	106,538
Fair value of 16,123,011 shares common stock transferred as consideration			704,413
Estimated fair value of awards assumed by FireEye			86,702
Total preliminary purchase price		$	897,653

 

The following is the estimated portion of assumed stock options and restricted stock awards that are subject to future service requirements and therefore will be expensed in the financial statements rather than included in purchase accounting (in thousands):

 

Estimated value of share based awards		$	122,612

 

F-65

---

Table of Contents

5. Preliminary Allocation of Estimated Preliminary Purchase Price to Assets Acquired and Liabilities Assumed

 

The following is the preliminary estimate of the assets acquired and the liabilities assumed by FireEye in the merger, reconciled to the purchase price transferred (in thousands):

 

Current assets		$	63,565
Non-current assets			11,452
Current liabilities			(135,028	)
Non-current liabilities			(29,216	)
Net acquired tangible assets			(89,227	)
Identifiable intangible assets (i)			275,500
Goodwill (ii)			711,380
Total preliminary purchase price allocation		$	897,653

 

(i)

As of the effective date of the merger, identifiable intangible assets are required to be measured at fair value and these acquired assets could include assets that are not intended to be used or sold or that are intended to be used in a manner other than their highest and best use. For purposes of these unaudited pro forma condensed combined financial statements, it is assumed that all assets will be used and that all assets will be used in a manner that represents the highest and best use of those assets. The Company’s management used an income approach to estimate the preliminary fair value of intangible assets. The preliminary estimated useful lives and fair values of the identifiable assets are as follows:

 

		Estimated Useful Life (in years)		Preliminary Fair Value (in thousands)
Existing technology		4 -6		$	54,600
In-process research and development		N/A			1,400
Content		10			128,500
Customer relationship		8			66,000
Contract backlog		1 - 3			12,600
Trade names		4			12,400
Total				$	275,500

 

(ii)

Goodwill is calculated as the difference between the estimated fair value of the consideration transferred and the estimated fair values of the assets acquired and liabilities assumed. Goodwill is not amortized.

 

F-66

---

Table of Contents

6. Pro Forma Adjustments

 

This note should be read in conjunction with Note 1. Description of Transaction; Note 2. Basis of Presentation; Note 4. Preliminary Purchase Price; and Note 5. Preliminary Allocation of Estimated Preliminary Purchase Price to Assets Acquired and Liabilities Assumed. Adjustments included in the column under the heading “Pro Forma Adjustments” represent the following:

 

(a)

To record amortization expense of the intangible assets acquired, eliminate amortization expense of Mandiant’s historical intangible assets, and record stock compensation expense for the assumed unvested stock-based awards that is to be recorded prospectively over the remaining weighted average service period of the awards (see Note 4), (in thousands):

 

		Year ended December 31, 2013
Record amortization expense of the acquired intangibles:
Cost of revenue – Product		$	7,854
Cost of revenue – Subscription and service			20,661
Sales and marketing			11,319
Eliminate amortization expense of historical intangibles:
Cost of revenue – Subscription and services			(1,543	)
Record amortization of the fair value portion of the assumed stock-based awards that is to be recorded prospectively:
Cost of revenue – Subscription and services			6,319
Research and development			2,989
Sales and marketing			3,066
General and administrative			29,961

 

(b)

To reclassify certain Mandiant’s engineering and cost of revenues and selling, general and administrative expense categories to conform with FireEye’s presentation. Additionally, to reallocate certain corporate level costs in accordance with FireEye’s allocation methodology. The following is the impact on each account from these reclassifications (in thousands):

 

		Year ended December 31, 2013
Reclassification adjustments:
Cost of revenue – Product		$	928
Cost of revenue – Subscription and services			64,658
Research and development			10,455
Sales and marketing			21,033
General and administrative			52,017
Re-allocation adjustment:
Cost of revenue – Product		$	—
Cost of revenue – Subscription and services			(31,720	)
Research and development			29,657
Sales and marketing			2,711
General and administrative			(648	)

 

(c)

Relates to the number of additional shares of common stock issued in relation to the merger, assuming for the purposes of these condensed combined pro-forma statement of operations that the merger closing date was January 1, 2012.

 

(d)

To record tax benefit related to the recognition of net operating losses.

 

(e)

To eliminate Mandiant’s and FireEye’s transaction costs of $20.5 million and $8.5 million, respectively, incurred and recorded in the twelve months ending December 31, 2013.

 

F-67

---

Table of Contents

---

Table of Contents

 

---

Table of Contents

PART II

 

INFORMATION NOT REQUIRED IN PROSPECTUS

 

ITEM 13. OTHER EXPENSES OF ISSUANCE AND DISTRIBUTION.

 

The following table sets forth all the fees and expenses to be paid by the Registrant, other than underwriting discounts and commissions, in connection with this offering. All amounts shown are estimates except for the SEC registration fee and the FINRA filing fee.

 

SEC registration fee		$	177,943
FINRA filing fee			207,719
Printing and engraving			250,000
Legal fees and expenses			750,000
Accounting fees and expenses			350,000
Transfer agent and registrar fees			6,000
Miscellaneous			175,000
Total		$	1,916,662

 

ITEM 14. INDEMNIFICATION OF DIRECTORS AND OFFICERS.

 

Section 145 of the Delaware General Corporation Law authorizes a corporation’s board of directors to grant, and authorizes a court to award, indemnity to officers, directors, and other corporate agents.

 

As permitted by Section 102(b)(7) of the Delaware General Corporation Law, the Registrant’s amended and restated certificate of incorporation includes provisions that eliminate the personal liability of its directors and officers for monetary damages for breach of their fiduciary duty as directors and officers.

 

In addition, as permitted by Section 145 of the Delaware General Corporation Law, the amended and restated certificate of incorporation and amended and restated bylaws of the Registrant provides that:

 

•

The Registrant shall indemnify its directors and officers for serving the Registrant in those capacities or for serving other business enterprises at the Registrant’s request, to the fullest extent permitted by Delaware law. Delaware law provides that a corporation may indemnify such person if such person acted in good faith and in a manner such person reasonably believed to be in or not opposed to the best interests of the Registrant and, with respect to any criminal proceeding, had no reasonable cause to believe such person’s conduct was unlawful.

 

•

The Registrant may, in its discretion, indemnify employees and agents in those circumstances where indemnification is permitted by applicable law.

 

•

The Registrant is required to advance expenses, as incurred, to its directors and officers in connection with defending a proceeding, except that such director or officer shall undertake to repay such advances if it is ultimately determined that such person is not entitled to indemnification.

 

•

The Registrant will not be obligated pursuant to the amended and restated bylaws to indemnify a person with respect to proceedings initiated by that person, except with respect to proceedings authorized by the Registrant’s board of directors or brought to enforce a right to indemnification.

 

•

The rights conferred in the amended and restated certificate of incorporation and amended and restated bylaws are not exclusive, and the Registrant is authorized to enter into indemnification agreements with its directors, officers, employees, and agents and to obtain insurance to indemnify such persons.

 

•

The Registrant may not retroactively amend the bylaw provisions to reduce its indemnification obligations to directors, officers, employees, and agents.

 

II-1

---

Table of Contents

The Registrant’s policy is to enter into separate indemnification agreements with each of its directors and certain officers that provide the maximum indemnity allowed to directors and executive officers by Section 145 of the Delaware General Corporation Law and also to provide for certain additional procedural protections. The Registrant also maintains directors and officers insurance to insure such persons against certain liabilities.

 

These indemnification provisions and the indemnification agreements entered into between the Registrant and its directors and certain of its officers may be sufficiently broad to permit indemnification of the Registrant’s officers and directors for liabilities (including reimbursement of expenses incurred) arising under the Securities Act of 1933, as amended, or the Securities Act.

 

The underwriting agreement filed as Exhibit 1.1 to this registration statement provides for indemnification by the underwriters of the Registrant and its officers and directors for certain liabilities arising under the Securities Act and otherwise.

 

ITEM 15. RECENT SALES OF UNREGISTERED SECURITIES.

 

During the last three years, the Registrant has sold the following unregistered securities:

 

Warrants

 

In August 2011, the Registrant issued a warrant to purchase 60,661 shares of its Series E convertible preferred stock to one accredited investor at an exercise price of $1.36 per share.

 

Sales of Convertible Preferred Stock

 

In December 2012 and January 2013, the Registrant sold an aggregate of 4,748,591 shares of its Series F convertible preferred stock to a total of 30 accredited investors at a purchase price of approximately $10.53 per share, for an aggregate purchase price of approximately $50,000,000.

 

Option and Common Stock Issuances

 

From January 1, 2011 through September 20, 2013 (the date of the filing of the Registrant’s registration statement on Form S-8, File No. 333-191299), pursuant to the terms of its 2008 Stock Plan and its 2013 Equity Incentive Plan, the Registrant granted to its officers, directors, employees, consultants and other service providers options to purchase an aggregate of 32,184,057 shares of its common stock at exercise prices ranging from $0.57 to $20.00 per share.

 

From January 1, 2011 through September 20, 2013 (the date of the filing of the Registrant’s registration statement on Form S-8, File No. 333-191299), pursuant to the terms of its 2008 Stock Plan, the Registrant granted to certain officers restricted stock units covering up to an aggregate of 565,500 shares of its common stock in exchange for services.

 

From January 1, 2011 through September 20, 2013 (the date of the filing of the Registrant’s registration statement on Form S-8, File No. 333-191299), pursuant to the terms of its 2004 Stock Option Plan and its 2008 Stock Plan, the Registrant issued and sold to its officers, directors, employees, consultants and other service providers an aggregate of 14,477,379 shares of its common stock upon the exercise of options at exercise prices ranging from $0.05 to $7.93 per share, for an aggregate exercise price of $15,109,324.

 

From January 1, 2011 through September 20, 2013 (the date of the filing of the Registrant’s registration statement on Form S-8, File No. 333-191299), the Registrant issued an aggregate of 2,651,484 shares of its restricted common stock in exchange for services and sold 1,220,498 shares of its restricted common stock at a purchase price of $0.57 per share for an aggregate purchase price of $695,684.

 

II-2

---

Table of Contents

On October 1, 2013, the Registrant issued 299,160 shares of common stock to an accredited investor upon the cashless net exercise of two outstanding warrants based on a weighted-average exercise price of approximately $0.67 per share.

 

None of the foregoing transactions involved any underwriters, underwriting discounts or commissions, or any public offering. The Registrant believes the offers, sales, and issuances of the above securities were exempt from registration under the Securities Act by virtue of (i) Section 4(a)(2) of the Securities Act (or Regulation D promulgated thereunder) as transactions not involving a public offering, (ii) Rule 701 promulgated under the Securities Act as transactions pursuant to compensatory benefit plans or contracts relating to compensation as provided under such rule, or (iii) Regulation S promulgated under the Securities Act as transactions made outside of the United States. The recipients of the securities in each of these transactions represented their intentions to acquire the securities for investment only and not with a view to or for sale in connection with any distribution thereof, and appropriate legends were placed upon the stock certificates issued in these transactions. All recipients had adequate access, through their relationships with the Registrant, to information about the Registrant. The sales of these securities were made without any general solicitation or advertising.

 

On September 25, 2013, in connection with the completion of the Registrant’s initial public offering, all 64,589,760 shares of its then-outstanding preferred stock were automatically converted into 74,221,533 shares of common stock. The issuance of such shares was exempt from the registration requirements of the Securities Act in reliance on Section 3(a)(9) and Section 4(a)(2) of the Securities Act. The Registrant received no additional consideration for such automatic conversions.

 

In addition to the securities described above, the Registrant has issued securities in connection with the following acquisitions:

 

•

On December 14, 2012, the Registrant issued 150,000 shares of its common stock as consideration for the acquisition of certain assets of another entity.

 

•

On December 20, 2012, the Registrant issued 763,133 shares of its common stock as partial consideration for the acquisition of another entity and an additional 11,488 shares of its common stock to a former advisor to such entity in connection with the acquisition.

 

•

On September 3, 2013, the Registrant issued 222,500 shares of its common stock as partial consideration for the acquisition of three entities affiliated with each other.

 

•

On December 30, 2013, the Registrant issued 16,920,709 shares of its common stock as partial consideration for the acquisition of Mandiant Corporation.

 

None of the foregoing transactions with respect to the acquisitions involved any underwriters, underwriting discounts or commissions, or any public offering. The Registrant believes that such offers, sales and issuances of the above securities in connection with the foregoing acquisitions were exempt from registration under the Securities Act by virtue of Regulation D promulgated thereunder, with respect to the transactions described in the third and fourth bullets, and Section 4(a)(2) of the Securities Act, with respect to the transactions described in the first and second bullets, as transactions by an issuer not involving a public offering. The Registrant took into account the following factors with respect to the transactions described in the first and second bullets: (i) all sales of the shares were made without any general solicitation or advertising; (ii) there were a limited number of offerees (three persons and two entities in the case of the acquisition described in the first bullet above and one offeree in the case of the acquisition described in the second bullet above); (iv) the purchasers and/or their legal representatives had access to substantial business and financial information regarding the Registrant; (v) the Registrant believes that each of the purchasers was sophisticated and capable of understanding and evaluating the risks of acquiring the Registrant’s securities; (vi) each of the purchasers made standard representations to the Registrant to ensure the availability of the Section 4(a)(2) exemption, including, without limitation, representations of their intentions to acquire the shares for investment for their own accounts and not with a view to the resale or distribution of any shares (except, in the case of the acquisition described in the first bullet above,

 

II-3

---

Table of Contents

for a distribution by the recipient entity to its five stockholders, provided that such distribution would be exempt from the registration requirements of the Securities Act); and (vii) appropriate legends were placed upon the stock certificates issued in connection with both of these acquisitions.

 

ITEM 16. EXHIBITS AND FINANCIAL STATEMENT SCHEDULES.

 

(a) Exhibits.

 

We have filed the exhibits listed on the accompanying Exhibit Index of this Registration Statement.

 

(b) Financial Statement Schedules.

 

All financial statement schedules are omitted because the information called for is not required or is shown either in the consolidated financial statements or in the notes thereto.

 

ITEM 17. UNDERTAKINGS.

 

The undersigned registrant hereby undertakes to provide to the underwriter at the closing specified in the underwriting agreements certificates in such denominations and registered in such names as required by the underwriter to permit prompt delivery to each purchaser.

 

Insofar as indemnification for liabilities arising under the Securities Act of 1933 may be permitted to directors, officers, and controlling persons of the Registrant pursuant to the foregoing provisions, or otherwise, the registrant has been advised that in the opinion of the Securities and Exchange Commission such indemnification is against public policy as expressed in the Act and is, therefore, unenforceable. In the event that a claim for indemnification against such liabilities (other than the payment by the registrant of expenses incurred or paid by a director, officer, or controlling person of the registrant in the successful defense of any action, suit, or proceeding) is asserted by such director, officer, or controlling person in connection with the securities being registered, the registrant will, unless in the opinion of its counsel the matter has been settled by controlling precedent, submit to a court of appropriate jurisdiction the question whether such indemnification by it is against public policy as expressed in the Act and will be governed by the final adjudication of such issue.

 

The undersigned registrant hereby undertakes that:

 

(1)

For purposes of determining any liability under the Securities Act of 1933, the information omitted from the form of prospectus filed as part of this registration statement in reliance upon Rule 430A and contained in a form of prospectus filed by the Registrant pursuant to Rule 424(b)(1) or (4) or 497(h) under the Securities Act shall be deemed to be part of this registration statement as of the time it was declared effective.

 

(2)

For the purpose of determining any liability under the Securities Act of 1933, each post-effective amendment that contains a form of prospectus shall be deemed to be a new registration statement relating to the securities offered therein, and the offering of such securities at that time shall be deemed to be the initial bona fide offering thereof.

 

II-4

---

Table of Contents

SIGNATURES

 

Pursuant to the requirements of the Securities Act of 1933, the Registrant has duly caused this registration statement to be signed on its behalf by the undersigned, thereunto duly authorized, in the City of Milpitas, State of California, on March 3, 2014.

 

 

Pursuant to the requirements of the Securities Act of 1933, this registration statement has been signed by the following persons in the capacities and on the dates indicated.

 

Signature		Title		Date
/S/ DAVID G. DEWALT     David G. DeWalt		Chief Executive Officer and Chairman of the Board (Principal Executive Officer)		March 3, 2014
/S/ MICHAEL J. SHERIDAN Michael J. Sheridan		Senior Vice President and Chief Financial Officer (Principal Financial and Accounting Officer)		March 3, 2014
* Ashar Aziz		Founder, Chief Technology Officer, Chief Strategy Officer, and Vice Chairman of the Board		March 3, 2014
* Ronald E. F. Codd		Director		March 3, 2014
* William M. Coughran Jr.		Director		March 3, 2014
* Gaurav Garg		Director		March 3, 2014
* Promod Haque		Director		March 3, 2014
* Robert F. Lentz		Director		March 3, 2014
* Enrique Salem		Director		March 3, 2014

 

* by:		/S/ DAVID G. DEWALT
		David G. DeWalt
		As Attorney-in-Fact

 

II-5

---

Table of Contents

EXHIBIT INDEX

 

Exhibit No.				Incorporated by Reference
		Description of Exhibit		Form		File No.		Exhibit		Filing Date
1.1		Form of Underwriting Agreement.
2.1+		Agreement and Plan of Reorganization, dated as of December 30, 2013, by and among the Registrant, Mercury Merger Corporation, Mercury Merger LLC, Mandiant Corporation and Shareholder Representative Services LLC.		8-K		001-36067		2.1		January 2, 2014
3.1		Amended and Restated Certificate of Incorporation of the Registrant.		8-K		001-36067		3.1		September 25, 2013
3.2		Amended and Restated Bylaws of the Registrant.		S-1/A		333-190338		3.4		August 21, 2013
4.1		Form of the Registrant’s common stock certificate.		S-1/A		333-190338		4.1		September 9, 2013
5.1		Opinion of Wilson Sonsini Goodrich & Rosati, Professional Corporation.
10.1†		Form of Indemnification Agreement between the Registrant and certain of its officers and directors.		S-1		333-190338		10.1		August 2, 2013
10.2†		Employee Incentive Plan.		S-1		333-190338		10.17		August 2, 2013
10.3†		Change of Control Severance Policy for Officers.		S-1/A		333-190338		10.27		August 21, 2013
10.4†		2004 Stock Option Plan, as amended, including form agreements under 2004 Stock Option Plan.		S-1		333-190338		10.5		August 2, 2013
10.5†		2008 Stock Plan, as amended, including form agreements under 2008 Stock Plan.		S-1/A		333-190338		10.6		September 9, 2013
10.6†		2013 Equity Incentive Plan, including form agreements under 2013 Equity Incentive Plan.
10.7†		2013 Employee Stock Purchase Plan.		S-1/A		333-190338		10.8		September 9, 2013
10.8†		Mandiant Corporation 2011 Equity Incentive Plan, as amended, including form agreements under Mandiant Corporation 2011 Equity Incentive Plan.		S-1		333-193717		10.8		February 3, 2014
10.9†		Offer Letter between the Registrant and David DeWalt, dated November 19, 2012, as amended and currently in effect.		S-1/A		333-190338		10.9		August 21, 2013
10.10†		Offer Letter between the Registrant and Ashar Aziz, dated November 26, 2012.		S-1		333-190338		10.10		August 2, 2013
10.11†		Offer Letter between the Registrant and Enrique Salem, dated February 2, 2013.		S-1		333-190338		10.11		August 2, 2013
10.12†		Offer Letter between the Registrant and Ronald E. F. Codd, dated July 28, 2012.		S-1		333-190338		10.12		August 2, 2013
10.13†		Offer Letter between the Registrant and Michael J. Sheridan, dated August 1, 2013.		S-1/A		333-190338		10.13		August 21, 2013

---

Table of Contents

Exhibit No.				Incorporated by Reference
		Description of Exhibit		Form		File No.		Exhibit		Filing Date
10.14†		Offer Letter between the Registrant and Bahman Mahbod, dated August 1, 2013.		S-1/A		333-190338		10.14		August 21, 2013
10.15†		Offer Letter between the Registrant and Jeffrey C. Williams, dated August 1, 2013.		S-1/A		333-190338		10.15		August 21, 2013
10.16†		Offer Letter between the Registrant and Alexa King, dated August 1, 2013.		S-1/A		333-190338		10.16		August 21, 2013
10.17†		Offer Letter, between the Registrant and Kevin Mandia, dated December 24, 2013.		8-K		001-36067		10.1		January 2, 2014
10.18†		Consideration Holdback Agreement, dated as of December 30, 2013, by and between Kevin Mandia and the Registrant.		8-K		001-36067		10.2		January 2, 2014
10.19†		Key Employee Non-Competition Agreement, dated as of December 30, 2013, by and between Kevin Mandia and the Registrant.		8-K		001-36067		10.3		January 2, 2014
10.20		Lease, dated as of January 15, 2008, by and between the Registrant and Silicon Valley CA-I, LLC, as amended and currently in effect.		S-1/A		333-190338		10.3		August 21, 2013
10.21		Lease, dated as of March 11, 2010, by and between the Registrant and Silicon Valley CA-I, LLC, as amended, assigned and currently in effect.		S-1		333-190338		10.4		August 2, 2013
10.22		Amended and Restated Loan and Security Agreement, dated as of August 26, 2011, between the Registrant and Silicon Valley Bank, as amended and currently in effect.		S-1		333-193717		10.22		February 3, 2014
10.23**		Flextronics Design and Manufacturing Services Agreement, dated as of September 28, 2012, by and between the Registrant and Flextronics Telecom Systems, Ltd.		S-1/A		333-190338		10.19		September 9, 2013
10.24		Amended and Restated Investors’ Rights Agreement, dated as of December 30, 2013, by and among the Registrant and the parties listed therein.		S-1		333-193717		10.24		February 3, 2014
10.25		Warrant to purchase shares of Series A-2 Preferred Stock issued to Silicon Valley Bank and assigned to SVB Financial Group, dated August 15, 2005.		S-1		333-190338		10.21		August 2, 2013
10.26		Warrant to purchase shares of Series B Preferred Stock issued to Silicon Valley Bank and assigned to SVB Financial Group, dated September 5, 2006.		S-1		333-190338		10.23		August 2, 2013
10.27		Warrant to purchase shares of Series D Preferred Stock issued to Silicon Valley Bank and assigned to SVB Financial Group, dated June 7, 2010.		S-1		333-190338		10.25		August 2, 2013
10.28		Warrant to purchase shares of Series E Preferred Stock issued to Silicon Valley Bank and assigned to SVB Financial Group, dated August 26, 2011.		S-1		333-190338		10.26		August 2, 2013
21.1		List of subsidiaries of the Registrant.		S-1		333-193717		21.1		February 3, 2014
23.1		Consent of Wilson Sonsini Goodrich & Rosati, P.C. (included in Exhibit 5.1).

---

Table of Contents

Exhibit No.				Incorporated by Reference
		Description of Exhibit		Form		File No.		Exhibit		Filing Date
23.2		Consent of Deloitte & Touche LLP, independent registered public accounting firm.
23.3		Consent of PricewaterhouseCoopers LLP, independent accountants.
24.1		Power of Attorney (see page II-5 to the original filing of this Registration Statement on Form S-1).
101.INS++		XBRL Instance Document.
101.SCH++		XBRL Taxonomy Extension Schema Document.
101.CAL++		XBRL Taxonomy Extension Calculation Linkbase Document.
101.DEF++		XBRL Taxonomy Extension Definition Linkbase Document.
101.LAB++		XBRL Taxonomy Extension Label Linkbase Document.
101.PRE++		XBRL Taxonomy Extension Presentation Linkbase Document.

 

+

The schedules and other attachments to this exhibit have been omitted. The Registrant agrees to furnish a copy of any omitted schedules or attachments to the SEC upon request.

†

Indicates a management contract or compensatory plan or arrangement.

**

Portions of this exhibit have been granted confidential treatment by the Securities and Exchange Commission.

++

In accordance with Rule 406T of Regulation S-T, the information in these exhibits is furnished and deemed not filed or a part of a registration statement or prospectus for purposes of sections 11 or 12 of the Securities Act of 1933, as amended, is deemed not filed for purposes of section 18 of the Securities Exchange Act of 1934, as amended, and otherwise is not subject to liability under these sections.