sv1za
Table of Contents

As filed with the Securities and Exchange Commission on February 23, 2007
Registration No. 333-138199
 
UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549
 
 
 
 
AMENDMENT NO. 5 TO
FORM S-1
REGISTRATION STATEMENT UNDER THE SECURITIES ACT OF 1933
 
 
 
 
SOURCEFIRE, INC.
(Exact name of registrant as specified in its charter)
 
         
Delaware
  7372   52-2289365
(State or Other Jurisdiction of
Incorporation or Organization)
  (Primary Standard Industrial
Classification Code Number)
  (IRS Employer
Identification No.)
 
9770 Patuxent Woods Drive
Columbia, Maryland 21046
(410) 290-1616
(Address, including zip code, and telephone number, including area code, of registrant’s principal executive offices)
 
 
 
 
E. Wayne Jackson, III
Chief Executive Officer
Sourcefire, Inc.
9770 Patuxent Woods Drive
Columbia, Maryland 21046
(410) 290-1616
(Name, address, including zip code, and telephone number, including area code, of agent for service)
 
 
 
 
Copies to:
 
     
Thomas J. Knox, Esq.   Marc D. Jaffe, Esq.
Jeffrey S. Marcus, Esq. 
  Rachel W. Sheridan, Esq.
Morrison & Foerster LLP
  Latham & Watkins LLP
1650 Tysons Blvd, Suite 300
  885 Third Avenue, Suite 1000
McLean, VA 22102
  New York, NY 10022
(703) 760-7700
  (212) 906-1200
 
 
 
 
Approximate date of commencement of proposed sale to the public:  As soon as practicable after this Registration Statement becomes effective.
If any of the securities being registered on this Form are to be offered on a delayed or continuous basis pursuant to Rule 415 under the Securities Act of 1933 check the following box. o
If this Form is filed to register additional securities for an offering pursuant to Rule 462(b) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same
offering. o _ _
If this Form is a post-effective amendment filed pursuant to Rule 462(c) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering. o _ _
If this Form is a post-effective amendment filed pursuant to Rule 462(d) under the Securities Act, check the following box and list the Securities Act registration statement number of the earlier effective registration statement for the same offering. o _ _
 
 
CALCULATION OF REGISTRATION FEE
 
                         
            Proposed Maximum
    Proposed Maximum
     
Title of each Class of
    Amount to be
    Offering Price per
    Aggregate Offering
    Amount of
Securities to be Registered     Registered(a)     Share(b)     Price(b)     Registration Fee(c)
Common stock, $0.001 par value
    6,635,500     $14.00     $92,897,000     $2,851.94
                         
(a) Includes 865,500 shares of common stock which may be purchased by the underwriters to cover over-allotments, if any.
(b) Estimated solely for the purpose of calculating the registration fee in accordance with Rule 457(a) promulgated under the Securities Act of 1933.
(c) A registration fee of $8,025.00 was paid with the initial filing of this registration statement. Therefore, no additional fee is being paid with this Amendment No. 5.
 
The Registrant hereby amends this registration statement on such date or dates as may be necessary to delay its effective date until the Registrant shall file a further amendment which specifically states that this registration statement shall thereafter become effective in accordance with Section 8(a) of the Securities Act of 1933, or until the registration statement shall become effective on such date as the Commission, acting pursuant to said Section 8(a), may determine.


Table of Contents

The information contained in this prospectus is not complete and may be changed. We may not sell these securities until the registration statement filed with the Securities and Exchange Commission is effective. This prospectus is not an offer to sell these securities and we are not soliciting offers to buy these securities in any state where the offer or sale is not permitted.
 
PROSPECTUS (Subject to Completion)
Issued February 23, 2007
 
5,770,000 Shares
 
(SOURCE FIRE LOGO)
 
COMMON STOCK
 
 
 
 
Sourcefire, Inc. is offering 5,320,000 shares of its common stock and the selling stockholders are offering 450,000 shares. We will not receive any proceeds from the sale of shares by the selling stockholders. This is our initial public offering and no public market exists for our shares. We anticipate that the initial public offering price will be between $12.00 and $14.00 per share.
 
 
We have applied to list our common stock for quotation on the Nasdaq Global Market under the symbol “FIRE.”
 
 
Investing in our common stock involves risks.  See “Risk Factors” beginning on page 9.
 
 
PRICE $      A SHARE
 
 
                 
        Underwriting
       
        Discounts and
  Proceeds to
  Proceeds to
    Price to Public   Commissions   Sourcefire   Selling Stockholders
 
Per share
  $        $        $        $     
Total
  $             $             $             $          
 
We have granted the underwriters the right to purchase up to an additional 865,500 shares of common stock to cover over-allotments.
 
The Securities and Exchange Commission and state securities regulators have not approved or disapproved these securities, or determined if this prospectus is truthful or complete. Any representation to the contrary is a criminal offense.
 
Morgan Stanley & Co.  Incorporated expects to deliver the shares of common stock to purchasers on          , 2007.
 
 
MORGAN STANLEY LEHMAN BROTHERS
 
 
 
 
UBS INVESTMENT BANK JEFFERIES & COMPANY
 
                    , 2007


Table of Contents

(Graphic)


 

TABLE OF CONTENTS
 
         
    Page
 
  1
  9
  24
  26
  26
  27
  29
  30
  32
  54
  69
  75
  95
  97
  99
  101
  102
  105
  108
  108
  108
  F-1
 Exhibit 1.1
 EX-3.5
 EX-5.1
 EX-10.11
 EX-10.12
 EX-10.13
 EX-10.14
 EX-10.15
 EX-10.16
 EX-10.17
 EX-23.1
 
 
You should rely only on the information contained in this prospectus. We have not authorized anyone to provide you with information different from that contained in this prospectus. We are offering to sell, and seeking offers to buy, shares of common stock only in jurisdictions where offers and sales are permitted. The information contained in this prospectus is accurate only as of the date of this prospectus, regardless of the time of delivery of this prospectus or of any sale of shares of common stock.
 
Until and including          , 2007, 25 days after the commencement of this offering, all dealers that buy, sell or trade shares of our common stock, whether or not participating in this offering, may be required to deliver a prospectus. This delivery requirement is in addition to the dealers’ obligation to deliver a prospectus when acting as underwriters and with respect to their unsold allotments or subscriptions.
 
For investors outside the United States.  Neither we nor any of the underwriters have done anything that would permit this offering or possession or distribution of this prospectus in any jurisdiction where action for that purpose is required, other than in the United States. You are required to inform yourselves about, and to observe any restrictions relating to, this offering and the distribution of this prospectus.


Table of Contents

 
PROSPECTUS SUMMARY
 
This summary highlights selected information contained elsewhere in this prospectus and does not contain all of the information you should consider in making your investment decision. You should read the following summary together with all of the more detailed information regarding us and our common stock being sold in the offering, including our financial statements and the related notes, appearing elsewhere in this prospectus. Unless we state otherwise, “Sourcefire,” the “Company,” “we,” “us,” and “our” refer to Sourcefire, Inc., a Delaware corporation, and its subsidiaries, taken as a whole.
 
SOURCEFIRE, INC.
 
Overview
 
We are a leading provider of intelligence driven, open source network security solutions that enable our customers to protect their computer networks in an effective, efficient and highly automated manner. We sell our security solutions to a diverse customer base that includes more than 25 of the Fortune 100 companies and over half of the 30 largest U.S. government agencies. We also manage one of the security industry’s leading open source initiatives, Snort.
 
Our family of network security products forms a comprehensive Discover, Determine and Defend, or 3D, approach to network security. Using this approach, our technology can automatically:
 
  •  Discover potential threats and points of vulnerability;
 
  •  Determine the potential impact of those observations to the network; and
 
  •  Defend the network through proactive enforcement of security policy.
 
Our Sourcefire 3D approach is comprised of three key components:
 
RNA.  At the heart of the Sourcefire 3D security solution is Real-time Network Awareness, or RNA, our network intelligence product that provides persistent visibility into the composition, behavior, topology (the relationship of network components) and risk profile of the network. This information provides a platform for the Defense Center’s automated decision-making and network policy compliance enforcement. The ability to continuously discover characteristics and vulnerabilities of any computing device, or endpoint, communicating on a network (such as a computer, printer or server), or endpoint intelligence, along with the ability to observe how those endpoints communicate with each other, or network intelligence, enables our Intrusion Prevention products to more precisely identify and block threatening traffic and to more efficiently classify threatening and/or suspicious behavior than products lacking network intelligence.
 
Intrusion Sensors.  The Intrusion Sensors utilize open source Snort® and our proprietary technology to monitor network traffic. These sensors compare observed traffic to a set of “Rules”, or a set of anomalous network traffic characteristics, which can be indicative of malicious activity. Once the Intrusion Sensors match a Rule to the observed traffic, they block malicious traffic and/or send an alert to the Defense Center for further analysis, prioritization and possible action.
 
Defense Center.  The Defense Center aggregates, correlates and prioritizes network security events from RNA Sensors and Intrusion Sensors to synthesize multipoint event correlation and policy compliance analysis. The Defense Center’s policy and response subsystems are designed to leverage existing IT infrastructure such as firewalls, routers, trouble ticketing and patch management systems for virtually any task, including alerting, blocking and initiating corrective measures.
 
The traffic inspection engine used in our intrusion prevention products is the open source technology called Snort. Martin Roesch, our founder and Chief Technology Officer, created Snort in 1998. Our employees, including Mr. Roesch, have authored all major components of Snort, and we maintain control over the Snort project, including the principal Snort community forum, Snort.org. Snort, which has become a de facto industry standard, has been downloaded over 3 million times. We believe that a majority of the Fortune 100 companies and all of the 30 largest U.S. government agencies use Snort technology to monitor network traffic and that Snort is the most widely


1


Table of Contents

deployed intrusion prevention technology worldwide. The ubiquitous nature of the Snort user community represents a significant opportunity to sell our proprietary products to customers that require a complete enterprise solution.
 
For the year ended December 31, 2006, we generated approximately 81% of our revenue from customers in the U.S. and 19% from international customers. We increased our revenue from $32.9 million in 2005 to $44.9 million in 2006, representing a growth rate of 37%.
 
Our Industry
 
We believe, based on our review of various industry sources, that the network security industry was estimated to be a $18.4 billion market in 2006 and is projected to grow to $26.9 billion in 2009, representing a compound annual growth rate of over 13%. Our addressable markets include intrusion prevention, vulnerability management and unified threat management, which were collectively projected to total $2.9 billion in 2006 and are expected to grow at a compound annual growth rate in excess of 21% to $5.2 billion in 2009, according to industry sources we reviewed. We expect that this growth should continue as organizations seek solutions to various growing and evolving security challenges, including:
 
Greater Sophistication, Severity and Frequency of Network Attacks.  The growing use of the Internet as a business tool has required organizations to increase the number of access points to their networks, which has made vast amounts of critical information more vulnerable to attack. Theft of sensitive information for financial gain motivates network attackers, who derive profit through identity theft, credit card fraud, money laundering, extortion, intellectual property theft and other illegal means. These profit-motivated attackers, in contrast to the hobbyist hackers of the past, are employing much more sophisticated tools and techniques to generate profits for themselves and their well-organized and well-financed sponsors.
 
Increasing Risks from Unknown Vulnerabilities.  Unknown vulnerabilities in computer software that are discovered by network attackers before they are discovered by security and software vendors represent a tremendous risk. These uncorrected flaws can leave networks largely defenseless and open to exploitation. According to Computer Emergency Response Team Coordination Center, or CERT-CC, data as of October 2006, the trends in the rate of vulnerability disclosure are particularly alarming, with approximately 3,780 disclosed in 2004 and more than 5,990 disclosed in 2005, representing a growth rate of approximately 58%.
 
Potential Degradation of Network Performance.  Many security products degrade network performance and are, therefore, disfavored by network administrators who generally prioritize network performance over incremental gains in network security. For example, the use of active scanners that probe networks for vulnerabilities often meets heavy resistance from administrators concerned about excessive network “noise,” clogged firewall logs and disruption of network assets that are critical to business operations.
 
Diverse Demands on Security Administrators.  The proliferation of targeted security solutions such as firewalls, intrusion prevention systems, URL filters, spam filters and anti-spyware solutions, while critical to enhancing network security, create significant administrative burdens on personnel who must manage numerous disparate technologies that are seldom integrated and often difficult to use. Most network security products require manual, labor intensive incident response and investigation by security administrators, especially when “false positive” results are generated.
 
Heightened Government Regulation.  Rapidly growing government regulation is forcing compliance with increased requirements for network security, which has escalated demand for security solutions that meet both compliance requirements and reduce the burdens of compliance, reporting and enforcement. Examples of these laws include The Health Insurance Portability and Accountability Act of 1996, or HIPAA, The Financial Services Modernization Act of 1999, commonly known as the Gramm-Leach-Bliley Act, The Sarbanes-Oxley Act of 2002 and The Federal Information Security Management Act.


2


Table of Contents

Our Competitive Strengths
 
We believe that our leading market position results from several key competitive strengths, including:
 
Real-Time Approach to Network Security.  Our solution is designed to support a continuum of network security functions that span pre-attack hardening of assets, high fidelity attack identification and disruption and real-time compromise detection and incident response. In addition, our ability to confidently classify and prioritize threats in network traffic and determine the composition, behavior and relationships of network devices, or endpoints, allows us to reliably automate what are otherwise manual, time-intensive processes.
 
Comprehensive Network Intelligence.  Our innovative network security solution incorporates RNA, which provides persistent visibility into the composition, behavior, topology and risk profile of the network and serves as a platform for automated decision-making and network security policy enforcement. RNA performs passive, or non-disruptive, network discovery. This enables real-time compositional cataloging of network assets, including their configuration, thereby significantly increasing the network intelligence available to IT and security administrators. By integrating this contextual understanding of the network’s components and situational awareness of network events, our solution is effective across a broad range of security domains, especially in the area of threat identification and impact assessment.
 
The Snort Community.  The Snort user community, with over 100,000 registered users and over 3 million downloads to date, has enabled us to establish a market footprint unlike any other in the industry. We believe the Snort open source community provides us with significant benefits, including a broad threat awareness network, significant research and development leverage, and a large pool of security experts that are skilled in the use of our technology. We believe that Snort’s broad acceptance makes us one of the most trusted sources of intrusion prevention and related security solutions.
 
Leading-Edge Performance.  Our solutions have the ability to process multiple gigabits of traffic with latency as low as 100 microseconds. Our intrusion prevention technology incorporates advanced traffic processing functionality, including packet acquisition, protocol normalization and target-based traffic inspection, which yields increased inspection precision and efficiency and enables more granular inspection of network traffic. The Defense Center supports event loads as high as 1,300 events per second, which we believe meets or exceeds the requirements of the most demanding enterprise customers.
 
Significant Security Expertise.  We have a highly knowledgeable management team with extensive network security industry experience gained from past service in leading enterprises and government organizations including Symantec, McAfee, the Department of Defense and the National Security Agency. Our founder and CTO, Martin Roesch, invented Snort and our core RNA technology and is widely regarded as a network security visionary. Our senior management team averages 16 years of experience in the networking and security industries. In addition, our Vulnerability Research Team, or VRT, is comprised of highly experienced security experts who research new vulnerabilities and create innovative methods for preventing attempts to exploit them.
 
Broad Industry Recognition.  We have received numerous industry awards and certifications, including recognition as a “leader” in the network intrusion prevention systems market, supporting our position as one of a select few companies that best combines “completeness of vision” with “ability to execute.” RNA is one of only five network security products to receive the NSS Gold award, which is awarded by The NSS Group only to those products that are distinguished in terms of advanced or unique features, and which offer outstanding value. In addition, our technology has achieved Common Criteria Evaluation Assurance Level 2, or EAL2, which is an international evaluation standard for information technology security products sanctioned by, among others, the International Standards Organization, the National Security Agency and the National Institute for Standards and Technology.


3


Table of Contents

Our Growth Strategy
 
We intend to become the preeminent provider of network security solutions on a global basis. The key elements of our growth strategy include:
 
Continue to Develop Innovative Network Security Technology.  We will continue to invest significantly in internal development and product enhancements and to hire additional network security experts to broaden our proprietary knowledge base. We believe our platform is capable of expanding into new markets such as unified threat management, security management and compliance and network management.
 
Grow our Customer Base.  With over 3 million downloads of Snort and over 100,000 registered users, we believe Snort is the most ubiquitous network intrusion detection and prevention technology. We seek to monetize the Snort installed base by targeting enterprises that implement Snort but have not yet purchased any of the components of our Sourcefire 3D security solution. We will continue to target large enterprises and government agencies that require advanced security technology and high levels of network availability and performance in sectors including finance, technology, healthcare, manufacturing and defense.
 
Further Penetrate our Existing Customer Base.  As of December 31, 2006, over 1,300 customers have purchased our Intrusion Sensors and Defense Center products. We intend to sell additional Intrusion Sensors to existing customers and expand our footprint in the networks of our customers to include branch offices, remote locations and data centers. In addition, we believe we have a significant opportunity to up-sell our higher margin RNA product to existing customers because of the significant incremental benefit that increased network intelligence can bring to their security systems.
 
Expand our OEM Alliances and Distribution Relationships.  As part of our ongoing effort to expand our OEM alliances, we recently entered into a relationship with Nokia whereby Nokia Enterprise Solutions will market to its enterprise customers network security solutions that utilize our proprietary software and technology. In addition, we seek to expand our strategic reseller agreements and increasingly use this channel to generate additional inbound customer prospects. We also intend to utilize our relationships with managed security service providers such as Verizon, VeriSign and Symantec, to derive incremental revenue. In 2006, we generated approximately 11% of our revenue from governmental organizations and, in the future, we believe we will generate an increasing amount of revenue from government suppliers such as Lockheed Martin, Northrop Grumman and Immix Technology.
 
Strengthen Our International Presence.  We believe the network security needs of many enterprises located outside of the United States are not being adequately served and represent a significant potential market opportunity. In 2006, we generated only approximately 19% of our revenue from international customers. We are expanding our sales in international markets by adding distribution relationships and expanding our direct sales force, with plans in the next year to double the number of personnel in Europe and to hire a country manager for Japan.
 
Selectively Pursue Acquisitions of Complementary Businesses and Technologies.  To accelerate our expected growth, enhance the capabilities of our existing products and broaden our product and service offerings, we intend to selectively pursue acquisitions of businesses, technologies and products that could complement our existing operations.
 
Certain Risk Factors
 
Investing in our common stock involves substantial risk. You should carefully consider all the information in this prospectus prior to investing in our common stock. These risks and uncertainties include, but are not limited to, the following:
 
  •  As we have had operating losses since our inception and we expect operating expenses to increase in the foreseeable future, we may never reach or maintain profitability.
 
  •  We face intense competition in our market, especially from larger, better-known companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.


4


Table of Contents

 
  •  New competitors could emerge or our customers or distributors could internally develop alternatives to our products and either development could impair our sales.
 
  •  Our quarterly operating results are likely to vary significantly and be unpredictable, in part because of the purchasing and budget practices of our customers, which could cause the trading price of our stock to decline.
 
  •  The market for network security products is rapidly evolving and the complex technology incorporated in our products makes them difficult to develop. If we do not accurately predict, prepare for and respond to technological and market developments and changing customer needs, our competitive position and prospects will be harmed.
 
  •  Claims that our products infringe the proprietary rights of others could harm our business and cause us to incur significant costs.
 
 
Our Corporate Information
 
We were incorporated as a Delaware corporation in December 2001. Our principal executive office is located at 9770 Patuxent Woods Drive, Columbia, Maryland 21046. Our telephone number at that location is (410) 290-1616. Our website address is www.sourcefire.com.  We also operate www.snort.org.  These are textual references only. We do not incorporate the information on, or accessible through, any of our websites into this prospectus, and you should not consider any information on, or that can be accessed through, our websites as part of this prospectus.


5


Table of Contents

THE OFFERING
 
Common stock offered by Sourcefire  5,320,000 shares
 
Common stock offered by the selling stockholders
   450,000 shares
 
       Total
 5,770,000 shares
 
Over-allotment option to be offered by Sourcefire
   865,500 shares
 
Common stock to be outstanding after this offering
23,113,892 shares
 
Use of proceeds We intend to use the net proceeds from this offering for working capital and other general corporate purposes. We may also use a portion of the net proceeds to repay our equipment facility or acquire other businesses, products or technologies. However, we do not have agreements or commitments for any specific repayments or acquisitions at this time. We will not receive any proceeds from the sale of common stock by the selling stockholders. See “Use of Proceeds.”
 
Proposed Nasdaq Global Market symbol
“FIRE”
 
The number of shares to be outstanding after this offering is based on 17,793,892 shares outstanding as of December 31, 2006, and excludes:
 
  •  3,199,903 shares that may be issued upon the exercise of options outstanding as of December 31, 2006 under our stock option plan;
 
  •  36,944 shares that may be issued upon the exercise of warrants outstanding as of December 31, 2006;
 
  •  181,934 shares that were reserved for issuance pursuant to our stock option plan as of December 31, 2006; and
 
  •  27,709 shares that are subject to repurchase by us.
 
Unless we specifically state otherwise, all information in this prospectus reflects or assumes:
 
  •  an initial public offering price of $13.00;
 
  •  a 1-to-1.624 reverse split of our common stock, which was effected on February 22, 2007;
 
  •  the conversion of all outstanding shares of our preferred stock into shares of our common stock immediately prior to the completion of this offering pursuant to a written consent executed by the holders of the requisite number of shares of each class of our preferred stock to voluntarily convert their shares of our preferred stock into shares of our common stock; and
 
  •  the underwriters’ over-allotment option to purchase up to an additional 865,500 shares of common stock is not exercised.


6


Table of Contents

SUMMARY CONSOLIDATED FINANCIAL DATA
 
The table below summarizes our consolidated financial information for the periods indicated and has been derived from our audited consolidated financial statements. You should read the following information together with the more detailed information contained in “Selected Consolidated Financial Data,” “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and the accompanying notes appearing elsewhere in this prospectus.
 
                                 
    Year ended December 31,  
    2003     2004     2005     2006  
    (in thousands, except share, per share and other operating data)  
 
Consolidated statement of operations data:
                               
Revenue:
                               
Products
  $ 8,153     $ 12,738     $ 23,589     $ 30,219  
Services
    1,328       3,955       9,290       14,707  
                                 
Total revenue
    9,481       16,693       32,879       44,926  
Cost of revenue:
                               
Products
    2,570       4,533       6,610       8,440  
Services
    436       872       1,453       2,632  
                                 
Total cost of revenue
    3,006       5,405       8,063       11,072  
                                 
Gross profit
    6,475       11,288       24,816       33,854  
Operating expenses:
                               
Research and development
    3,751       5,706       6,831       8,612  
Sales and marketing
    9,002       12,585       17,135       20,652  
General and administrative
    2,141       2,905       5,120       5,017  
Depreciation and amortization
    441       752       1,103       1,230  
                                 
Total operating expenses
    15,335       21,948       30,189       35,511  
                                 
Loss from operations
    (8,860 )     (10,660 )     (5,373 )     (1,657 )
Other income (expense), net
    16       164       (85 )     792  
                                 
Loss before income taxes
    (8,844 )     (10,496 )     (5,458 )     (865 )
Income tax expense
                      (67 )
                                 
Net loss
    (8,844 )     (10,496 )     (5,458 )     (932 )
Accretion of preferred stock
    (1,262 )     (2,451 )     (2,668 )     (3,819 )
                                 
Net loss attributable to common stockholders
  $ (10,106 )   $ (12,947 )   $ (8,126 )   $ (4,751 )
                                 
Net loss attributable to common stockholders per common share:
                               
Basic and diluted
  $ (4.69 )   $ (4.97 )   $ (2.54 )   $ (1.40 )
Pro forma (unaudited)(1)
                            (0.06 )
Shares used in per common share calculations:
                               
Basic and diluted
    2,156,725       2,602,743       3,200,318       3,389,527  
Pro forma (unaudited)(1)
                            16,885,981  
Other operating data:
                               
Number of sales in excess of $500,000
    2       5       9       14  
Number of new 3D customers
    161       136       149       273  
Cumulative number of Fortune 100 3D customers at end of period
    10       17       24       26  
Number of full-time employees at end of period
    84       107       135       182  
 
(footnotes on following page)
 


7


Table of Contents

                         
          As of December 31,
 
          2006  
                Pro forma
 
    Actual     Pro forma(2)     As Adjusted(3)  
    (unaudited)  
    (in thousands)  
 
Consolidated balance sheet data:
                       
Cash and cash equivalents
  $ 13,029     $ 13,029     $ 74,898  
Held-to-maturity investments
    13,293       13,293       13,293  
Total assets
    49,952       49,952       111,821  
Long-term debt
    1,312       1,312       1,312  
Total liabilities
    22,104       22,104       22,104  
Total convertible preferred stock
    66,747              
Total stockholders’ equity (deficit)
    (38,899 )     27,848       89,717  
 
(1) Pro forma to give effect to the conversion of all outstanding shares of our preferred stock into shares of our common stock immediately prior to the completion of this offering.
(2) The pro forma balance sheet data reflect the conversion of all outstanding shares of our preferred stock into shares of our common stock immediately prior to the completion of this offering.
(3) The pro forma as adjusted balance sheet data reflect the conversion of all outstanding shares of our preferred stock into shares of our common stock immediately prior to the completion of this offering and our receipt of estimated net proceeds of $61.9 million from our sale of 5,320,000 shares of common stock that we are offering at an assumed public offering price of $13.00 per share, after deducting estimated underwriting discounts and commissions and estimated offering expenses payable by us.

8


Table of Contents

 
RISK FACTORS
 
Investing in our common stock involves a high degree of risk. You should carefully consider the following risks and all other information contained in this prospectus, including our consolidated financial statements and the related notes, before investing in our common stock. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, also may become important factors that affect us. If any of the following risks materialize, our business, financial condition or results of operations could be materially harmed. In that case, the trading price of our common stock could decline, and you may lose some or all of your investment.
 
Risks Related to Our Business
 
We have had operating losses since our inception and we expect operating expenses to increase in the foreseeable future and we may never reach or maintain profitability.
 
We have incurred operating losses each year since our inception in 2001. Our net loss was approximately $10.5 million for the year ended December 31, 2004, $5.5 million for the year ended December 31, 2005 and $0.9 million for the year ended December 31, 2006. Our accumulated deficit as of December 31, 2006 is approximately $38.9 million. Becoming profitable will depend in large part on our ability to generate and sustain increased revenue levels in future periods. Although our revenue has generally been increasing and our losses have generally been decreasing when compared to prior periods, you should not assume that we will become profitable in the near future or at any other time. We may never achieve profitability and, even if we do, we may not be able to maintain or increase our level of profitability. We expect that our operating expenses will continue to increase in the foreseeable future as we seek to expand our customer base, increase our sales and marketing efforts, continue to invest in research and development of our technologies and product enhancements and incur significant new costs associated with becoming a public company. These efforts may be more costly than we expect and we may not be able to increase our revenue enough to offset our higher operating expenses. In addition, if our new products and product enhancements fail to achieve adequate market acceptance, our revenue will suffer. If we cannot increase our revenue at a greater rate than our expenses, we will not become and remain profitable.
 
We face intense competition in our market, especially from larger, better-known companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position.
 
The market for network security monitoring, detection, prevention and response solutions is intensely competitive, and we expect competition to increase in the future. We may not compete successfully against our current or potential competitors, especially those with significantly greater financial resources or brand name recognition. Our chief competitors include large software companies, software or hardware network infrastructure companies, smaller software companies offering relatively limited applications for network and Internet security monitoring, detection, prevention or response and small and large companies offering point solutions that compete with components of our product offerings.
 
Mergers or consolidations among these competitors, or acquisitions of our competitors by large companies, present heightened competitive challenges to our business. For example, Symantec Corporation, Cisco Systems, Inc., McAfee, Inc., 3Com Corporation and Juniper Networks, Inc. have acquired during the past several years smaller companies, which have intrusion detection or prevention technologies and Internet Security Systems, Inc. has recently been acquired by IBM. These acquisitions will make these combined entities potentially more formidable competitors to us if such products and offerings are effectively integrated. Large companies may have advantages over us because of their longer operating histories, greater brand name recognition, larger customer bases or greater financial, technical and marketing resources. As a result, they may be able to adapt more quickly to new or emerging technologies and changes in customer requirements. They also have greater resources to devote to the promotion and sale of their products than we have. In addition, these companies have reduced and could continue to reduce, the price of their security monitoring, detection, prevention and response products and managed security services, which intensifies pricing pressures within our market.
 
Several companies currently sell software products (such as encryption, firewall, operating system security and virus detection software) that our customers and potential customers have broadly adopted. Some of these


9


Table of Contents

companies sell products that perform the same functions as some of our products. In addition, the vendors of operating system software or networking hardware may enhance their products to include functions similar to those that our products currently provide. The widespread inclusion of comparable features to our software in operating system software or networking hardware could render our products less competitive or obsolete, particularly if such features are of a high quality. Even if security functions integrated into operating system software or networking hardware are more limited than those of our products, a significant number of customers may accept more limited functionality to avoid purchasing additional products such as ours.
 
One of the characteristics of open source software is that anyone can offer new software products for free under an open source licensing model in order to gain rapid and widespread market acceptance. Such competition can develop without the degree of overhead and lead time required by traditional technology companies. It is possible for new competitors with greater resources than ours to develop their own open source security solutions, potentially reducing the demand for our solutions. We may not be able to compete successfully against current and future competitors. Competitive pressure and/or the availability of open source software may result in price reductions, reduced revenue, reduced operating margins and loss of market share, any one of which could seriously harm our business.
 
New competitors could emerge or our customers or distributors could internally develop alternatives to our products and either development could impair our sales.
 
We may face competition from emerging companies as well as established companies who have not previously entered the market for network security products. Established companies may not only develop their own network intrusion detection and prevention products, but they may also acquire or establish product integration, distribution or other cooperative relationships with our current competitors. Moreover, our large corporate customers and potential customers could develop network security software internally, which would reduce our potential revenue. New competitors or alliances among competitors may emerge and rapidly acquire significant market share due to factors such as greater brand name recognition, a larger installed customer base and significantly greater financial, technical, marketing and other resources and experience. For example, one of our competitors, Internet Security Systems, Inc., has recently been acquired by IBM and the combined company, if successfully integrated, could become a formidable competitor to us. In addition, the acquisition could result in a loss of our current sales to IBM if IBM were to discontinue reselling our products and services. If these new competitors are successful, we would lose market share and our revenue would likely decline.
 
Our quarterly operating results are likely to vary significantly and be unpredictable, in part because of the purchasing and budget practices of our customers, which could cause the trading price of our stock to decline.
 
Our operating results have historically varied significantly from period to period, and we expect that they will continue to do so as a result of a number of factors, most of which are outside of our control, including:
 
  •  the budgeting cycles, internal approval requirements and funding available to our existing and prospective customers for the purchase of network security products;
 
  •  the timing, size and contract terms of orders received, which have historically been highest in the fourth quarter (representing more than one-third of our total revenue in recent years), but may fluctuate seasonally in different ways;
 
  •  the level of perceived threats to network security, which may fluctuate from period to period;
 
  •  the level of demand for products sold by original equipment manufacturers, or OEMs, resellers and distributors that incorporate and resell our technologies;
 
  •  the market acceptance of open-source software solutions;
 
  •  the announcement or introduction of new product offerings by us or our competitors, and the levels of anticipation and market acceptance of those products;
 
  •  price competition;
 
  •  general economic conditions, both domestically and in our foreign markets;


10


Table of Contents

 
  •  the product mix of our sales; and
 
  •  the timing of revenue recognition for our sales.
 
In particular, the network security technology procurement practices of many of our customers have had a measurable influence on the historical variability of our operating performance. Our prospective customers usually exercise great care and invest substantial time in their network security technology purchasing decisions. Many of our customers have historically finalized purchase decisions in the last weeks or days of a quarter. A delay in even one large order beyond the end of a particular quarter can substantially diminish our anticipated revenue for that quarter. In addition, many of our expenses must be incurred before we generate revenue. As a result, the negative impact on our operating results would increase if our revenue fails to meet expectations in any period.
 
The cumulative effect of these factors will likely result in larger fluctuations and unpredictability in our quarterly operating results than in the operating results of many other software and technology companies. This variability and unpredictability could result in our failing to meet the revenue or operating results expectations of securities industry analysts or investors for any period. If we fail to meet or exceed such expectations for these or any other reasons, the market price of our shares could fall substantially and we could face costly securities class action suits. Therefore, you should not rely on our operating results in any quarter as being indicative of our operating results for any future period, nor should you rely on other expectations, predictions or projections of our future revenue or other aspects of our results of operations.
 
The market for network security products is rapidly evolving and the complex technology incorporated in our products makes them difficult to develop. If we do not accurately predict, prepare for and respond promptly to technological and market developments and changing customer needs, our competitive position and prospects will be harmed.
 
The market for network security products is relatively new and is expected to continue to evolve rapidly. Moreover, many customers operate in markets characterized by rapidly changing technologies and business plans, which require them to add numerous network access points and adapt increasingly complex enterprise networks, incorporating a variety of hardware, software applications, operating systems and networking protocols. In addition, computer hackers and others who try to attack networks employ increasingly sophisticated new techniques to gain access to and attack systems and networks. Customers look to our products to continue to protect their networks against these threats in this increasingly complex environment without sacrificing network efficiency or causing significant network downtime. The software in our products is especially complex because it needs to effectively identify and respond to new and increasingly sophisticated methods of attack, while not impeding the high network performance demanded by our customers. Although the market expects speedy introduction of software to respond to new threats, the development of these products is difficult and the timetable for commercial release of new products is uncertain. Therefore, we may in the future experience delays in the introduction of new products or new versions, modifications or enhancements of existing products. If we do not quickly respond to the rapidly changing and rigorous needs of our customers by developing and introducing on a timely basis new and effective products, upgrades and services that can respond adequately to new security threats, our competitive position and business prospects will be harmed.
 
If our new products and product enhancements do not achieve sufficient market acceptance, our results of operations and competitive position will suffer.
 
We spend substantial amounts of time and money to research and develop new products and enhanced versions of Snort, the Defense Center and our Intrusion Sensors and RNA products to incorporate additional features, improved functionality or other enhancements in order to meet our customers’ rapidly evolving demands for network security in our highly competitive industry. When we develop a new product or an advanced version of an existing product, we typically expend significant money and effort upfront to market, promote and sell the new offering. Therefore, when we develop and introduce new or enhanced products, they must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing the products to market.


11


Table of Contents

Our new products or enhancements could fail to attain sufficient market acceptance for many reasons, including:
 
  •  delays in introducing new, enhanced or modified products;
 
  •  defects, errors or failures in any of our products;
 
  •  inability to operate effectively with the networks of our prospective customers;
 
  •  inability to protect against new types of attacks or techniques used by hackers;
 
  •  negative publicity about the performance or effectiveness of our intrusion prevention or other network security products;
 
  •  reluctance of customers to purchase products based on open source software; and
 
  •  disruptions or delays in the availability and delivery of our products, which problems are more likely due to our just-in-time manufacturing and inventory practices.
 
If our new products or enhancements (including, but not limited to, version 4.0 of RNA, which we plan to introduce in the next several months) do not achieve adequate acceptance in the market, our competitive position will be impaired, our revenue will be diminished and the effect on our operating results may be particularly acute because of the significant research, development, marketing, sales and other expenses we incurred in connection with the new product.
 
If existing customers do not make subsequent purchases from us or if our relationships with our largest customers are impaired, our revenue could decline.
 
In 2004, 2005 and 2006, existing customers that purchased additional products and services from us, whether for new locations or additional technology to protect existing networks and locations, generated a majority of our total revenue for each respective period. Part of our growth strategy is to sell additional products to our existing customers and, in particular, to up-sell our RNA products to customers that previously bought our Intrusion Sensor products. We may not be effective in executing this or any other aspect of our growth strategy. Our revenue could decline if our current customers do not continue to purchase additional products from us. In addition, as we deploy new versions of our existing Snort, Intrusion Sensors and RNA products or introduce new products, our current customers may not require the functionality of these products and may not purchase them.
 
We also depend on our installed customer base for future service revenue from annual maintenance fees. Our maintenance and support agreements typically have durations of one year. Approximately 82% of our customers renewed their maintenance and support agreements upon expiration in the year ended December 31, 2006. No single customer contributed greater than 10% of our recurring maintenance and support revenues in 2005 or in 2006. If customers choose not to continue their maintenance service, our revenue may decline.
 
If we cannot attract sufficient government agency customers, our revenue and competitive position will suffer.
 
Contracts with the U.S. federal and state and other national and state government agencies accounted for 17% of our total revenue for the year ended December 31, 2004, 16% for the year ended December 31, 2005 and 11% for the year ended December 31, 2006. We lost many government agency customers when a foreign company tried unsuccessfully to acquire us in late 2005 and early 2006. Since then, we have been attempting to regain government customers, which subjects us to a number of risks, including:
 
  •  Procurement.  Contracting with public sector customers is highly competitive and can be expensive and time-consuming, often requiring that we incur significant upfront time and expense without any assurance that we will win a contract;
 
  •  Budgetary Constraints and Cycles.  Demand and payment for our products and services are impacted by public sector budgetary cycles and funding availability, with funding reductions or delays adversely impacting public sector demand for our products, including delays caused by continuing resolutions or other temporary funding arrangements resulting from the current congressional transition;


12


Table of Contents

 
  •  Modification or Cancellation of Contracts.  Public sector customers often have contractual or other legal rights to terminate current contracts for convenience or due to a default. If a contract is cancelled for convenience, which can occur if the customer’s product needs change, we may only be able to collect for products and services delivered prior to termination. If a contract is cancelled because of default, we may only be able to collect for products and alternative products and services delivered to the customer;
 
 
  •  Governmental Audits.  National governments and other state and local agencies routinely investigate and audit government contractors’ administrative processes. They may audit our performance and pricing and review our compliance with applicable rules and regulations. If they find that we improperly allocated costs, they may require us to refund those costs or may refuse to pay us for outstanding balances related to the improper allocation. An unfavorable audit could result in a reduction of revenue, and may result in civil or criminal liability if the audit uncovers improper or illegal activities.
 
  •  Replacing Existing Products.  After we announced in October 2005 that we had agreed to be acquired by a foreign company, many government agencies were unwilling to buy products from us and instead purchased and installed products sold by our competitors. The proposed acquisition was terminated in April 2006 following objections from the Committee on Foreign Investment in the United States. Since that time, we have been attempting to retain government agency customers. Many government agencies, however, already have installed network security products of our competitors. It can be very difficult to convince government agencies or other prospective customers to replace their existing network security solutions with our products, even if we can demonstrate the superiority of our products.
 
We are subject to risks of operating internationally that could impair our ability to grow our revenue abroad.
 
We market and sell our software in North America, South America, Europe, Asia and Australia and we plan to establish additional sales presence in these and other parts of the world. Therefore, we are subject to risks associated with having worldwide operations. Sales to customers located outside of the United States accounted for approximately 18% of our total revenue in the year ended December 31, 2004, approximately 18% of our total revenue in the year ended December 31, 2005 and approximately 19% of our total revenue in the year ended December 31, 2006. The expansion of our existing operations and entry into additional worldwide markets will require significant management attention and financial resources. We are also subject to a number of risks customary for international operations, including:
 
  •  economic or political instability in foreign markets;
 
  •  greater difficulty in accounts receivable collection and longer collection periods;
 
  •  unexpected changes in regulatory requirements;
 
  •  difficulties and costs of staffing and managing foreign operations;
 
  •  import and export controls;
 
  •  the uncertainty of protection for intellectual property rights in some countries;
 
  •  costs of compliance with foreign laws and laws applicable to companies doing business in foreign jurisdictions;
 
  •  management communication and integration problems resulting from cultural differences and geographic dispersion;
 
  •  multiple and possibly overlapping tax structures; and
 
  •  foreign currency exchange rate fluctuations.
 
To date, a substantial portion of our sales have been denominated in U.S. dollars, and we have not used risk management techniques or “hedged” the risks associated with fluctuations in foreign currency exchange rates. In the future, if we do not engage in hedging transactions, our results of operations will be subject to losses from fluctuations in foreign currency exchange rates.


13


Table of Contents

In the future, we may not be able to secure financing necessary to operate and grow our business as planned.
 
We expect that the net proceeds from this offering together with current cash, cash equivalents, borrowings under our credit facility and short-term investments should be sufficient to meet our anticipated cash needs for working capital and capital expenditures for at least the next 24 months. However, our business and operations may consume resources faster than we anticipate. In the future, we may need to raise additional funds to expand our sales and marketing and research and development efforts or to make acquisitions. Additional financing may not be available on favorable terms, if at all. If adequate funds are not available on acceptable terms, we may be unable to fund the expansion of our sales and marketing and research and development efforts or take advantage of acquisition or other opportunities, which could seriously harm our business and operating results. If we issue debt, the debt holders would have rights senior to common stockholders to make claims on our assets and the terms of any debt could restrict our operations, including our ability to pay dividends on our common stock. Furthermore, if we issue additional equity securities, stockholders will experience dilution, and the new equity securities could have rights senior to those of our common stock.
 
Our inability to acquire and integrate other businesses, products or technologies could seriously harm our competitive position.
 
In order to remain competitive, we intend to acquire additional businesses, products or technologies. If we identify an appropriate acquisition candidate, we may not be successful in negotiating the terms of the acquisition, financing the acquisition, or effectively integrating the acquired business, product or technology into our existing business and operations. Any acquisitions we are able to complete may not be accretive to earnings. Further, completing a potential acquisition and integrating an acquired business will significantly divert management time and resources.
 
If other parties claim commercial ownership rights to Snort, our reputation, customer relations and results of operations could be harmed.
 
While we created a majority of the current Snort code base, a portion of the current Snort code was created by the combined efforts of the Company and the open source software community and a portion was created solely by the open source community. We believe that the portions of the Snort code base created by anyone other than by us are required to be licensed by us pursuant to the GNU General Public License, or GPL, which is how we currently license Snort. There is a risk, however, that a third party could claim some ownership rights in Snort, and attempt to prevent us from commercially licensing Snort in the future (rather than pursuant to the GPL as it is currently licensed) and claim a right to licensing royalties. Any such claim, regardless of its merit or outcome, could be costly to defend, harm our reputation and customer relations and result in our having to pay substantial compensation to the party claiming ownership.
 
Our products contain third party open source software, and failure to comply with the terms of the underlying open source software licenses could restrict our ability to sell our products.
 
Our products are distributed with software programs licensed to us by third party authors under “open source” licenses, which may include the GPL, the GNU Lesser Public License, or LGPL, the BSD License and the Apache License. These open source software programs include, without limitation, Snort®, Linux, Apache, Openssl, Etheral, IPTables, Tcpdump and Tripwire. These third party open source programs are typically licensed to us for a minimal fee or no fee at all, and the underlying license agreements generally require us to make available to the open source user community the source code for such programs, as well as the source code for any modifications or derivative works we create based on these third party open source software programs. With the exception of Snort, we have not created any modifications or derivative works to any other open source software programs referenced above. We regularly release updates and upgrades to the Snort software program under the terms and conditions of the GNU GPL version 2. Included with our software and/or appliances are copies of the relevant source code and licenses for the open source programs. Alternatively, we include instructions to users on how to obtain copies of the relevant open source code and licenses. Additionally, if we combine our proprietary software with third party open source software in a certain manner, we could, under the terms of certain of these open source license agreements, be required to release the source code of our proprietary software. This could also allow our competitors to create similar products, which would result in a loss of our product sales. We do not provide end users a copy of the source


14


Table of Contents

code to our proprietary software because we believe that the manner in which our proprietary software is aligned with the relevant open source programs does not create a modification or derivative work of that open source program requiring the distribution of our proprietary source code. Our ability to commercialize our products by incorporating third party open source software may be restricted because, among other reasons:
 
  •  the terms of open source license agreements may be unclear and subject to varying interpretations, which could result in unforeseen obligations regarding our proprietary products;
 
  •  it may be difficult to determine the developers of open source software and whether such licensed software infringes another party’s intellectual property rights;
 
  •  competitors will have greater access to information by obtaining these open source products, which may help them develop competitive products; and
 
  •  open source software potentially increases customer support costs because licensees can modify the software and potentially introduce errors.
 
The software program Linux is included in our products and is licensed under the GPL. The GPL is the subject of litigation in the case of The SCO Group, Inc. v. International Business Machines Corp., pending in the United States District Court for the District of Utah. It is possible that the court could rule that the GPL is not enforceable in such litigation. Any ruling by the court that the GPL is not enforceable could have the effect of limiting or preventing us from using Linux as currently implemented.
 
Efforts to assert intellectual property ownership rights in our products could impact our standing in the open source community which could limit our product innovation capabilities.
 
When we undertake actions to protect and maintain ownership and control over our proprietary intellectual property, including patents, copyrights and trademark rights, our standing in the open source community could be diminished which could result in a limitation on our ability to continue to rely on this community as a resource to identify and defend against new viruses, threats and techniques to attack secure networks, explore new ideas and concepts and further our research and development efforts.
 
Our proprietary rights may be difficult to enforce, which could enable others to copy or use aspects of our products without compensating us.
 
We rely primarily on copyright, trademark, patent and trade secrets laws, confidentiality procedures and contractual provisions to protect our proprietary rights. As of the date hereof, we had 25 patent applications pending for examination in the U.S. and foreign jurisdictions. We also hold numerous registered United States and foreign trademarks and have a number of trademark applications pending in the United States and in foreign jurisdictions. Valid patents may not be issued from pending applications, and the claims allowed on any patents may not be sufficiently broad to protect our technology or products. Any issued patents may be challenged, invalidated or circumvented, and any rights granted under these patents may not actually provide adequate protection or competitive advantages to us. Despite our efforts to protect our proprietary rights, unauthorized parties may attempt to copy aspects of our products or to obtain and use information that we regard as proprietary. Policing unauthorized use of our technologies or products is difficult. Our products incorporate open source Snort software, which is readily available to the public. In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as do the laws of the United States, and many foreign countries do not enforce these laws as diligently as U.S. government agencies and private parties. It is possible that we may have to resort to litigation to enforce and protect our copyrights, trademarks, patents and trade secrets, which litigation could be costly and a diversion of management resources. If we are unable to protect our proprietary rights to the totality of the features in our software and products (including aspects of our software and products protected other than by patent rights), we may find ourselves at a competitive disadvantage to others who need not incur the additional expense, time and effort required to create the innovative products that have enabled us to be successful to date.
 
In limited instances we have agreed to place, and in the future may place, source code for our software in escrow, other than the Snort source code which is publicly available. In most cases, the source code may be made available to certain of our customers and OEM partners in the event that we file for bankruptcy or materially fail to support our products. This may increase the likelihood of misappropriation or other misuse of our software. We


15


Table of Contents

have agreed to source code escrow arrangements in the past only rarely and usually only in connection with prospective customers considering a significant purchase of our products and services.
 
Claims that our products infringe the proprietary rights of others could harm our business and cause us to incur significant costs.
 
Technology products such as ours, which interact with multiple components of complex networks, are increasingly subject to infringement claims as the functionality of products in different industry segments overlaps. In particular, our RNA technology is a new technology for which we have yet be issued a patent. It is possible that other companies have patents with respect to technology similar to our technology, including RNA. Ten of our 25 pending patent applications relate to our RNA technology and were filed in 2003, 2004 and 2005. If others filed patent applications before us, which contain allowable claims within the scope of our RNA technology, then we may be found to infringe on such patents, if and when they are issued. We are aware of at least one company that has filed an application for a patent that, on its face, contains claims that may be construed to be within the scope of the same broad technology area as our RNA technology. That company, PredatorWatch, has filed suit against us for misappropriation and incorporation in our RNA technology of its proprietary rights (see discussion in next risk factor). PredatorWatch has separately notified us that it believes that our RNA technology is covered by claims in a pending patent application filed by PredatorWatch. Unless and until the U.S. Patent and Trademark Office, or PTO, issues a patent to an applicant, there can be no way to assess a potential patentee’s right to exclude. Depending on the timing and substance of these patents and patent applications, our products, including our RNA technology, may infringe the proprietary rights of others, and we may be subject to litigation with respect to any alleged infringement. The application of patent law to the software industry is particularly uncertain as the PTO has only recently begun to issue software patents in large numbers and there is a backlog of software related patent applications pending claiming inventions whose priority dates may pre-date development of our own proprietary software. Additionally, in our customer contracts we typically agree to indemnify our customers if they incur losses resulting from a third party claim that their use of our products infringes upon the intellectual property rights of a third party. Any potential intellectual property claims against us, with or without merit, could:
 
  •  be very expensive and time consuming to defend;
 
  •  require us to indemnify our customers for losses resulting from such claims;
 
  •  cause us to cease making, licensing or using software or products that incorporate the challenged intellectual property;
 
  •  cause product shipment and installation delays;
 
  •  require us to redesign our products, which may not be feasible;
 
  •  divert management’s attention and resources; or
 
  •  require us to enter into royalty or licensing agreements in order to obtain the right to use a necessary product or component.
 
Royalty or licensing agreements, if required, may not be available on acceptable terms, if at all. A successful claim of infringement against us and our failure or inability to license the infringed or similar technology could prevent us from distributing our products and cause us to incur great expense and delay in developing non-infringing products.
 
We have been sued by a company claiming that we misappropriated and incorporated its proprietary rights into our 3D product line and our defense of these claims is costly, diverts the attention of our management and may be unsuccessful.
 
On April 25, 2006, we were served with a complaint filed by PredatorWatch (now named NetClarity) in the Superior Court for Suffolk County, Massachusetts. The plaintiff alleges that we, Martin F. Roesch, our Chief Technology Officer, and Inflection Point Associates, L.P., the general partner of one of our stockholders, Inflection Point Ventures, L.P. (i) misappropriated and incorporated the plaintiff’s trade secrets; (ii) breached an oral agreement of confidentiality; (iii) breached a covenant of good faith and fair dealing owed to the plaintiff;


16


Table of Contents

(iv) were unjustly enriched; (v) misrepresented certain material facts to the plaintiff, upon which the plaintiff relied to its detriment; and (vi) engaged in unfair and deceptive acts in violation of Massachusetts state law. The plaintiff has sought to recover amounts to be ascertained and established, as well as double and treble damages and attorney’s fees.
 
Litigation is subject to inherent uncertainties, especially in cases like this where sophisticated factual issues must be assessed and complex technical issues must be resolved. In addition, these types of cases involve issues of law that are evolving, presenting further uncertainty. Our defense of this litigation, regardless of the merits of the complaint, has been, and will likely continue to be, time consuming, extremely costly and a diversion of time and attention for our technical and management personnel. Through December 31, 2006, we have spent approximately $198,000 in legal fees and expenses on this litigation and expect to incur substantial additional expenses even if we ultimately prevail. Publicity related to this litigation could likely have a negative impact on our sales of our 3D product line and a negative impact on the price of our common stock. Sales of our 3D product line amounted to $21.7 million and $26.9 million for 2005 and 2006, respectively, or 66% and 60% of our total sales for 2005 and 2006, respectively.
 
A failure to prevail in the litigation could result in one or more of the following:
 
  •  our paying substantial monetary damages, which could be tripled if any misappropriation is found to have been willful, and which may include paying an ongoing significant royalty to PredatorWatch or compensation for lost profits to PredatorWatch;
 
  •  our paying substantial punitive damages;
 
  •  our having to provide an accounting of all revenue received from selling our 3D product line in its current form;
 
  •  the issuance of a preliminary or permanent injunction requiring us to stop selling our 3D product line in its current form;
 
  •  our having to redesign our 3D product line, which could be costly and time-consuming and could substantially delay our 3D product line shipments, assuming that a redesign is feasible;
 
  •  our having to reimburse PredatorWatch for some or all of its attorneys’ fees and costs, which would be substantial;
 
  •  our having to obtain from PredatorWatch a license to use its technology, which might not be available on reasonable terms, if at all; or
 
  •  our having to indemnify our customers against any losses they may incur due to the alleged infringement.
 
Additionally, PredatorWatch has separately notified us that they believe that our RNA technology and 3D security solutions are covered by claims contained in a pending patent application. This pending patent application has not issued as a patent, but in the event it does issue, PredatorWatch could file an additional complaint to include a patent infringement claim against us.
 
If we are enjoined from selling our 3D product line in its current form, we may be required to redesign our 3D product line to avoid infringing on the intellectual property rights of others. If we are unable to efficiently redesign commercially acceptable products, our sales will decline substantially. This litigation is at an early stage, so we cannot predict its course or its costs to us. We do, however, expect to continue to incur significant costs in defending against this litigation and these costs could increase substantially if this litigation approaches or enters a trial phase. It is possible that these costs could substantially exceed our expectations in future periods. For a more detailed description of this litigation, please see “Business — Legal Proceedings.”
 
We rely on software licensed from other parties, the loss of which could increase our costs and delay software shipments.
 
We utilize various types of software licensed from unaffiliated third parties. For example, we license database software from MySQL that we use in our Intrusion Sensors, our RNA Sensors and our Defense Centers. Our


17


Table of Contents

Agreement with MySQL permits us to distribute MySQL software on our products to our customers worldwide until December 31, 2010. We amended our MySQL agreement on December 29, 2006 to give us the unlimited right to distribute MySQL software in exchange for a one-time lump-sum payment. We believe that the MySQL agreement is material to our business because we have spent a significant amount of development resources to allow the MySQL software to function in our products. If we were forced to find replacement database software for our products, we would be required to expend resources to implement a replacement database in our products, and there would be no guarantee that we would be able to procure the replacement on the same or similar commercial terms.
 
In addition to MySQL, we rely on other open source software, such as the Linux operating system, the Apache web server and OpenSSL, a secure socket layer implementation. These open source programs are licensed to us under various open source licenses. For example, Linux is licensed under the GNU General Public License, while Apache and OpenSSL are licensed under other forms of open source license agreements. If we could no longer rely on these open source programs, the functionality of our products would be impaired and, we would be required to expend significant resources to find suitable alternatives.
 
Our business would be disrupted if any of the software we license from others or functional equivalents of this software were either no longer available to us or no longer offered to us on commercially reasonable terms. In either case, we would be required to either redesign our products to function with software available from other parties or develop these components ourselves, which would result in increased costs and could result in delays in our product shipments and the release of new product offerings. Furthermore, we might be forced to limit the features available in our current or future products. If we fail to maintain or renegotiate any of these software licenses, we could face significant delays and diversion of resources in attempting to license and integrate a functional equivalent of the software.
 
Defects, errors or vulnerabilities in our software products would harm our reputation and divert resources.
 
Because our products are complex, they may contain defects, errors or vulnerabilities that are not detected until after our commercial release and installation by our customers. We may not be able to correct any errors or defects or address vulnerabilities promptly, or at all. Any defects, errors or vulnerabilities in our products could result in:
 
  •  expenditure of significant financial and product development resources in efforts to analyze, correct, eliminate or work-around errors or defects or to address and eliminate vulnerabilities;
 
  •  loss of existing or potential customers;
 
  •  delayed or lost revenue;
 
  •  delay or failure to attain market acceptance;
 
  •  increased service, warranty, product replacement and product liability insurance costs; and
 
  •  negative publicity, which will harm our reputation.
 
In addition, because our products and services provide and monitor network security and may protect valuable information, we could face claims for product liability, tort or breach of warranty. Anyone who circumvents our security measures could misappropriate the confidential information or other valuable property of customers using our products, or interrupt their operations. If that happens, affected customers or others may sue us. In addition, we may face liability for breaches of our product warranties, product failures or damages caused by faulty installation of our products. Provisions in our contracts relating to warranty disclaimers and liability limitations may be unenforceable. Some courts, for example, have found contractual limitations of liability in standard computer and software contracts to be unenforceable in some circumstances. Defending a lawsuit, regardless of its merit, could be costly and divert management attention. Our business liability insurance coverage may be inadequate or future coverage may be unavailable on acceptable terms or at all.
 
Our networks, products and services are vulnerable to, and may be targeted by, hackers.
 
Like other companies, our websites, networks, information systems, products and services may be targets for sabotage, disruption or misappropriation by hackers. As a leading network security solutions company, we are a


18


Table of Contents

high profile target and our networks, products and services may have vulnerabilities that may be targeted by hackers. Although we believe we have sufficient controls in place to prevent disruption and misappropriation, and to respond to such situations, we expect these efforts by hackers to continue. If these efforts are successful, our operations, reputation and sales could be adversely affected.
 
We utilize a just-in-time contract manufacturing and inventory process, which increases our vulnerability to supply disruption.
 
Our ability to meet our customers’ demand for certain of our products depends upon obtaining adequate hardware platforms on a timely basis, which must be integrated with our software. We purchase hardware platforms through our contract manufacturers from a limited number of suppliers on a just-in-time basis. In addition, these suppliers may extend lead times, limit the supply to our manufacturers or increase prices due to capacity constraints or other factors. Although we work closely with our manufacturers and suppliers to avoid shortages, we may encounter these problems in the future. Our results of operations would be adversely affected if we were unable to obtain adequate supplies of hardware platforms in a timely manner or if there were significant increases in the costs of hardware platforms or problems with the quality of those hardware platforms.
 
We depend on a single source to manufacture our enterprise class intrusion sensor product; if that sole source were to fail to satisfy our requirements, our sales revenue would decline and our reputation would be harmed.
 
We rely on one manufacturer, Bivio Networks, to build the hardware platform for two models of our intrusion sensor products that are used by our enterprise class customers. These enterprise class intrusion sensor products are purchased directly by customers for their internal use and are also utilized by third party managed security service providers to provide services to their customers. Revenue resulting from sales of these enterprise class intrusion sensor products accounted for approximately 3.8% of our product revenue in the year ended December 31, 2005 and approximately 21% of our product revenue in the year ended December 31, 2006. The unexpected termination of our relationship with Bivio Networks would be disruptive to our business and our reputation which could result in a decline in our revenue as well as shipment delays and possible increased costs as we seek and implement production with an alternate manufacturer.
 
Our inability to hire and retain key personnel would slow our growth.
 
Our business is dependent on our ability to hire, retain and motivate highly qualified personnel, including senior management, sales and technical professionals. In particular, we intend to expand the size of our direct sales force domestically and internationally and to hire additional customer support and professional services personnel. However, competition for qualified services personnel is intense, and if we are unable to attract, train or retain the number of highly qualified sales and services personnel that our business needs, our reputation, customer satisfaction and potential revenue growth could be seriously harmed. To the extent we hire personnel from competitors, we may be subject to allegations that they have been improperly solicited or divulged proprietary or other confidential information.
 
Our future success will depend to a significant extent on the continued services of Martin Roesch, our founder and Chief Technology Officer, and E. Wayne Jackson, III, our Chief Executive Officer. The loss of the services of either of these or other individuals could adversely affect our business and could divert other senior management time in searching for their replacements.
 
We depend on resellers and distributors for our sales; if they fail to perform as expected, our revenue will suffer.
 
Part of our business strategy involves entering into additional agreements with resellers and distributors that permit them to resell our products and service offerings. Revenue resulting from our resellers and distributors accounted for approximately 46% of our total revenue in the year ended December 31, 2004, approximately 48% of our total revenue in the year ended December 31, 2005 and approximately 49% of our total revenue in the year ended December 31, 2006. For the year ended December 31, 2005 and for the year ended December 31, 2006, no single reseller, distributor, customer or OEM accounted for more than ten percent of our total revenue. There is a risk that our pace of entering into such agreements may slow, or that our existing agreements may not produce as much business as we anticipate. There is also a risk that some or all of our resellers or distributors may be acquired,


19


Table of Contents

may change their business models or may go out of business, any of which could have an adverse effect on our business. For example, IBM, our current reseller, recently completed its acquisition of Internet Security Systems, Inc., one of our competitors. Sales of our products to IBM or where IBM helped influence the sales process as a percentage of our total revenue were 3.1% and 1.2% for the year ended December 31, 2006 and the year ended December 31, 2005, respectively. While we have received oral assurances from IBM that it does not expect any material change to our reseller relationship solely on account of its acquisition of Internet Security Systems, Inc., we cannot currently anticipate how our relationship with IBM may change. IBM may decide to discontinue reselling our products and services.
 
If we do not continue to establish and effectively manage our OEM relationships, our revenue could decline.
 
Our ability to sell our network security software products in new markets and to increase our share of existing markets will be impaired if we fail to expand our indirect distribution channels. Our sales strategy involves the establishment of multiple distribution channels domestically and internationally through strategic resellers, system integrators and OEMs. We have alliances with OEMs such as IBM and Nokia and we cannot predict the extent to which these companies will be successful in marketing or selling our software. These agreements could be terminated on short notice and they do not prevent our OEMs, systems integrators, strategic resellers or other distributors from selling the network security software of other companies, including our competitors. IBM and Nokia or any other OEM, system integrator, strategic reseller or distributor could give higher priority to other companies’ software or to their own software than they give to ours, which could cause our revenue to decline. Additionally, IBM recently completed its acquisition of Internet Security Systems, Inc., one of our competitors. Our ability to sell our network security software products through IBM as a reseller or have our product sales influenced by them as a partner could be materially diminished.
 
Our inability to effectively manage our expected headcount growth and expansion and our additional obligations as a public company could seriously harm our ability to effectively run our business.
 
Our historical growth has placed, and our intended future growth is likely to continue to place, a significant strain on our management, financial, personnel and other resources. We will likely not continue to grow at our historical pace due to limits on our resources. We have grown from 84 employees at December 31, 2003 to 182 employees at December 31, 2006. Since January 1, 2005, we have opened additional sales offices and have significantly expanded our operations. This rapid growth has strained our facilities and required us to lease additional space at our headquarters. In several recent quarters, we have not been able to hire sufficient personnel to keep pace with our growth. In addition to managing our expected growth, we will have substantial additional obligations and costs as a result of being a public company. These obligations include investor relations, preparing and filing periodic SEC reports, developing and maintaining internal controls over financial reporting and disclosure controls, compliance with corporate governance rules, Regulation FD and other requirements imposed on public companies by the SEC and the Nasdaq Global Market. Fulfilling these additional obligations will make it more difficult to operate a growing company. Any failure to effectively manage growth or fulfill our obligations as a public company could seriously harm our ability to respond to customers, the quality of our software and services and our operating results. To effectively manage growth and operate a public company, we will need to implement additional management information systems, improve our operating, administrative, financial and accounting systems and controls, train new employees and maintain close coordination among our executive, engineering, accounting, finance, marketing, sales and operations organizations.
 
Risks Related to Your Investment
 
The price of our common stock may be subject to wide fluctuations and may trade below the initial public offering price.
 
Before this offering, there has not been a public market for our common stock. The initial public offering price of our common stock will be determined by negotiations between us and representatives of the underwriters, based on numerous factors, including those that we discuss under “Underwriters.” This price may not be indicative of the market price of our common stock after this offering. We cannot assure you that an active public market for our common stock will develop or be sustained after this offering. The market price of our common stock also could be


20


Table of Contents

subject to significant fluctuations. As a result, you may not be able to sell your shares of our common stock quickly or at prices equal to or greater than the price you paid in this offering.
 
Among the factors that could affect our common stock price are the risks described in this “Risk Factors” section and other factors, including:
 
  •  quarterly variations in our operating results compared to market expectations;
 
  •  changes in expectations as to our future financial performance, including financial estimates or reports by securities analysts;
 
  •  changes in market valuations of similar companies;
 
  •  liquidity and activity in the market for our common stock;
 
  •  actual or expected sales of our common stock by our stockholders;
 
  •  strategic moves by us or our competitors, such as acquisitions or restructurings;
 
  •  general market conditions; and
 
  •  domestic and international economic, legal and regulatory factors unrelated to our performance.
 
Stock markets in general have experienced extreme volatility that has often been unrelated to the operating performance of a particular company. These broad market fluctuations may adversely affect the trading price of our common stock, regardless of our operating performance.
 
Sales of substantial amounts of our common stock in the public markets, or the perception that they might occur, could reduce the price that our common stock might otherwise attain and may dilute your voting power and your ownership interest in us.
 
After the completion of this offering, we will have 23,113,892 outstanding shares of common stock (23,979,392 shares of common stock if the underwriters exercise in full their option to purchase additional shares). This number is comprised of all the shares of our common stock that we are selling in this offering, which may be resold immediately in the public market. Subject to certain exceptions described under the caption “Underwriters,” we and all of our directors and executive officers and certain of our stockholders and option holders have agreed not to offer, sell or agree to sell, directly or indirectly, any shares of common stock without the permission of the underwriters for a period of 180 days from the date of this prospectus. When this period expires we and our locked-up stockholders will be able to sell our shares in the public market. Sales of a substantial number of such shares upon expiration, or early release, of the lock-up (or the perception that such sales may occur) could cause our share price to fall.
 
Sales of substantial amounts of our common stock in the public market following our initial public offering, or the perception that such sales could occur, could adversely affect the market price of our common stock and may make it more difficult for you to sell your common stock at a time and price that you deem appropriate.
 
We also may issue our shares of common stock from time to time as consideration for future acquisitions and investments. If any such acquisition or investment is significant, the number of shares that we may issue may in turn be significant. In addition, we may also grant registration rights covering those shares in connection with any such acquisitions and investments.
 
Investors purchasing common stock in this offering will experience immediate and substantial dilution.
 
The assumed initial public offering price of our common stock is substantially higher than the net tangible book value per outstanding share of our common stock immediately after this offering. As a result, you will pay a price per share that substantially exceeds the book value of our tangible assets after subtracting our liabilities. Purchasers of our common stock in this offering will incur immediate and substantial dilution of $9.12 per share in the net tangible book value of our common stock from the assumed initial public offering price of $13.00 per share, which is the mid-point of the estimated range set forth on the cover of this prospectus. If the underwriters exercise in


21


Table of Contents

full their option to purchase additional shares, there will be dilution of $8.82 per share in the net tangible book value of our common stock, assuming the same public offering price.
 
As a result of becoming a public company, we will be obligated to develop and maintain proper and effective internal controls over financial reporting and will be subject to other requirements that will be burdensome and costly. We may not complete our analysis of our internal controls over financial reporting in a timely manner, or these internal controls may not be determined to be effective, which may adversely affect investor confidence in our company and, as a result, the value of our common stock.
 
We will be required, pursuant to Section 404 of the Sarbanes-Oxley Act of 2002 (Section 404), to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting for the first fiscal year beginning after the effective date of this offering. This assessment will need to include disclosure of any material weaknesses identified by our management in our internal control over financial reporting, as well as a statement that our auditors have issued an attestation report on our management’s assessment of our internal controls.
 
We are just beginning the costly and challenging process of compiling the system and processing documentation before we perform the evaluation needed to comply with Section 404. We may not be able to complete our evaluation, testing and any required remediation in a timely fashion. During the evaluation and testing process, if we identify one or more material weaknesses in our internal control over financial reporting, we will be unable to assert that our internal control is effective. If we are unable to assert that our internal control over financial reporting is effective, or if our auditors are unable to attest that our management’s report is fairly stated or they are unable to express an opinion on the effectiveness of our internal control, we could lose investor confidence in the accuracy and completeness of our financial reports, which would have a material adverse effect on the price of our common stock. Failure to comply with the new rules might make it more difficult for us to obtain certain types of insurance, including director and officer liability insurance, and we might be forced to accept reduced policy limits and coverage and/or incur substantially higher costs to obtain the same or similar coverage. The impact of these events could also make it more difficult for us to attract and retain qualified persons to serve on our board of directors, on committees of our board of directors, or as executive officers.
 
In addition, as a public company, we will incur significant additional legal, accounting and other expenses that we did not incur as a private company, and our administrative staff will be required to perform additional tasks. For example, in anticipation of becoming a public company, we will need to create or revise the roles and duties of our board committees, adopt disclosure controls and procedures, retain a transfer agent, adopt an insider trading policy and bear all of the internal and external costs of preparing and distributing periodic public reports in compliance with our obligations under the securities laws. In addition, changing laws, regulations and standards relating to corporate governance and public disclosure, and related regulations implemented by the Securities and Exchange Commission and the Nasdaq Global Market, are creating uncertainty for public companies, increasing legal and financial compliance costs and making some activities more time consuming. These laws, regulations and standards are subject to varying interpretations, in many cases due to their lack of specificity, and, as a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies. We intend to invest resources to comply with evolving laws, regulations and standards, and this investment may result in increased general and administrative expenses and a diversion of management’s time and attention from revenue-generating activities to compliance activities. If our efforts to comply with new laws, regulations and standards differ from the activities intended by regulatory or governing bodies due to ambiguities related to practice, regulatory authorities may initiate legal proceedings against us and our business may be harmed.


22


Table of Contents

Anti-takeover provisions in our charter documents and under Delaware law could make an acquisition of us, which may be beneficial to our stockholders, more difficult and may prevent attempts by our stockholders to replace or remove our current management.
 
We intend to amend and restate our certificate of incorporation and bylaws, both of which will become effective upon the completion of this offering, to add provisions that may delay or prevent an acquisition of us or a change in our management. These provisions include a classified board of directors, a prohibition on actions by written consent of our stockholders, and the ability of our board of directors to issue preferred stock without stockholder approval. In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which prohibits stockholders owning in excess of 15% of our outstanding voting stock from merging or combining with us. Although we believe these provisions collectively provide for an opportunity to receive higher bids by requiring potential acquirors to negotiate with our board of directors, they would apply even if the offer may be considered beneficial by some stockholders. In addition, these provisions may frustrate or prevent attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our board of directors, which is responsible for appointing the members of our management.


23


Table of Contents

 
SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS
 
This prospectus contains both historical and forward-looking statements. All statements other than statements of historical fact are, or may be deemed to be, forward-looking statements. For example, statements concerning projections, predictions, expectations, estimates or forecasts and statements that describe our objectives, plans or goals are or may be forward-looking statements. These forward-looking statements reflect management’s current expectations concerning future results and events and generally can be identified by use of expressions such as “may,” “will,” “should,” “could,” “would,” “predict,” “potential,” “continue,” “expect,” “anticipate,” “future,” “intend,” “plan,” “foresee,” “believe,” “estimate,” and similar expressions, as well as statements in future tense. These forward-looking statements include, but are not limited to, the following:
 
  •  expected growth in the markets for network security products;
 
  •  our plans to continue to invest in and develop innovative technology and products for our existing markets and other network security markets;
 
  •  the timing of expected introductions of new or enhanced products;
 
  •  our expectation of growth in our customer base and increasing sales to existing customers;
 
  •  our plans to increase revenue through more relationships with original equipment manufacturers, resellers, distributors, government suppliers and co-marketers;
 
  •  our plans to grow international sales;
 
  •  our plans to acquire and integrate new businesses and technologies;
 
  •  our plans to hire more network security experts and broaden our knowledge base; and
 
  •  our plans to hire additional sales personnel and the additional revenue we expect them to generate.
 
The forward-looking statements included in this prospectus are made only as of the date of this prospectus. We expressly disclaim any intent or obligation to update any forward-looking statements to reflect subsequent events or circumstances.
 
Forward-looking statements involve known and unknown risks, uncertainties and other factors that may cause our actual results, performance or achievements to be different from any future results, performance and achievements expressed or implied by these statements. These risks and uncertainties include, but are not limited to, the following:
 
  •  the market for network security products is rapidly evolving and the complex technology incorporated in our products makes them difficult to develop, and if we do not accurately predict, prepare for and respond promptly to technological and market developments and changing customer needs, our competitive position and prospects will be harmed;
 
  •  defects, errors or vulnerabilities in our software products would harm our reputation and divert resources;
 
  •  in the future, we may not be able to secure financing necessary to operate and grow our business as planned;
 
  •  claims that our products infringe the proprietary rights of others could harm our business and cause us to incur significant costs;
 
  •  we face intense competition in our market, especially from larger, better-known companies, and we may lack sufficient financial or other resources to maintain or improve our competitive position;
 
  •  new competitors could emerge or our customers or distributors could internally develop alternatives to our products and either development could impair our sales;
 
  •  if our new products and product enhancements do not achieve sufficient market acceptance, our results of operations and competitive position will suffer;
 
  •  if existing customers do not make subsequent purchases from us or if our relationships with our largest customers are impaired, our revenue could decline;


24


Table of Contents

 
  •  if we cannot attract sufficient government agency customers, our revenue and competitive position will suffer;
 
  •  if we do not continue to establish and effectively manage our OEM relationships, our revenue could decline;
 
  •  we are subject to risks of operating internationally that could impair our ability to grow our revenue abroad;
 
  •  our inability to acquire and integrate other businesses, products or technologies could seriously harm our competitive position;
 
  •  our inability to hire and retain key personnel would slow our growth; and
 
  •  our inability to effectively manage our headcount growth and expansion could seriously harm our ability to effectively run our business.
 
 
We operate in an industry in which it is difficult to obtain precise industry and market information. Although we have obtained some industry data from outside sources that we believe to be reliable, in certain cases we have based certain statements contained in this prospectus regarding our industry and our position in the industry on our estimates concerning, among other things, our customers and competitors. These estimates are based on our experience in the industry, conversations with our principal suppliers and customers and our own investigations of market conditions. The statistical data contained in this prospectus regarding the network security software industry are our statements, which are based on data we obtained from industry sources.
 
 
SOURCEFIRE®, SNORT®, the Sourcefire logo, the Snort and Pig logo, SECURITY FOR THE REAL WORLDtm, SOURCEFIRE DEFENSE CENTERtm, SOURCEFIRE 3Dtm, RNAtm and certain other trademarks and logos are trademarks or registered trademarks of Sourcefire, Inc. in the United States and other countries. This prospectus also refers to the products or services of other companies by the trademarks and trade names used and owned by those companies.


25


Table of Contents

 
USE OF PROCEEDS
 
Assuming an initial public offering price of $13.00 per share, we estimate that we will receive net proceeds from this offering of approximately $61.9 million, after deducting underwriting discounts and commissions and other estimated expenses of $2.5 million payable by us. If the underwriters’ option to purchase additional shares in this offering is exercised in full we estimate that our net proceeds will be approximately $72.3 million. We will not receive any proceeds from the sale of shares of our common stock by the selling stockholders, one of which is our Chief Executive Officer. See “Principal and Selling Stockholders” for more information.
 
We intend to use the net proceeds to us from this offering for working capital and other general corporate purposes, including financing our growth, developing new products and funding capital expenditures. We may seek to finance our growth by, for example, expanding our direct sales force in international markets and by hiring additional personnel beyond our current plans to bring products to market sooner. Some possible capital expenditures include, without limitation, (i) procuring and installing an enterprise resource planning system, (ii) purchasing additional development and testing equipment for our security lab and (iii) acquiring additional security-related technology for further development. In addition, we may choose to repay the equipment line portion of our credit facility with Silicon Valley Bank or expand our current business through acquisitions of other businesses, products or technologies. However, we do not have agreements or commitments for any specific repayments nor do we have any plans, proposals or arrangements with respect to any specific acquisitions at this time. As of December 31, 2006, the outstanding balance under the equipment line portion of our Silicon Valley Bank credit facility was $1,312,000, bearing interest at annual rates from 6.5%, fixed, to 8.75%, variable based on prime plus 0.5% at December 31, 2006, and maturing between February 2007 and December 2009. The outstanding balance, if any, under the working capital portion of the credit facility must be repaid on March 28, 2007. The proceeds of the equipment line portion of the credit facility were used for furniture, leasehold improvements, personal computers and equipment for our network security lab.
 
Pending any use, as described above, we plan to invest the net proceeds in short-term, interest-bearing investment grade securities.
 
A $1.00 increase (decrease) in the assumed initial public offering price of $13.00 per share would increase (decrease) the net proceeds to us from this offering by $4.9 million, assuming the number of shares offered by us, as set forth on the cover page of this prospectus, remains the same and after deducting the estimated underwriting discounts and commissions and estimated expenses payable by us.
 
DIVIDEND POLICY
 
We intend to retain all future earnings, if any, for use in the operation of our business and to fund future growth. We have never declared or paid any dividend on our capital stock and do not anticipate paying any dividends for the foreseeable future and the loan and security agreement governing our working capital line of credit restricts our ability to pay dividends or other distributions on our capital stock. The decision whether to pay dividends will be made by our board of directors in light of conditions then existing, including factors such as our results of operations, financial condition and requirements, business conditions and covenants under any applicable contractual arrangements.


26


Table of Contents

 
CAPITALIZATION
 
The following table sets forth our cash and cash equivalents and our capitalization (including long-term debt) as of December 31, 2006:
 
  •  on an actual basis;
 
  •  on a pro forma basis, giving effect to the conversion of all of the outstanding shares of our preferred stock into 14,302,128 shares of our common stock immediately prior to the completion of this offering pursuant to a written consent executed by the holders of the requisite number of shares of each class of our preferred stock to voluntarily convert their shares of our preferred stock into shares of our common stock; and
 
  •  on a pro forma as adjusted basis, giving effect to the conversion of all of the outstanding shares of our preferred stock into 14,302,128 shares of our common stock immediately prior to the completion of this offering and our sale of 5,320,000 shares of common stock in this offering, assuming an initial public offering price of $13.00, the midpoint of the estimated price range set forth on the cover of this prospectus, after deducting the estimated underwriting discounts and commissions and estimated offering expenses payable by us.
 
The numbers of shares of common stock shown as issued and outstanding exclude:
 
  •  3,199,093 shares that may be issued upon the exercise of options outstanding as of December 31, 2006;
 
  •  36,944 shares that may be issued upon the exercise of warrants outstanding as of December 31, 2006;
 
  •  181,934 shares that are reserved for issuance pursuant to our stock option plan as of December 31, 2006; and
 
  •  27,709 shares that are subject to repurchase by us.
 
You should read this table in conjunction with the consolidated financial statements and the related notes, “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” and “Description of Capital Stock” included elsewhere in this prospectus.


27


Table of Contents

                         
    As of December 31, 2006  
                Pro forma
 
    Actual     Pro forma     As Adjusted  
    (unaudited)
 
    (dollars in thousands)  
 
Cash and cash equivalents
  $ 13,029     $ 13,029     $ 74,898  
                         
Long-term debt, including current portion
  $ 1,312     $ 1,312     $ 1,312  
                         
Series A Convertible Preferred Stock, par value $.001 per share: 2,495,410 shares authorized, 2,475,410 shares issued and outstanding, actual; no shares authorized, no shares issued and outstanding, pro forma and pro forma as adjusted
    10,308              
Series B Convertible Preferred Stock, par value $.001 per share: 7,132,205 shares authorized, 7,132,205 shares issued and outstanding, actual; no shares authorized, no shares issued and outstanding, pro forma and pro forma as adjusted
    14,265              
Series C Convertible Preferred Stock, par value $.001 per share: 5,404,043 shares authorized, 5,404,043 shares issued and outstanding, actual; no shares authorized, no shares issued and outstanding, pro forma and pro forma as adjusted
    18,270              
Series D Convertible Preferred Stock, par value $.001 per share: 3,264,449 shares authorized, 3,264,449 shares issued and outstanding, actual; no shares authorized, no shares issued and outstanding, pro forma and pro forma as adjusted
    23,879              
Warrants to purchase Series A Convertible Preferred Stock
    25              
                         
Total convertible preferred stock and warrants
    66,747       —           —    
                         
Stockholders’ equity (deficit):
                       
Common Stock, par value $.001 per share: 36,500,000 authorized, 3,491,764 issued and outstanding, actual; 36,500,000 shares authorized, 17,793,892 shares issued and outstanding, pro forma; 240,000,000 shares authorized, 23,113,892 shares issued and outstanding, pro forma as adjusted
    3       18       23  
Preferred Stock, par value $.001 per share: no shares authorized, no shares issued and outstanding, actual and pro forma; 20,000,000 shares authorized, no shares issued and outstanding, pro forma as adjusted
                 
Unearned compensation
                   
Additional paid-in capital
          66,732       128,596  
Accumulated deficit
    (38,902 )     (38,902 )     (38,902 )
                         
Total stockholders’ equity (deficit)
    (38,899 )     27,848       89,717  
                         
Total capitalization (including long-term debt)
  $ 29,160     $ 29,160     $ 91,029  
                         


28


Table of Contents

 
DILUTION
 
Dilution is the amount by which the offering price paid by the purchasers of the common stock sold in the offering exceeds the net tangible book value per share of common stock after the offering. Net tangible book value per share is determined at any date by subtracting our total liabilities from the total book value of our tangible assets and dividing the difference by the number of shares of common stock deemed to be outstanding at that date.
 
Our pro forma net tangible book value as of December 31, 2006 was $27.8 million, or $1.57 per share, which gives effect to the conversion of all outstanding shares of our preferred stock into 14,302,128 shares of our common stock immediately prior to the completion of this offering. After giving effect to the receipt and our intended use of approximately $61.9 million of estimated net proceeds from our sale of 5,320,000 shares of common stock in this offering at an assumed offering price of $13.00 per share, our pro forma as adjusted net tangible book value as of December 31, 2006 would have been approximately $89.7 million, or $3.88 per share. This represents an immediate increase in pro forma net tangible book value of $2.31 per share to existing stockholders and an immediate dilution of $9.12 per share to new investors purchasing shares of common stock in the offering. The following table illustrates this substantial and immediate per share dilution to new investors:
 
                 
Assumed initial public offering price per share
          $ 13.00  
Pro forma net tangible book value per share before this offering
  $ 1.57          
Increase per share attributable to investors in this offering
    2.31          
                 
As adjusted pro forma net tangible book value per share after this offering
            3.88  
                 
Dilution per share to new investors
          $ 9.12  
                 
 
A $1.00 increase (decrease) in the assumed initial public offering price of $13.00 per share, which is the midpoint of the range listed on the cover page of this prospectus, would increase (decrease) the as adjusted pro forma net tangible book value per share after this offering by $0.22 and the dilution per share to new investors in this offering by $0.22, assuming the number of shares offered by us, as set forth on the cover page of this prospectus, remains the same and after deducting underwriting discounts and commissions and estimated offering expenses payable by us.
 
The following table summarizes on an as adjusted pro forma basis as of December 31, 2006.
 
  •  the total number of shares of common stock purchased from us by our existing stockholders and by new investors purchasing shares in this offering;
 
  •  the total consideration paid to us by our existing stockholders and by new investors purchasing shares in this offering, assuming an initial public offering price of $13.00 per share (before deducting the estimated underwriting discounts and commissions and estimated offering expenses payable by us in connection with this offering); and
 
  •  the average price per share paid by existing stockholders and by new investors purchasing shares in this offering:
 
                                         
    Shares purchased     Total consideration     Average price
 
    Number     Percent     Amount     Percent     per share  
 
Existing stockholders
    17,793,892       77 %   $ 56,878,184       45 %   $ 3.20  
Investors in the offering
    5,320,000       23       69,160,000       55       13.00  
                                         
Total
    23,113,892       100 %   $ 126,038,184       100 %        
                                         
 
The tables and calculations above assume no exercise of:
 
  •  stock options outstanding as of December 31, 2006 to purchase 3,199,903 shares of common stock at a weighted average exercise price of $2.95 per share; or
 
  •  the underwriters’ over-allotment option.
 
To the extent any of these options are exercised, there will be further dilution to new investors.


29


Table of Contents

 
SELECTED CONSOLIDATED FINANCIAL DATA
 
The consolidated statement of operations data for the five years ended December 31, 2006 and the consolidated balance sheet data as of December 31, 2002, 2003, 2004, 2005 and 2006 have been derived from our audited consolidated financial statements. The selected consolidated financial data set forth below should be read in conjunction with “Management’s Discussion and Analysis of Financial Condition and Results of Operations” set forth below and our consolidated financial statements and related notes included elsewhere in this prospectus. The historical results are not necessarily indicative of the results to be expected in any future period.
 
                                         
    Year ended December 31,  
    2002     2003     2004     2005     2006  
    (in thousands, except share, per share and other operating data)  
 
Consolidated statement of operations data:
                                       
Revenue:
                                       
Products
  $ 1,704     $ 8,153     $ 12,738     $ 23,589     $ 30,219  
Services
    197       1,328       3,955       9,290       14,707  
                                         
Total revenue
    1,901       9,481       16,693       32,879       44,926  
Cost of revenue:
                                       
Products
    448       2,570       4,533       6,610       8,440  
Services
    155       436       872       1,453       2,632  
                                         
Total cost of revenue
    603       3,006       5,405       8,063       11,072  
Gross profit
    1,298       6,475       11,288       24,816       33,854  
Operating expenses
Research and development
    1,261       3,751       5,706       6,831       8,612  
Sales and marketing
    3,179       9,002       12,585       17,135       20,652  
General and administrative
    1,234       2,141       2,905       5,120       5,017  
Depreciation and amortization
    153       441       752       1,103       1,230  
                                         
Total operating expenses
    5,827       15,335       21,948       30,189       35,511  
                                         
Operating loss
    (4,529 )     (8,860 )     (10,660 )     (5,373 )     (1,657 )
Other income (expense), net
    22       16       164       (85 )     792  
                                         
Loss before income taxes
    (4,507 )     (8,844 )     (10,496 )     (5,458 )     (865 )
Income tax expense
                            (67 )
                                         
Net loss
    (4,507 )     (8,844 )     (10,496 )     (5,458 )     (932 )
Accretion of preferred stock
    (356 )     (1,262 )     (2,451 )     (2,668 )     (3,819 )
                                         
Net loss attributable to common stockholders
  $ (4,863 )   $ (10,106 )   $ (12,947 )   $ (8,126 )   $ (4,751 )
                                         
Net loss per common share:
                                       
Basic and diluted
  $ (2.61 )   $ (4.69 )   $ (4.97 )   $ (2.54 )   $ (1.40 )
                                         
Pro forma (unaudited)(1)
                                  $ (0.06 )
                                         
Shares used in per common share calculations:
                                       
Basic and diluted
    1,865,663       2,156,725       2,602,743       3,200,318       3,389,527  
Pro forma (unaudited)(1)
                                    16,885,981  
                                         
Other operating data:
                                       
Number of sales in excess of $500,000
    1       2       5       9       14  
Number of new 3D customers
            161       136       149       273  
Cumulative number of Fortune 100 3D customers at end of period
    3       10       17       24       26  
Number of full-time employees at end of period
    46       84       107       135       182  
 
(footnotes on following page)
 


30


Table of Contents

                                                 
    As of December 31,    
    2002   2003   2004   2005   2006    
Consolidated balance sheet data:
                                               
Cash and cash equivalents
  $ 2,991     $ 5,315     $ 3,563     $ 1,106     $ 13,029          
Held-to-maturity investments
                5,751       2,005       13,293          
Total assets
    4,928       10,316       20,016       21,250       49,952          
Long-term debt
    580       345       461       990       1,312          
Total liabilities
    2,031       5,166       10,177       16,340       22,104          
Total convertible preferred stock
    7,716       19,958       37,339       40,007       66,747          
Total stockholders’ equity (deficit)
    (4,819 )     (14,808 )     (27,500 )     (35,097 )     (38,899 )        
Dividends declared per share
                                     
 
(1) On a pro forma basis, giving effect to the conversion of all of the outstanding shares of our preferred stock into shares of our common stock immediately prior to the completion of this offering.

31


Table of Contents

 
MANAGEMENT’S DISCUSSION AND ANALYSIS OF
FINANCIAL CONDITION AND RESULTS OF OPERATIONS
 
The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our consolidated financial statements and related notes that appear elsewhere in this prospectus. In addition to historical consolidated financial information, the following discussion contains forward-looking statements that reflect our plans, estimates and beliefs. Our actual results could differ materially from those discussed in the forward-looking statements. Factors that could cause or contribute to these differences include those discussed below and elsewhere in this prospectus, particularly in “Risk Factors.”
 
Overview
 
Sourcefire is a leading provider of intelligence driven, open source network security solutions that enable our customers to protect their computer networks in an effective, efficient and highly automated manner. We apply a comprehensive Discover, Determine and Defend, or 3D, approach to network security through which we: 1) discover potential threats and vulnerabilities, 2) determine the potential impact of those observations to the network and 3) defend the network through aggressive enforcement of security policies. We sell our security solutions to a diverse customer base that includes over 25 of the Fortune 100 companies and over half of the 30 largest U.S. government agencies. We also manage one of the security industry’s leading open source initiatives, Snort.
 
Our Sourcefire 3D approach is comprised of three key components:
 
RNA.  At the heart of the Sourcefire 3D security solution is Real-time Network Awareness, or RNA, our network intelligence product that provides persistent visibility into the composition, behavior, topology (the relationship of network components) and risk profile of the network. This information provides a platform for the Defense Center’s automated decision-making and network policy compliance enforcement. The ability to continuously discover characteristics and vulnerabilities of any computing device communicating on a network such as a computer, printer or server, or endpoint intelligence, enables our Intrusion Prevention products to more precisely identify and block threatening traffic and to more efficiently classify threatening and/or suspicious behavior than products lacking network intelligence.
 
Intrusion Sensors.  The Intrusion Sensors utilize open source Snort® and our proprietary technology to monitor network traffic. These sensors compare observed traffic to a set of “Rules”, or a set of network traffic characteristics, which can be indicative of malicious activity. Once the Intrusion Sensors match a Rule to the observed traffic, they block malicious traffic and/or send an alert to the Defense Center for further analysis, prioritization and possible action.
 
Defense Center.  The Defense Center aggregates, correlates and prioritizes network security events from RNA Sensors and Intrusion Sensors to synthesize multipoint event correlation and policy compliance analysis. The Defense Center’s policy and response subsystems are designed to leverage existing IT infrastructure such as firewalls, routers, trouble ticketing, and patch management systems for virtually any task, including alerting, blocking and initiating corrective measures.
 
Historical Development of our Business
 
We were organized as a Delaware corporation and began operations in January 2001, and we sold our first commercial product, a Sourcefire Intrusion Sensor, in the summer of 2001. In 2002, we released the first version of the Defense Center product, closed our first round of institutional financing, raising approximately $7.5 million from the sale of Series A convertible preferred stock, and hired senior executives including our CEO, COO, VP of Sales and VP of Business Development. In 2003, we closed our second round of institutional financing, raising $11 million from the sale of Series B convertible preferred stock, released our RNA product and hired our CFO and VP of Engineering. In 2004, we completed our third round of institutional financing, raising $15 million from the sale of Series C convertible preferred stock, exceeded 100 total employees, hired our chief marketing officer and introduced the Sourcefire 3D suite of products. In 2005, we leased approximately 40,000 square feet of office space


32


Table of Contents

for our corporate headquarters including a 4,000 square foot state-of-the-art security lab, received NSS gold certification for our intrusion detection product and released our enterprise class intrusion sensor product.
 
In October 2005 we entered into a definitive merger agreement to be acquired by Check Point Software Technologies Ltd., an Israeli company, for $225.0 million. As a result of the merger announcement and during the period following the announcement, our U.S. government business was curtailed as certain government agencies apparently became unwilling to buy products from a company being acquired by a foreign entity and instead purchased and installed products sold by our competitors. In April 2006, the proposed acquisition was mutually terminated in response to objections from the Committee on Foreign Investment in the United States. Our business, including our business with the U.S. government, continued to grow following the termination. We believe that, other than the curtailment of government business described above, the announcement, pendency and termination of the merger have not had a material adverse effect on our business or plans for this offering.
 
In 2006, we closed our fourth round of institutional financing, raising $23 million from the sale of Series D convertible preferred stock, and achieved our first quarter of cash flow positive results.
 
Key Financial Metrics and Trends
 
Pricing and Discounts
 
We maintain a standard price list for all our products and we have not changed our list pricing during the past. Additionally, we have a corporate policy that governs the level of discounting our sales organization may offer on our products based on factors such as transaction size, volume of products, federal or state programs, reseller or distributor involvement and the level of technical support commitment. Our total product revenue and the resulting cost of revenue and gross profit percentage are directly affected by our ability to manage our product pricing policy. Although we have not experienced pressure to reduce our prices, competition is increasing and, in the future, we may be forced to reduce our prices to remain competitive.
 
Revenue
 
We currently derive revenue from product sales and services. Product revenue is principally derived from the sale of our network security solutions. Our network security solutions include a perpetual software license bundled with a third-party hardware platform. Services revenue is principally derived from technical support and professional services. We typically sell technical support to complement our network security solutions. Technical support entitles a customer to product updates, new Rules releases and both telephone and web assistance for using our products. Our professional services revenue includes optional on-site network security deployment consulting, and classroom and online training for managing a network security solution.
 
Product sales are typically recognized as revenue at shipment of the product to the customer, whether sold directly or through resellers. For sales made through distributors and original equipment manufacturers, or OEMs, we do not recognize revenue until we receive the monthly sales report which indicates the sell-through volume to end user customers. Revenue from services is recognized when the services are performed. For technical support services, revenue is recognized ratably over the term of the support arrangement, which is usually a 12-month agreement providing for payment in advance and automatic renewals.
 
We sell our network security solutions globally. However, over 80% of our revenue for 2006 was generated by sales to U.S.-based customers. We expect that our revenue from customers based outside of the United States will increase in amount and as a percentage of total revenue as we execute our strategy to strengthen our international presence. We also expect that our revenue from sales through OEMs and distributors will increase in amount and as a percentage of total revenue as we execute our strategy to expand such relationships. We manage our operations on a consolidated basis for purposes of assessing performance and making operating decisions. Accordingly, our business does not have reportable segments.
 
Revenue from product sales has been highly seasonal, with more than one-third of our total product revenue in recent fiscal years generated in the fourth quarter. The timing of our year-end shipments could materially affect our fourth quarter product revenue in any fiscal year and sequential quarterly comparisons. Revenue from our government customers has occasionally been influenced by the September 30th fiscal year-end of the U.S. federal


33


Table of Contents

government, which has historically resulted in our revenue from government customers being highest in the third quarter. Although we do not expect these general seasonal patterns to change substantially in the future, our revenue within a particular quarter is often affected significantly by the unpredictable procurement patterns of our customers. Our prospective customers usually spend a long time evaluating and making purchase decisions for network security solutions. Historically, many of our customers have not finalized their purchasing decisions until the final weeks or days of a quarter. We expect these purchasing patterns to continue in the future. Therefore, a delay in even one large order beyond the end of the quarter could materially reduce our anticipated revenue for a quarter. Because many of our expenses must be incurred before we expect to generate revenue, delayed orders could negatively impact our results of operations for the period and cause us to fail to meet the financial performance expectations of securities industry research analysts or investors.
 
On April 20, 2006, we received a complaint filed by PredatorWatch, Inc. in Suffolk County, Massachusetts, alleging, among other things, that we misappropriated and incorporated the plaintiff’s trade secrets and confidential information into our RNA technology. The plaintiff has sought to recover amounts to be ascertained and established, as well as double and treble damages and attorneys’ fees. While this litigation is at an early stage and we cannot reliably estimate the amount, if any, that the Plaintiff could recover, the potential range of remedies available to the Plaintiff, if successful, could include royalties on past and future sales of RNA and/or a permanent injunction prohibiting us from selling any products containing RNA technology.
 
Cost of Revenue
 
Cost of product revenue includes the cost of the hardware platform bundled into our network security solution, royalties for third-party software included in our network security solution, materials and labor that go into the quality assurance of our products, logistics, warranty, shipping and handling costs and, in the limited instance where we lease our network security solutions to our customers, depreciation and amortization. For both the year ended December 31, 2006 and the year ended December 31, 2005, cost of product revenue was 28% of total product revenue. Hardware costs, which are our most significant cost items, generally have not fluctuated materially as a percentage of revenue in recent years because competition among hardware platform suppliers has remained strong and, therefore, our hardware cost has remained consistent. Because of the competition among hardware suppliers and our outsourcing of the manufacture of our products to four separate domestic contract manufacturers, we currently have no reason to expect that our cost of product revenue as a percentage of total product revenue will change significantly in the foreseeable future due to hardware pricing increases. However, hardware or other costs of manufacturing may increase in the future. We incur labor and associated overhead expenses, such as occupancy costs and fringe benefits costs, as part of managing the manufacturing process. These costs are included as a component of our cost of product revenue, but they have not been material.
 
Cost of service revenue includes the direct labor costs of professionals and outside consultants engaged to furnish those services, as well as their travel and associated direct material costs. Additionally, we include in cost of service revenue an allocation of overhead expenses such as occupancy costs, fringe benefits and supplies. For the years ended December 31, 2006 and 2005, cost of service revenue was 18% and 16% of total service revenue, respectively, and, although we anticipate incurring additional costs in the future for increased personnel to support and service our growing customer base, we do not expect the cost of service revenue as a percentage of service revenue to change materially in the future.
 
Gross Profit
 
Our gross profit is affected by a variety of factors, including competition, the mix and average selling prices of our products, our pricing policy, technical support and professional services, new product introductions, the cost of hardware platforms, the cost of labor to generate such revenue and the mix of distribution channels through which our products are sold. Although we have not had to reduce the prices of our products or vary our pricing policy in recent years, our gross profit would be adversely affected by price declines if we are unable to reduce costs on existing products and to continue to introduce new products with higher margins. Currently, product sales typically have a lower gross profit as a percentage of revenue than our services due to the cost of the hardware platform. Our gross profit for any particular quarter could be adversely affected if we do not complete sales of higher margin products by the end of the quarter. As discussed above, many of our customers do not finalize purchasing decisions


34


Table of Contents

until the final weeks or days of a quarter, so a delay in even one large order of a higher-margin product could reduce our total gross profit percentage for that quarter. For both the year ended December 31, 2006 and the year ended December 31, 2005, gross profit was 75% of total revenue. Based on current market conditions, we do not expect these percentages to change significantly in the foreseeable future, although unexpected pricing pressures or an increase in hardware or other costs would cause our gross profit percentage to decline.
 
Operating Expenses
 
Research and Development.  Research and development expenses consist primarily of payroll, benefits and related costs for our engineers, occupancy costs and other overhead, costs for sophisticated components used in product and prototype development and costs of test equipment used during product development.
 
We have significantly expanded our research and development capabilities and expect to continue to expand these capabilities in the future. All of our research and development is performed in the United States. We are committed to increasing the level of innovative design and development of new products as we strive to enhance our ability to serve our existing commercial and federal government markets as well as new markets for security solutions. To meet the changing requirements of our customers, we will need to fund investments in several development projects in parallel. Accordingly, we anticipate that our research and development expenses will continue to increase in absolute dollars for the foreseeable future, but should decline moderately as a percentage of total revenue as we expect to grow our sales more rapidly than our research and development expenditures. For the years ended December 31, 2006 and 2005, research and development expense was $8.6 million and $6.8 million, or 19% and 21% of total revenue, respectively.
 
Sales and Marketing.  Sales and marketing expenses consist primarily of salaries, incentive compensation, benefits and related costs for: sales and marketing personnel; trade show, advertising, marketing and other brand-building costs; marketing consultants and other professional services; training, seminars and conferences; travel and related costs; and occupancy and other overhead costs.
 
As we focus on increasing our market penetration, expanding internationally and continuing to build brand awareness, we anticipate that selling and marketing expenses will continue to increase in absolute dollars, but decrease as a percentage of our revenue, in the future.
 
For the years ended December 31, 2006 and 2005, sales and marketing expense was $20.7 million and $17.1 million, or 46% and 52% of total revenue, respectively.
 
General and Administrative.  General and administrative expenses consist primarily of: salaries, incentive compensation, benefits and related costs for executive, finance, information system and administrative personnel; legal, accounting and tax preparation and advisory fees; travel and related costs; information systems and infrastructure costs; and occupancy and other overhead costs.
 
We expect our general and administrative expenses to increase due to our preparations to become and to operate as a public company, including costs associated with compliance with Section 404 of the Sarbanes-Oxley Act, directors’ and officers’ liability insurance, increased professional services and a new investor relations function.
 
For the years ended December 31, 2006 and 2005, general and administrative expense was $5.1 million and $5.0 million or 11% and 16% of total revenue, respectively.
 
Stock-Based Compensation.  Prior to January 1, 2006, our stock-based compensation expense consisted primarily of the amortization of unearned compensation related to grants of restricted shares of our common stock to certain officers and employees in 2002 and 2003, as well as the modification of certain fixed stock option awards subsequent to their grant date. Total stock-based compensation expenses recorded in our statements of operations for 2003, 2004 and 2005 were $72,000, $177,000 and $470,000, respectively.
 
Effective January 1, 2006, the Company adopted the fair value recognition provisions of the Financial Accounting Standards Board’s SFAS No. 123(R), “Share-Based Payment,” using the prospective transition method, which requires the Company to apply its provisions only to awards granted, modified, repurchased or cancelled


35


Table of Contents

after the effective date. Under this transition method, stock-based compensation expense recognized beginning January 1, 2006 is based on the grant date fair value of stock awards granted or modified after January 1, 2006.
 
As a result of adopting SFAS No. 123(R) on January 1, 2006, based on the estimated grant-date fair value of employee stock options subsequently granted or modified, the Company recognized aggregate stock-based compensation expense of $703,000 for the year ended December 31, 2006. The Company uses the Black-Scholes option pricing model to estimate the calculated value of granted stock options. The use of option valuation models requires the input of highly subjective assumptions, including the expected term and the expected stock price volatility.
 
The grant date fair value of options not yet recognized as expense as of December 31, 2006 aggregated approximately $3.4 million, net of estimated forfeitures, which will be recognized over a weighted-average period of approximately four years. We expect to record aggregate amortization of stock-based compensation of approximately $1,251,000, $1,026,000, $791,000 and $321,000 during fiscal years 2007, 2008, 2009 and 2010, respectively, from these outstanding awards, subject to continued vesting.
 
Critical Accounting Policies and Estimates
 
Our consolidated financial statements are prepared in accordance with accounting principles generally accepted in the United States of America. The preparation of these consolidated financial statements requires us to make estimates and assumptions that affect the reported amounts of assets, liabilities, revenue, costs and expenses and related disclosures. We evaluate our estimates and assumptions on an ongoing basis. Our actual results may differ from these estimates.
 
We believe that, of our significant accounting policies, which are described in Note 2 to the notes to our consolidated financial statements, the following accounting policies involve a greater degree of judgment and complexity. Accordingly, we believe that the following accounting policies are the most critical to aid in fully understanding and evaluating our consolidated financial condition and results of operations.
 
Revenue Recognition.  We recognize substantially all of our revenue in accordance with Statement of Position No. 97-2, “Software Revenue Recognition,” or SOP 97-2, as amended by SOP 98-4 and SOP 98-9. We establish persuasive evidence of an arrangement for each type of revenue transaction based on:
 
  •  in the case of direct sales or indirect sales through some resellers or distributors, either a signed contract with the end user customer or a click-wrap contract embedded in the product, whereby the end user customer agrees to our standard terms and conditions,
 
  •  in the case of indirect sales through OEMs or some resellers or distributors, a signed distribution contract with OEMs and other resellers; or
 
  •  in the case of services, including support, training and other professional services, through the execution of a separate services arrangement.
 
For each arrangement, we defer revenue recognition until all of the following criteria have been met:
 
  •  persuasive evidence of an arrangement exists (e.g., a signed contract);
 
  •  delivery of the product has occurred and there are no remaining obligations or substantive customer acceptance provisions;
 
  •  the fee is fixed or determinable; and
 
  •  collection of the fee is probable.
 
We allocate the total value of the arrangement among each deliverable based on its fair value as determined by vendor-specific objective evidence, such as standard product discount levels, daily service rates and consistent support level renewal pricing. If vendor-specific objective evidence of fair value does not exist for each of the deliverables, all revenue from the arrangement is further deferred until the earlier of the point at which sufficient vendor-specific objective evidence of fair value can be determined or all elements of the arrangement have been delivered. However, if the only undelivered elements are technical support and/or professional services, elements


36


Table of Contents

for which we currently have established vendor specific objective evidence of fair value, we recognize revenue for the delivered elements using the residual method. Changes in judgments and estimates about these assumptions could materially impact the timing of revenue recognition.
 
Accounting for Stock-Based Compensation.  Prior to January 1, 2006, we accounted for stock-based compensation using the intrinsic value method prescribed in Accounting Principles Board Opinion No. 25, “Accounting for Stock Issued to Employees,” or APB No. 25, and related interpretations. Accordingly, compensation cost for stock options generally was measured as the excess, if any, of the estimated fair value of our common stock over the amount an employee must pay to acquire the common stock on the date that both the exercise price and the number of shares to be acquired pursuant to the option are fixed. We had adopted the disclosure-only provisions of SFAS No. 123, “Accounting for Stock-Based Compensation,” and SFAS No. 148, “Accounting for Stock-Based Compensation — Transition and Disclosure,” which was released in December 2002 as an amendment to SFAS No. 123, and used the minimum value method of valuing stock options as allowed for non-public companies.
 
In December 2004, the Financial Accounting Standards Board issued SFAS No. 123(R), “Share-Based Payment,” which revised SFAS No. 123 and superseded APB No. 25. SFAS 123(R) focuses primarily on transactions in which an entity obtains employee services in exchange for share-based payments. Under SFAS 123(R), an entity is generally required to measure the cost of employee services received in exchange for an award of equity instruments based on the grant date fair value of the award, with such cost recognized over the applicable requisite service period. In addition, SFAS 123(R) requires an entity to provide certain disclosures in order to assist in understanding the nature of share-based payment transactions and the effects of those transactions on the financial statements. The provisions of SFAS No. 123(R) are required to be applied as of the beginning of the first interim or annual reporting period of the entity’s first fiscal year that begins after December 15, 2005.
 
Effective January 1, 2006, we adopted the fair value recognition provisions of SFAS No. 123(R) using the prospective transition method, which requires the Company to apply the provisions of SFAS No. 123(R) only to awards granted, modified, repurchased or cancelled after the effective date. Under this transition method, stock-based compensation expense recognized beginning January 1, 2006 is based on the grant date fair value of stock awards granted or modified after January 1, 2006. As the Company had used the minimum value method for valuing its stock options under the disclosure requirements of SFAS 123, all options granted prior to January 1, 2006 continue to be accounted for under APB No. 25.
 
In determining the grant date fair value of share-based payments, we conducted contemporaneous valuations relying on the guidance prescribed by the American Institute of Certified Public Accountants in its practice aid, “Valuation of Privately-Held-Company Equity Securities Issued as Compensation,” or the Practice Aid. In each instance where we made such a valuation determination, and as more fully described below, we generally first determined a fair value of the enterprise using one or both of the market approach or the income approach. Once we determined an estimated fair value of the enterprise, we then allocated that enterprise value to each of our classes of stock based upon a consideration of those classes’ relative economic and control rights, using a methodology consistent with the Practice Aid, as discussed in further detail below.
 
We did not obtain contemporaneous valuations by an unrelated valuation specialist that we could rely on during the periods outlined below. Instead, we relied on the experience of our management team and our board of directors, which includes several venture capitalists who have considerable experience in the valuation of emerging companies and one member with extensive experience as a chief financial officer of a publicly traded company who joined our board in August 2006.
 
For the Period August 2005 through September 2005.  We did not grant any share-based payments during the period from August 2005 through September 2005. The primary reason for not granting any share-based compensation during this period was because we believed that the fair value of our enterprise was not easily determinable due to our ongoing merger discussions with Check Point Software Technologies Ltd., or Check Point.
 
October 2005.  On October 5, 2005 our ongoing discussions with Check Point resulted in the signing of a definitive merger agreement to be acquired for approximately $225.0 million in cash. Later that month, we granted an option to purchase 6,157 shares of our common stock at an exercise price of $8.36 per share to one employee. In connection with that grant, we determined that the fair value of our common stock was also $8.36 per share and


37


Table of Contents

therefore, in accordance with APB No. 25, did not record any compensation expense since the award had no intrinsic value on the measurement date. In concluding that $8.36 was the fair value of our common stock, we followed the methodology outlined above by first determining our enterprise value and then allocating that value to each of our classes of stock. We calculated an enterprise value of $225.0 million using the market approach. We concluded that the market approach was the most appropriate methodology at this time since it relied on data generated by an actual market transaction. Immediately prior to this grant, we executed a merger agreement with Check Point, which proposed a definitive arm’s length transaction between willing parties. We arrived at the $225.0 million enterprise value using the aggregate consideration that Check Point had agreed to pay for us. In addition to doing the foregoing analysis, we also reviewed market data provided by our investment advisors for comparable acquisition transactions that had occurred in the previous several months to ascertain the fairness of the Check Point offer.
 
In allocating the $225.0 million enterprise value to each of our classes of stock, we used the current-value method since we believed at the time of the valuation that a liquidity event in the form of an acquisition was imminent. Using the current-value method, we first allocated the proceeds to each of our series of preferred stock based upon their respective liquidation preferences and dividend rights. Specifically, we allocated approximately $56.8 million in the aggregate to our preferred stock, representing the liquidation preferences plus all accrued but unpaid dividends. In accordance with our Charter, we then allocated the remaining $168.2 million to all equity securities assuming conversion of all securities into shares of common stock. This resulted in a value of approximately $8.85 per share of common stock. We then applied a discount of approximately five percent to reflect the risk that the proposed merger with Check Point would not be consummated, and we arrived at fair value per common share of $8.36. We used a five percent discount based upon advice received from our financial advisors that such a discount was typical at similar stages of similar transactions, as well as based on our own opinions formed in negotiating the merger agreement with Check Point.
 
For the Period November 2005 to March 2006.  In January 2006 we granted options to purchase a total of 171,489 shares of our common stock to our employees at an exercise price of $8.36 per share. In accordance with SFAS 123(R), we measured share-based compensation expense with respect to these grants using the Black-Scholes option pricing model using a per share fair value of our common stock of $8.36 per share. In concluding that $8.36 was the fair value of our common stock, we followed the same methodology used in October 2005 because we were still a party to the proposed merger agreement with Check Point for which we believed that consummation was imminent and therefore no adjustment to the market approach previously used was warranted. In late March 2006 we made a public announcement concerning the withdrawal of our merger agreement with Check Point because we could not obtain approval from the Department of Homeland Security’s Committee on Foreign Investment in the United States, or CFIUS.
 
April 2006.  During April 2006, we cancelled the 6,157 options previously granted in October 2005 as well as the options to purchase 159,175 shares of our common stock we granted in January 2006, all at an exercise price of $8.36 per share, and we reissued them at an exercise price of $5.26 per share. Additionally, we granted new options to employees to purchase an aggregate of 287,846 shares of our common stock at $5.26 per share. In accordance with SFAS 123(R), we measured the share-based compensation expense with respect to these grants using the Black-Scholes option pricing model using a per share fair value of our common stock of $5.26 per share. In concluding that $5.26 was the fair value of our common stock, we again followed the methodology outlined above by first determining our enterprise value and then allocating that value to each of our classes of stock.
 
In April 2006, we calculated an enterprise value of $205.0 million using both a market approach and an income approach. One fundamental factor that affected the enterprise fair value calculated under both approaches, and resulted in an enterprise value that was lower than the amount calculated during the period from October 2005 through March 2006, was the March 2006 withdrawal of our merger agreement from consideration for approval by CFIUS. We considered valuations derived using both approaches because we believed that neither approach, on its own, would necessarily result in the best evidence of fair value based on the status of our business. For example, we did not believe that the market approach alone would be the most appropriate methodology as a result of our inability to consummate the Check Point transaction. Similarly, we believed that relying solely on the income approach would not have resulted in the best evidence of fair value because of the inherent limitations of that approach in accounting for risk.


38


Table of Contents

 
Under the market approach, we considered the merger agreement with Check Point as one data point; however, we assigned less probative value to that transaction in light of the termination of that agreement due to the failure of the CFIUS approval process. We also considered comparable recent acquisition transactions that had occurred in the previous several months. In deciding which companies and transactions were sufficiently similar to us to result in a meaningful comparison, we looked to the merger and acquisition market for security software companies and specifically both public and private target companies within that group that were similar to us in terms of size (revenue and growth rates), industry, profitability (or net loss experience), stage of development, enterprise valuations, growth patterns, business model, and experience of the management team. Examples of companies within this group, or the Peer Group, included Abridean (acquired by nCipher), Cyberguard (acquired by Secure Computing), Sygate (acquired by Symantec), Omnipod (acquired by MessageLabs) LODOGA Security (acquired by Transdigital), iDefense (acquired by Verisign), JP Mobile (acquired by Good Technology) and GuardedBet (acquired by Micromuse). We chose these companies because they best matched the comparison criteria listed above without the need to make further assumptions or adjustments to arrive at a meaningful comparison.
 
In arriving at an enterprise fair value under this approach, we placed significant emphasis on the enterprise value of companies within the Peer Group expressed as a multiple of those respective companies’ trailing revenues. We believe that focusing on revenue multiples of trailing revenue was the best evidence of fair value because the merger and acquisition market for security software companies most commonly uses this approach to measure valuation. Based on that assumption, in reviewing companies within the Peer Group, we observed a range of revenue multiples from 4.5 to 14.3 resulting in a mean revenue multiple of 5.88. From this analysis and rounding to the nearest whole number, we determined that an appropriate revenue multiple that marketplace participants used to value companies within the Peer Group was six times their 2005 revenues. Six times our 2005 revenues yielded an enterprise value of approximately $197.0 million.
 
Under the income approach, we calculated our enterprise value using the discounted cash flow method, which determines the present value of the expected future economic benefit to an equity holder by application of an appropriate discount rate. Our EBITDA projections, working capital requirements and capital expenditure requirements, all of which affect our cash flows, were calculated through our fiscal year ending December 31, 2008. We did not use estimated cash flows for periods beyond our fiscal year 2008 for two primary reasons. First, the projections we used internally to manage our business included only detailed results of our operations through our fiscal year ending December 31, 2008. Second, the fact that we had limited and variable historical data due to our establishment as an enterprise in 2001 and our belief that the assumptions necessary to determine cash flows from our business beyond 2008 were highly speculative in nature and could have caused us to place an inaccurate enterprise valuation on our business. To arrive at a present value of these projected cash flows, we discounted each year’s cash flows using a 20.8% weighted average cost of capital. To these discounted cash flows we added the present value of our estimated enterprise terminal value in early 2009. Based on a review of comparable company market multiple data, we determined this terminal value to be three times our estimated 2008 revenues, or $320.0 million. Taking into account the discounted cash flows and this estimated terminal value, we arrived at an enterprise value of $205.0 million. We used this enterprise value to calculate the fair value of our common stock since it did not differ materially from the estimated enterprise value using the market approach.
 
In allocating the $205.0 million enterprise value to each of our classes of stock, we again used the current-value method since we still believed at the time that the most likely outcome for our business was an acquisition transaction. We also considered that if we had used the probability-weighted expected return method of allocation, we believed the allocation results would have been the same as those achieved using the current-value method because in April 2006, we assigned a zero probability to an IPO scenario. Accordingly, we allocated approximately $57.8 million in the aggregate to our preferred stock, representing the liquidation preferences plus all accrued but unpaid dividends. We then allocated the remaining $151.2 million, which included estimated option exercise proceeds of $4.0 million, to all equity securities assuming conversion of all securities into shares of common stock. This resulted in a per share gross fair value of approximately $8.25 per share of common stock. We then applied a discount of fifteen percent (15%) to account for the lack of marketability of our equity securities. In arriving at a fifteen percent (15%) marketability discount, we considered the following factors: our expectations of a ready market for our securities in the future, the number, extent and terms of existing contractual arrangements requiring us to purchase or sell our securities, the restrictions on transferability of our equity securities by our stockholders,


39


Table of Contents

the existence of potential acquirors, the costs associated with bringing equity securities to market, the risk and volatility of our business, the size and timing of any projected dividends, the difficulty in assigning a value to our equity interest and the concentration of our ownership. In addition to the marketability discount, we further discounted this value by twenty-five percent (25%) to reflect the absence of any strategic or synergistic benefits that would justify a valuation premium for our common stockholders. Because our common stockholders controlled significantly less than a 50% interest, we considered that class a minority interest. In arriving at this twenty-five percent (25%) discount, we considered the following factors: the concentration of our ownership in individual stockholders, the number of common stockholders and the relative size of their holdings, the existence of potential acquirors, the degree of influence a minority shareholder has, patterns of historical liquidation of stockholders’ interests, how control is exercised and the average change-of-control premium realized in other comparable merger and acquisition transactions. We relied on studies performed by merger and acquisition data tracking service providers, such as Mergerstat and Pratt’s Stats, to determine the appropriate marketability and minority interest discounts. Applying both discounts to the value of $8.25 per share yielded a fair value of $5.26 per share. In determining that the result obtained under this approach was the best evidence of our fair value, our board also considered the negative impact that the withdrawal of our Check Point merger agreement due to the CFIUS approval process had on our business. Prior to entering into the merger agreement, we had planned to generate both net income and positive cash flow for 2006. As a result of the termination of the merger agreement, we revised our 2006 operating plan downward to reflect operational difficulties and uncertainties associated with existing and potential government agency customers, which had in some cases refrained from doing business with us during the CFIUS review process. Although we had increased our revenue and customer penetration substantially over the previous few years, we still operated at a net loss and had to use cash proceeds from private placements to fund our operations. Thus, in April 2006, our board of directors considered the foregoing analyses and concluded that $5.26 was the best estimate of the fair value of our common stock for purposes of granting options at that time.
 
For the Period May 2006 to September 2006.  We did not grant any share-based compensation to our employees during the period from May 2006 until September 2006, and thus recorded no expense with respect to share-based compensation to our employees during that period.
 
October and November 2006.  In October 2006 we granted options to purchase a total of 399,603 shares of our common stock to our employees at an exercise price of $9.48 per share. In accordance with SFAS 123(R), we measured share-based compensation expense with respect to these grants using the Black-Scholes option pricing model using a per share fair value of our common stock of $9.48 per share. In concluding that $9.48 was the fair value of our common stock, we again followed the methodology outlined above by first determining our enterprise value and then allocating that value to each of our classes of stock. In addition to the allocation of the enterprise value to each of our classes of stock, we also considered the impact of two significant potential liquidity events: the successful consummation of a public offering of our common stock, or the IPO scenario, and the sale of the company in a merger or acquisition transaction, or the M&A scenario. We took into account the probability of each outcome in making our evaluation.
 
In October 2006, we calculated an enterprise value of $226.0 million using a market approach, which we corroborated using an income approach that considered discounted cash flows. In conducting our analysis using the market approach, we followed the same methodology that we used in calculating fair value under that approach in April 2006, except that we used a multiple of six times our revenues for the trailing four quarters ended September 30, 2006 instead of six times our 2005 revenues.
 
In allocating the $226.0 million enterprise value to each of our classes of stock, we recognized that the methodology to follow would differ from past periods because we faced the two potential liquidity scenarios described above. In allocating the enterprise value under the M&A scenario, we followed closely the allocation methodology used in past periods whereby we first allocated a portion of the enterprise fair value to our preferred stock based upon its rights and preferences. Accordingly, we allocated approximately $75.0 million in the aggregate to our preferred stock based upon liquidation preferences and accrued but unpaid dividends. We then allocated the remaining $151.0 million to all equity securities assuming conversion of all securities into shares of common stock. This resulted in a per share value of approximately $7.55 per share of common stock.


40


Table of Contents

 
In allocating the enterprise value under the IPO scenario, we assumed that all of our preferred stock would automatically convert to common stock based on the definition of a qualified public offering contained in our Charter. Thus under the IPO scenario allocation, we did not first allocate a portion of the enterprise value to our preferred stock, but rather calculated the value of approximately $11.42 per share assuming conversion of all securities into shares of common stock.
 
Under this dual allocation approach, we then assigned a probability to the M&A scenario and another probability to the IPO scenario to arrive at a composite allocation. In October 2006, because of the relative uncertainty surrounding the likelihood of an M&A scenario versus an IPO scenario, we ascribed a 50% probability to the M&A scenario and 50% probability to the IPO scenario, resulting in a fair value of $9.48 per share. Thus, in mid-October 2006, our board of directors considered the foregoing analyses and concluded that $9.48 was the best estimate of the fair value of our common stock for purposes of granting options at that time.
 
In November 2006 we granted options to purchase a total of 56,955 shares of our common stock to our employees at an exercise price of $10.41 per share. In accordance with SFAS 123(R), we measured share-based compensation expense with respect to these grants using the Black-Scholes option pricing model using a fair value of our common stock of $10.41 per share. In concluding that $10.41 was the fair value of our common stock, we performed an analysis identical to the one we performed in October 2006 using the same enterprise value of $226.0 million. Because there was not a substantial difference in our trailing four quarters of revenue as measured in October and November, we determined that using an enterprise value of $226.0 million for our analysis in both periods was appropriate. The difference in the resultant valuation, however, was in our assessment of an M&A scenario versus the relative likelihood of an IPO scenario. In November 2006, we determined that the IPO event scenario was more likely than it had been in October because we had filed our initial registration statement with the Securities and Exchange Commission on October 25, 2006.
 
In allocating the $226.0 million enterprise value, we followed the probability-weighted expected return method. Thus we assigned a 75% probability to the $11.42 per share value arrived under the IPO scenario and a 25% probability to the $7.55 per share value arrived under the M&A scenario, given our increased expectation of completing our initial public offering. This probability-weighted expected return methodology resulted in a per share fair value of our common stock of $10.41. Thus, in November 2006, our board of directors considered the foregoing analysis and concluded that $10.41 was the best estimate of the fair value of our common stock for purposes of granting options at that time.
 
December 2006.  In December 2006 we granted options to purchase a total of 38,484 shares of our common stock to our employees at an exercise price of $11.34 per share. In accordance with SFAS 123(R), we measured share-based compensation expense with respect to these grants using the Black-Scholes option pricing model using a per share fair value of our common stock of $11.34 per share. In concluding that $11.34 was a fair value of our common stock, we followed an analysis similar to the ones that we performed in October and November 2006.
 
We used an enterprise value of $250.0 million that we determined based upon valuation discussions that we conducted with our underwriters with respect to other recent technology initial public offerings, and our perceptions of the then-current market conditions. Additionally, in December 2006, we determined that the IPO event scenario was just as likely as it had been in November.
 
In allocating the $250.0 million enterprise value, we followed the probability-weighted expected return method. Thus, we assigned a 75% likelihood that the IPO scenario would occur and a 25% likelihood that the M&A scenario would occur. In allocating the enterprise value under the M&A scenario, we followed closely the allocation methodology used in past periods whereby we first allocated a portion of the enterprise fair value to our preferred stock based upon its rights and preferences. Accordingly, we allocated approximately $79.0 million in the aggregate to our preferred stock based upon liquidation preferences and accrued but unpaid dividends. We then allocated the remaining $171.0 million to all equity securities assuming conversion of all securities into shares of common stock. Under the IPO scenario, we calculated the fair value of approximately $12.26 per share assuming conversion of all securities into shares of common stock. By assigning a 25% probability to the $8.53 per share fair value arrived under the M&A scenario and assigning a 75% probably to the $11.34 per share fair value arrived under the IPO scenario, this probability-weighted expected return methodology resulted in a per share fair value of our common


41


Table of Contents

stock of $11.34. Thus, in December 2006, our board of directors considered the foregoing analysis and concluded that $11.34 was the best estimate of the fair value of our common stock for purposes of granting options at that time.
 
As noted above, we use the Black-Scholes option pricing model to estimate the calculated value of granted stock options. The use of option valuation models requires the input of highly subjective assumptions, including the expected term and the expected stock price volatility. Additionally, the recognition of expense requires the estimation of the number of options that will ultimately vest and the number of options that will ultimately be forfeited. Accordingly, the use of different estimates and assumptions can have a significant impact on the amount of stock-based compensation that is measured and recognized.
 
Accounting for Income Taxes.  Deferred taxes are determined based on the difference between the financial statement and tax basis of assets and liabilities using enacted tax rates in effect in the years in which the differences are expected to reverse. Valuation allowances are provided if, based upon the weight of available evidence, it is more likely than not that some or all of the deferred tax assets will not be realized.
 
To date, for U.S. federal income tax purposes, we have operated in a loss position. We have $28.1 million of net operating loss carry-forwards as of December 31, 2006, although the use of these net operating loss carry-forwards may be significantly limited by changes in our ownership. As of December 31, 2006, we recorded a full valuation allowance against net deferred tax assets, including deferred tax assets generated by net operating loss carry-forwards. These carry-forwards will begin to expire in 2022. We expect that, to the extent we have taxable income in years before their expiration, these net operating loss carry-forwards will impact our effective tax rate.
 
Warranty.  We provide a one-year warranty against defects in materials and workmanship and will either repair the goods or provide replacement products at no charge to the customer. We record estimated warranty costs, currently at less than 1.0% of product revenue, based on historical experience by product, at the time we recognize product revenue. As the complexity of our products increases, we could experience higher warranty claims relative to sales than we have previously experienced, and we may need to increase these estimated warranty reserves.
 
Bad Debt Reserve.  We have historically used a rate of 1.0% of outstanding accounts receivable to estimate our reserve for bad debts based on analysis of past due balances and historical experiences of write-offs. As we expand our business, we expect our accounts receivable balance to grow. If our future experience of actual write-offs for bad debts exceeds 1.0% of our accounts receivable balance, we will have to increase our reserve accordingly.
 
Inventory Valuation.  We outsource our manufacturing and our products are generally drop-shipped directly to our customers by the manufacturers. Therefore, we usually carry relatively little inventory. The inventory on our balance sheet also includes products that we use for demonstration purposes at customer locations. We value our inventory at the lower of the actual cost of our inventory or its current estimated market value. We write down inventory for obsolescence or lack of marketability based upon condition of the inventory and our view about future demand and market conditions. Because of the seasonality of our product sales, obsolescence of technology and product life cycles, we generally write down inventory to net realizable value based on forecasted product demand. Actual demand and market conditions may be lower than those that we project and this difference could have a material adverse effect on our gross profit if inventory write-downs beyond those initially recorded become necessary.


42


Table of Contents

Results of Operations
 
The following table sets forth our results of operations for the periods shown:
 
                                 
    Year ended December 31,  
    2003     2004     2005     2006  
    (in thousands)  
 
Revenue:
                               
Products
  $ 8,153     $ 12,738     $ 23,589     $ 30,219  
Services
    1,328       3,955       9,290       14,707  
                                 
Total revenue
    9,481       16,693       32,879       44,926  
Cost of revenue:
                               
Products
    2,570       4,533       6,610       8,440  
Services
    436       872       1,453       2,632  
                                 
Total cost of revenue
    3,006       5,405       8,063       11,072  
                                 
Gross profit
    6,475       11,288       24,816       33,854  
Operating expenses:
                               
Research and development
    3,751       5,706       6,831       8,612  
Sales and marketing
    9,002       12,585       17,135       20,652  
General and administrative
    2,141       2,905       5,120       5,017  
Depreciation and amortization
    441       752       1,103       1,230  
                                 
Total operating expenses
    15,335       21,948       30,189       35,511  
                                 
Operating loss
    (8,860 )     (10,660 )     (5,373 )     (1,657 )
Other income (expense), net
    16       164       (85 )     792  
                                 
Loss before income taxes
    (8,844 )     (10,496 )     (5,458 )     (865 )
Income tax expense
                      (67 )
                                 
Net loss
  $ (8,844 )   $ (10,496 )   $ (5,458 )   $ (932 )
                                 


43


Table of Contents

The following table sets forth our results of operations as a percentage of total revenue for the periods shown:
 
                                 
    Year ended December 31,  
    2003     2004     2005     2006  
    (% of revenue)  
 
Revenue:
                               
Products
    86 %     76 %     72 %     67 %
Services
    14       24       28       33  
                                 
Total revenue
    100       100       100       100  
                                 
Cost of revenue:
                               
Products
    27       27       20       19  
Services
    5       5       5       6  
                                 
Total cost of revenue
    32       32       25       25  
                                 
Gross profit
    68       68       75       75  
Operating expenses:
                               
Research and development
    39       34       21       19  
Sales and marketing
    95       75       52       46  
General and administrative
    22       18       16       11  
Depreciation and amortization
    5       5       3       3  
                                 
Total operating expenses
    161       132       92       79  
                                 
Operating loss
    (93 )     (64 )     (17 )     (4 )
Other income (expense), net
          1             2  
                                 
Loss before income taxes
    (93 )     (63 )     (17 )     (2 )
Income tax expense
                       
                                 
Net loss
    (93 )%     (63 )%     (17 )%     (2 )%
                                 
 
Comparison of Years Ended December 31, 2006 and 2005
 
Revenue.  Our total revenue increased 37% to $44.9 million in the year ended December 31, 2006 from $32.9 million in the year ended December 31, 2005. Product revenue increased 28% to $30.2 million in the year ended December 31, 2006 from $23.6 million in the year ended December 31, 2005. We did not introduce any new products during 2006 nor did we change the prices of our products from 2005 to 2006. The increase in product revenue was driven primarily by higher demand for our network security solutions throughout both periods, specifically sales of our enterprise class Intrusion Sensors which increased $5.3 million during 2006. Our services revenue increased 58% to $14.7 million in the year ended December 31, 2006 from $9.3 million in the year ended December 31, 2005. The increase in service revenue resulted primarily from support services being provided to a larger installed customer base in the 2006 period.
 
Cost of Revenue.  Our total cost of revenue increased 36% to $11.1 million in the year ended December 31, 2006, compared to $8.1 million in the year ended December 31, 2005. Our product cost of revenue increased 28% to $8.4 million in the year ended December 31, 2006, compared to $6.6 million in the year ended December 31, 2005. During these periods, we did not experience a material increase in our cost per unit of hardware platforms, which is the largest component of our product cost of revenue. The increase in product cost of revenue was driven primarily by higher volume demand for our network security solutions for which we must procure and provide the hardware platform to our customers. Our services cost of revenue increased 81% to $2.6 million in the year ended December 31, 2006, compared to $1.5 million in the year ended December 31, 2005. Of this increase, $620,000 was attributable to our hiring of additional personnel to both service our larger installed customer base


44


Table of Contents

and to provide training and professional services to our customers, and $190,000 was attributable to extending the service contracts with the manufacturers for the hardware platform included with our products for our installed base of customers.
 
Gross Profit.  Gross profit increased 36% to $33.9 million in the year ended December 31, 2006, from $24.8 million in the year ended December 31, 2005. Gross profit as a percentage of total revenue was 75% in both the years ended December 31, 2006 and December 31, 2005. This percentage did not vary between the periods because our product mix, the selling prices of our products and our hardware platform costs remained relatively stable throughout both periods. The increase of $9.1 million in gross profit was primarily due to an increase in product sales and an increase in the number of customers that contracted with us for support arrangements.
 
Research and Development.  Research and development expenses increased 26% to $8.6 million, or 19% of total revenue, in the year ended December 31, 2006 from $6.8 million, or 21% of total revenue, in the year ended December 31, 2005. The increase in the amount of research and development expenses was primarily due to an increase in payroll and benefits of $1.8 million in the year ended December 31, 2006, which resulted from adding personnel in our research and development department to support the release of updates and enhancements to RNA, Intrusion Sensor, and Defense Center products. In addition, at the beginning of 2006, we began product development work on a new release of the Snort intrusion detection engine.
 
Sales and Marketing.  Sales and marketing expenses increased 21% to $20.7 million, or 46% of total revenue, in the year ended December 31, 2006 from $17.1 million, or 52% of total revenue, in the year ended December 31, 2005. The increase in the amount of sales and marketing expenses was primarily due to an increase of $2.1 million in salaries and incentive compensation expense for additional sales personnel, as well as an increase of $0.4 million for stock compensation expense and $0.3 million in advertising and promotion expenses in support of our 3D marketing message for our network security solutions.
 
General and Administrative.  General and administrative expenses decreased 2% to $5.0 million, or 11% of total revenue in the year ended December 31, 2006 from $5.1 million, or 16% of total revenue in the year ended December 31, 2005. During 2006, payroll and benefits increased $180,000 for personnel hired in our accounting, information technology, human resources and legal departments, stock compensation increased $280,000 for the adoption of FAS 123R, and audit and tax consulting increased $110,000; however, these increases were offset by a reduction of $620,000 in legal fees associated with the planned merger with Check Point Software Technologies, Inc. that was negotiated in the summer and autumn of 2005 and withdrawn in March 2006
 
Depreciation and Amortization.  Depreciation and amortization expenses increased 12% to $1.2 million in the year ended December 31, 2006 from $1.1 million in the year ended December 31, 2005. These expenses increased principally because of additional personal computers purchased for personnel hired during 2006.
 
Comparison of Years Ended December 31, 2005 and 2004
 
Revenue.  Our total revenue increased 97% to $32.9 million in the year ended December 31, 2005 from $16.7 million in the year ended December 31, 2004. Product revenue increased 85% to $23.6 million in 2005 from $12.7 million in 2004. The increase in product revenue was primarily driven by increasingly strong demand for our 3D security solutions, particularly by Fortune 100 companies, of which we added seven as customers during 2005. During the fourth quarter of 2005 we introduced our enterprise class Intrusion Sensors which resulted in $900,000 of incremental sales over 2004. Additionally, the Company experienced further demand for its RNA product during 2005 resulting in incremental sales of $2.3 million. We made no material changes in the selling prices of our products in 2004 or 2005. Our services revenue increased 135% to $9.3 million in 2005 from $4.0 million in 2004. The $5.3 million increase resulted primarily from an additional $4.4 million in revenue generated from support services being provided to a larger installed customer base in 2005 than in 2004, and a $880,000 increase in professional and training services revenue resulting from our increase in the number of training programs and the personnel to provide these services in 2005 over 2004. During 2005, we created the Sourcefire Certification Program to provide training for network security professionals.
 
Cost of Revenue.  Our total cost of revenue increased 49% to $8.1 million in the year ended December 31, 2005 from $5.4 million in the year ended December 31, 2004. Our product cost of revenue increased 46% to


45


Table of Contents

$6.6 million in 2005, compared to $4.5 million in 2004. The increase in product cost of revenue was primarily attributable to additional hardware platform costs for the approximately 550 incremental units shipped in 2005 over the amount shipped in 2004, as well as the shipment of our more costly enterprise class intrusion sensors, which were introduced in August 2005. Our cost for hardware platforms and manufacturing did not change materially between 2004 and 2005. Additionally our royalty cost of providing third party software in our products increased by approximately $400,000. Our services cost of revenue increased 67% to $1.5 million in the 2005, compared to $872,000 in 2004. Of this increase, approximately $310,000 was attributable to salaries, bonuses and associated employee benefits and overhead costs for our hiring of additional training and professional service personnel in 2005, with a further $270,000 attributable to travel, facilities and consulting costs incurred in the provision of training and services in 2005 over 2004.
 
Gross Profit.  Our gross profit increased 120% to $24.8 million in 2005, from $11.3 million in 2004. Gross profit as a percentage of total revenue increased to 75% in 2005 from 68% in 2004. This increase in gross profit, as a percentage of total revenue, was principally due to a change in product mix between the periods, with a larger percentage of higher margin products being sold in 2005, and significant growth in our customer support revenue of $4.5 million, which did not require an equivalent incremental expense for support personnel.
 
Research and Development.  Research and development expenses increased 20% to $6.8 million, or 21% of total revenue, in the year ended December 31, 2005 from $5.7 million, or 34% of total revenue, in the year ended December 31, 2004. In 2005, we increased our research and development staff to support the development of enhancements to our 3D product line and the introduction of our enterprise class intrusion sensor, which resulted in an approximate increase of $500,000 in compensation and benefits for additional research and development personnel. Additionally we submitted our products to multiple independent security testing processes in 2005, which cost us an additional $420,000 in testing and certification.
 
Sales and Marketing.  Sales and marketing expenses increased 36% to $17.1 million, or 52% of total revenue, in the year ended December 31, 2005 from $12.6 million, or 75% of total revenue, in the year ended December 31, 2004. The reduction in the percentage of sales and marketing costs to total revenue resulted primarily from an increase in support revenue as well as an increase in sales efficiency against higher sales quotas. The increase of $4.5 million in 2005 resulted primarily from $1.7 million in additional compensation and benefits for personnel added to the sales force, $1.6 million in additional incentive compensation earned on significantly higher sales volume and an increase of $700,000 in marketing expenses to support the company’s growth and product brand recognition programs.
 
General and Administrative.  General and administrative expenses increased to $5.1 million, or 16% of total revenue in the year ended December 31, 2005 from $2.9 million, or 17% of total revenue in the year ended December 31, 2004. The significant increase in 2005 resulted from $1.1 million in legal fees, including $750,000 of one-time fees resulting from our planned acquisition by Check Point Software Technologies, Ltd., and approximately $900,000 in additional compensation and benefits for additional general and administrative personnel.
 
Depreciation and Amortization.  Depreciation and amortization expenses increased 47% to $1.1 million in the year ended December 31, 2005 from $752,000 in the year ended December 31, 2004. These expenses increased principally because of additional amortization of leasehold improvements made to our principal place of business into which we moved in April 2005.
 
Comparison of Years Ended December 31, 2004 and 2003
 
Revenue.  Our total revenue increased 76% to $16.7 million in the year ended December 31, 2004, from $9.5 million in the year ended December 31, 2003. Product revenue increased 56% to $12.7 million in 2004 from $8.2 million in 2003. The increase in product revenue in 2004 resulted primarily from an increase in demand for our network security products, the first full year of sales for both our RNA product, which was introduced in December 2003, and our enterprise class Defense Center, which was introduced in September 2003. Sales of RNA increased by $2.2 million and incremental sales of the enterprise class Defense Center were $550,000. Our services revenue increased 198% to $4.0 million in 2004 from $1.3 million in 2003. The increase in services revenue resulted


46


Table of Contents

primarily from a $2.5 million increase in our support services for our growing customer base as well as the first year of professional training and service revenues of $160,000, which programs were initiated in early 2004.
 
Cost of Revenue.  Our total cost of revenue increased to $5.4 million, or 32% of total revenue in 2004, from $3.0 million, or 32% of total revenue, in 2003. Our product cost of revenue increased 76% to $4.5 million in 2004, compared to $2.6 million in 2003. The increase in product cost of revenue is primarily due to the increase in product revenue of $4.5 million and the resulting increase in our cost of hardware of $1.5 million. The cost of the hardware platforms as a percentage of the selling price remained relatively static at 29% and 27% for 2004 and 2003, respectively. Our services cost of revenue increased 100% to $872,000 in 2004 from $436,000 in 2003. This increase was attributable to the addition in 2004 of personnel to perform training services, which contributed $440,000 of additional compensation, benefits and associated supplies and overhead expenses.
 
Gross Profit.  Gross profit increased to $11.3 million in 2004 from $6.5 million in 2003. Gross profit as a percentage of total revenue was 68% for both 2004 and 2003. The $4.8 million increase was achieved primarily by increasing the volume of products sold while maintaining a consistent hardware platform cost per unit relative to revenue of 29% and 27% in 2004 and 2003, respectively.
 
Research and Development.  Research and development expenses increased 52% to $5.7 million, or 34% of total revenue, in the year ended December 31, 2004 from $3.8 million, or 40% of total revenue, in the year ended December 31, 2003. The increase of $1.9 million resulted primarily from the addition of hired personnel and outside consultants to our research and development team to support the development of our RNA product, which contributed an increase of $1.4 million in compensation and benefits expenses and $550,000 of consulting costs in 2004.
 
Sales and Marketing.  Sales and marketing expenses increased 40% to $12.6 million, or 75% of total revenue, in the year ended December 31, 2004 from $9.0 million, or 95% of total revenue in the year ended December 31, 2003. The reduction in the percentage of sales and marketing costs to total revenue resulted primarily from an increase in support revenue as well as an increase in sales efficiency against higher sales quotas. The increase of $3.6 million in 2004 was primarily due to approximately $1.3 million for salary and benefits for the addition of personnel to the sales force, approximately $900,000 in additional incentive compensation earned on significantly higher sales volume and an increase of $800,000 in marketing expenses to support the company’s growth and product brand recognition.
 
General and Administrative.  General and administrative expenses increased to $2.9 million, or 17% of total revenue, in the year ended December 31, 2004 from $2.1 million, or 23% of total revenue in the year ended December 31, 2003. The increase in 2004 resulted primarily from additional personnel in finance and information technology, which added approximately $600,000 of compensation and benefits expenses.
 
Depreciation and Amortization.  Depreciation and amortization expenses increased 71% to $752,000 in the year ended December 31, 2004 from $441,000 in the year ended December 31, 2003. These expenses increased principally because of an increase in purchases of testing equipment for our research and development lab as well as personal computers for additional personnel hired during 2004.


47


Table of Contents

Quarterly Results of Operations
 
You should read the following tables presenting our unaudited quarterly results of operations in conjunction with the consolidated financial statements and related notes contained elsewhere in this prospectus. We have prepared the unaudited information on the same basis as our audited consolidated financial statements. You should also keep in mind, as you read the following tables, that our operating results for any quarter are not necessarily indicative of results for any future quarters or for a full year.
 
The following table presents our unaudited quarterly results of operations for the eight fiscal quarters ended December 31, 2006. This table includes all adjustments, consisting only of normal recurring adjustments, that we consider necessary for fair statement of our operating results for the quarters presented.
 
                                                                 
    Three months ended  
    March 31,
    June 30,
    Sept. 30,
    Dec. 31,
    March 31,
    June 30,
    Sept. 30,
    Dec. 31,
 
    2005     2005     2005     2005     2006     2006     2006     2006  
    (unaudited)  
    (in thousands)  
 
Revenue:
                                                               
Products
  $ 4,890     $ 4,019     $ 5,980     $ 8,700     $ 5,423     $ 6,040     $ 6,927     $ 11,829  
Services
    1,862       2,076       2,397       2,955       3,109       3,495       3,940       4,163  
                                                                 
Total revenue
    6,752       6,095       8,377       11,655       8,532       9,535       10,867       15,992  
                                                                 
Cost of revenue:
                                                               
Products
    1,375       1,082       1,772       2,381       1,397       1,721       1,813       3,509  
Services
    290       332       359       472       610       681       725       616  
                                                                 
Total cost of revenue
    1,665       1,414       2,131       2,853       2,007       2,402       2,538       4,125  
                                                                 
Gross profit
    5,087       4,681       6,246       8,802       6,525       7,133       8,329       11,867  
Operating expenses
    6,547       6,466       8,021       9,155       8,440       8,485       8,420       10,166  
                                                                 
Income (loss) from operations
    (1,460 )     (1,785 )     (1,775 )     (353 )     (1,915 )     (1,352 )     (91 )     1,701  
Other income (expense)
    (1 )     (10 )     (39 )     (35 )     (10 )     156       296       350  
                                                                 
(Loss) income before income taxes
    (1,461 )     (1,795 )     (1,814 )     (388 )     (1,925 )     (1,196 )     205       2,051  
Income tax expense
                                              67  
                                                                 
Net (loss) income
  $ (1,461 )   $ (1,795 )   $ (1,814 )   $ (388 )   $ (1,925 )   $ (1,196 )   $ 205     $ 1,984  
                                                                 
Net cash (used in) provided by operations
    680       (1,316 )     (2,086 )     (1,736 )     2,701       (1,205 )     416       156  


48


Table of Contents

The following table sets forth our results of operations as a percentage of total revenue for the periods shown:
 
                                                                 
    Three months ended  
    March 31,
    June 30,
    Sept. 30,
    Dec. 31,
    March 31,
    June 30,
    Sept. 30,
    Dec. 31,
 
    2005     2005     2005     2005     2006     2006     2006     2006  
    (unaudited)  
    (% of revenue)  
 
Revenue:
                                                               
Products
    72 %     66 %     71 %     75 %     64 %     63 %     64 %     74 %
Services
    28       34       29       25       36       37       36       26  
                                                                 
Total revenue
    100       100       100       100       100       100       100       100  
                                                                 
Cost of revenue:
                                                               
Products
    21       18       21       20       16       18       17       22  
Services
    4       5       4       4       7       7       7       4  
                                                                 
Total cost of revenue
    25       23       25       24       23       25       24       26  
                                                                 
Gross profit
    75       77       75       76       77       75       76       74  
Operating expenses
    97       106       96       79       99       89       77       64  
                                                                 
Income (loss) from operations
    (22 )     (29 )     (21 )     (3 )     (22 )     (14 )     (1 )     10  
Other income (expense)
                (1 )           (1 )     1       3       2  
                                                                 
(Loss) income before income tax expense
    (22 )     (29 )     (22 )     (3 )     (23 )     (13 )     2       12  
Income tax expense
                                               
                                                                 
Net (loss) income
    (22 )%     (29 )%     (22 )%     (3 )%     (23 )%     (13 )%     2 %     12 %
                                                                 
 
Seasonality
 
Our product revenue has tended to be seasonal. In our third quarter, we have historically benefited from the Federal government’s fiscal year end purchasing activity. This increase has been partially offset, however, by European sales, which have tended to decline significantly in the summer months due to the practice by many Europeans of taking extended vacation time and delaying capital purchase activities until their return in the fall. We have historically generated a significant portion of product revenue in the fourth quarter due to the combination of increased activity in Europe coupled with North American enterprise customers who often wait until the fourth quarter to extract favorable pricing terms from their vendors, including Sourcefire. The timing of these shipments could materially affect our year-end product revenue. Currently, we do not see any indication that these seasonal patterns will change significantly in the foreseeable future.
 
Quarterly Timing of Revenue
 
On a quarterly basis, we have usually generated the majority of our product revenue in the final month of each quarter. We believe this occurs for two reasons. First, many customers wait until the end of the quarter to extract favorable pricing terms from their vendors, including Sourcefire. Second, our sales personnel, who have a strong incentive to meet quarterly sales targets, have tended to increase their sales activity as the end of a quarter nears, while their participation in sales management review and planning activities are typically scheduled at the beginning of a quarter.
 
Liquidity and Capital Resources
 
At December 31, 2006 and December 31, 2005, our principal sources of liquidity were cash and cash equivalents totaling $13.0 million and $1.1 million, respectively, held-to-maturity investments of $13.3 million and


49


Table of Contents

$2.0 million, respectively, and accounts receivable of $16.5 million and $12.9 million, respectively. We have funded our growth primarily with proceeds from the issuance of convertible preferred stock for aggregate net cash proceeds of $56.5 million through December 31, 2006, occasional borrowings under a working capital line of credit and cash generated from operations.
 
We manufacture and distribute our products through contract manufacturers and OEMs. We believe that this approach gives us the advantages of relatively low capital investment and significant flexibility in scheduling production and managing inventory levels. By leasing our office facilities, we also minimize the cash needed for expansion. Our capital spending is generally limited to leasehold improvements, computers, office furniture and product-specific test equipment. The majority of our products are delivered to our customers directly from our contract manufacturers. Accordingly, our contract manufacturers are responsible for purchasing and stocking the components required for the production of our products and they invoice us when the finished goods are shipped.
 
Our product sales are, and are expected to continue to be, highly seasonal. This seasonality typically results in a significant amount of cash provided by our operating activities during the first half of the year with lower to negative cash flow during the second half of the year. We have cash reserves and a working capital line of credit that can be utilized to cover any short-term cash needs resulting from the seasonality of our business.
 
Discussion of Cash Flows
 
Net cash provided by our operating activities in 2006 was $2.1 million compared to net cash used in our operating activities in 2005, 2004 and 2003 of $4.5 million, $9.8 million and $7.6 million, respectively.
 
The cash provided by our operations in 2006 resulted primarily from an increase in deferred revenue of $3.5 million, an increase in accounts payable and accrued expenses of $1.6 million, and depreciation and amortization of $1.3 million and stock based compensation of $806,000, both of which are non-cash charges, offset by an increase in accounts receivable of $3.6 million and a net loss of $932,000. Deferred revenue increased primarily due to an increase of $4.4 million in support services provided to customers. The increase in accounts payable and accrued expenses resulted primarily from additional legal costs associated with this offering and additional contract manufacturing costs associated with increased sales volume. The increase in accounts receivable resulted primarily from our seasonally significant fourth quarter product sales that are invoiced and recorded as revenue but not collected as of the end of the calendar year.
 
The cash used in our operating activities in 2005 resulted primarily from a net loss of $5.5 million and an increase of $5.1 million in accounts receivable and $1.1 million in inventory, offset by an increase in deferred revenue of $5.0 million, and depreciation and amortization of $1.1 million and stock-based compensation of $470,000, both of which are non-cash charges. The increase in accounts receivable resulted primarily from our seasonally significant fourth quarter product sales that are invoiced and recorded as revenue but not collected as of the end of the calendar year, while the increase in inventory was primarily due to the expansion of our number of evaluation, or demonstration, products, especially the enterprise class intrusion sensors. Deferred revenue increased primarily due to an increase of $3.6 million for support services to customers, which are usually paid for in advance but recorded as revenue ratably throughout the term of the service contract.
 
The cash used in our operating activities in 2004 resulted primarily from a net loss of $10.5 million and an increase of $4.7 million in accounts receivable and $409,000 in inventory, offset by an increase in deferred revenue of $3.1 million, an increase in accounts payable and accrued expenses of $1.7 million and depreciation and amortization of $756,000 and stock-based compensation of $177,000, both of which are non-cash charges. The increase in accounts receivable resulted primarily from our seasonally significant fourth quarter product sales that are invoiced and recorded as revenue but not collected as of the end of the calendar year, while the increase in inventory was primarily due to the expansion of our number of evaluation, or demonstration, products. Deferred revenue increased primarily due to an increase of $2.4 million for support services to customers and $860,000 for products.
 
Historically, we have incurred significant losses, largely attributable to our investment in internally funded research and development and the rapid expansion of our sales force. Based on our historical product development efforts, we launched our first commercial products in November 2001. Since November 2001, our revenue has


50


Table of Contents

significantly increased, our investment in internally-funded research and development has declined as a percentage of revenue, but not for any subsequent period. We have not invested significantly in property, plant and equipment, and we have established an outsourced approach to manufacturing that provides significant flexibility in both managing inventory levels and financing our inventory. Our revenue has been highly seasonal. This seasonality tends to result in the generation of cash in the first quarter of the year, due to the collection of accounts receivable from significant fourth quarter billings, and the net use of cash during the remaining nine months of the year. Given the recent success of our products and resulting growth in revenue, we believe that the proceeds of this offering, existing cash, cash equivalents, cash provided by operating activities and funds available through our bank line of credit will be sufficient to meet our working capital and capital expenditure needs for at least the next 24 months.
 
Credit Facility.  In March 2005, we renewed our loan and security agreement with Silicon Valley Bank, under which we increased our working capital line of credit with Silicon Valley Bank so that we can borrow up to $5.0 million. This agreement also provides for an additional $1.0 million equipment facility for capital expenditure financing and we obtained a supplemental $1.0 million equipment facility in July 2006, for a total of $2.0 million. Interest on the working capital line of credit accrues at a variable rate of prime plus 0.5%. The line expires on March 28, 2007, at which time all advances will be immediately due and payable. We intend to renew this credit facility for a minimum period of one year. As of December 31, 2006, we had no amounts outstanding and $4.8 million available under our working capital line of credit. Any borrowings we may make under the working capital line of credit would be secured by substantially all of our assets, other than our intellectual property. We have issued a $201,000 standby letter of credit which reduces the available borrowings under the agreement by that amount. For the equipment facility, we were allowed to request advances through January 31, 2007. Each advance is collateralized into a note payable at a fixed rate of 9.0% or prime plus 0.5% over a term of 36 months. As of December 31, 2006, we had $1,312,000 outstanding and $113,000 remaining available under the equipment facility. The $113,000 remaining availability was fully utilized as of January 31, 2007. The working capital line of credit restricts our ability to:
 
  •  incur or guaranty additional indebtedness;
 
  •  create liens;
 
  •  enter into transactions with affiliates;
 
  •  make loans or investments;
 
  •  sell assets;
 
  •  pay dividends or make distributions on, or repurchase, our stock; or
 
  •  consolidate or merge with other entities.
 
In addition, we are required to maintain a monthly adjusted quick ratio (unrestricted cash plus accounts receivable to current liabilities, excluding deferred revenue, plus long-term debt) of 1.5 to 1.0 and we must achieve a positive earnings before interest, taxes, depreciation and amortization by the calendar quarter ending March 31, 2007. These thresholds are based on our stockholders’ equity, assuming conversion of all of our convertible preferred stock into shares of common stock. These operating and financial covenants may restrict our ability to finance our operations, engage in business activities or expand or pursue our business strategies. As of December 31, 2006, we were in compliance with all covenants under the credit facility. To the extent we are unable to satisfy those covenants in the future, we will need to obtain waivers to avoid being in default of the terms of either of our credit facilities. In addition to a covenant default, other events of default under our credit facilities include the filing or entry of a tax lien, attachment of funds or material judgment against us, or other uninsured loss of our material assets. If a default occurs, the bank may require that we immediately repay all amounts of principal and interest then outstanding. After this offering, we expect that we will have sufficient resources to fund any amounts which may become due under this credit facility as a result of a default by us or otherwise. Any amounts which we may be required to repay prior to a scheduled repayment date, however, would reduce funds that we could otherwise allocate to other opportunities that we consider desirable.
 
Working Capital and Capital Expenditure Needs
 
Except as disclosed in the Contractual Obligations table below, we currently have no material cash commitments, except for normal recurring trade payables, expense accruals and operating leases, all of which we


51


Table of Contents

anticipate funding through our existing working capital line of credit, our available working capital and funds expected to be provided by operating activities. In addition, we do not currently anticipate significant investment in property, plant and equipment, and we believe that our outsourced approach to manufacturing provides us significant flexibility in both managing inventory levels and financing our inventory. In the event that our revenue plan does not meet our expectations, we may eliminate or curtail expenditures to mitigate the impact on our working capital. Our future capital requirements will depend on many factors, including our rate of revenue growth, the expansion of our marketing and sales activities, the timing and extent of spending to support product development efforts, the timing of introductions of new products and enhancements to existing products, the acquisition of new capabilities or technologies, and the continuing market acceptance of our products and services. Moreover, to the extent that existing cash, cash equivalents, cash from operations, cash from short-term borrowing and the net proceeds from this offering are insufficient to fund our future activities, we may need to raise additional funds through public or private equity or debt financing. In the years ended December 31, 2006 and 2005 we spent $1.3 million and $2.2 million, respectively, on capital equipment. Our capital expenditure budget for 2007 totals approximately $2.5 million, which is expected to include approximately $400,000 for leasehold improvements, $1.2 million for additional testing equipment for our research and development lab, $600,000 for additional network systems and $300,000 for personal computers for additional personnel we anticipate hiring.
 
Although we are currently not a party to any agreement or letter of intent with respect to potential investments in, or acquisitions of, businesses, services or technologies, we may enter into these types of arrangements in the future, which could also require us to seek additional equity or debt financing. Additional funds may not be available on terms favorable to us or at all. We currently have no plans, proposals or arrangements with respect to any specific acquisition.
 
Contractual Obligations
 
Our principal commitments consist of obligations under our equipment facility, leases for office space and minimum contractual obligations for services. The following table describes our commitments to settle contractual obligations in cash as of December 31, 2006:
 
                                         
    Payments due by period  
          Less than
    1-3
    3-5
    More than
 
    Total     1 year     years     years     5 years  
    (in thousands)  
 
Equipment Line of Credit Facility
  $ 1,312     $ 675     $ 637     $     $   —  
Operating Leases
    5,511       1,576       2,604       1,290       41  
Purchase Commitments(1)
    1,655       1,388       267              
 
 
  (1)  We entered into a purchase commitment with a hardware manufacturing vendor with whom we have a current arrangement. Under the terms of this commitment, we have agreed to purchase a set quantity of new appliance inventory over an 18-month period. The approximate value of the purchase commitment is $800,000 and we expect to commence making payments under this commitment beginning in April 2007 once the new appliance configuration is accepted. Additionally, we have entered into a purchase commitment with a vendor to license database software that is used in our products. Under the terms of the commitment, we are permitted to distribute the vendor’s software in our products through December 31, 2010 in exchange for an up front payment, plus annual maintenance fees. The approximate aggregate value of the purchase commitment is $855,000, which was paid in January 2007.
 
As of December 31, 2006, our total contractual obligations were $6.8 million or a net increase of $2.8 million over the amount due at December 31, 2005, due to increased borrowings under our equipment facility with Silicon Valley Bank, our off-balance sheet arrangement with ePlus, and new leases of office space.
 
Off-Balance Sheet Arrangements
 
As of December 31, 2006, we had an off-balance sheet arrangement with ePlus, a supplier and financier of computer equipment and furniture. The arrangement provides financing that does not meet the requirement of


52


Table of Contents

generally accepted accounting principles for treatment as capitalized equipment and furniture due to the short length of the term of the financing versus the useful life of the equipment and furniture. As of December 31, 2006 we had utilized approximately $845,000 of this arrangement which has no set expiration date, but can be terminated by either party providing the other party notice of the intent to discontinue.
 
Recent Accounting Pronouncement
 
On July 13, 2006, the FASB issued FIN 48, “Accounting for Uncertainty in Income Taxes.” FIN 48 clarifies the accounting for uncertainty in income taxes recognized in an enterprise’s financial statements in accordance with FASB Statement No. 109, “Accounting for Income Taxes.” FIN 48 prescribes a recognition threshold and measurement attribute for the financial statement recognition and measurement of a tax position taken or expected to be taken in a tax return. FIN 48 also provides guidance on derecognition, classification, interest and penalties, accounting in interim periods, disclosure and transition. FIN 48 is effective for fiscal years beginning after December 15, 2006. An enterprise is required to disclose the cumulative effect of the change on retained earnings in the statement of financial position as of the date of adoption and such disclosure is required only in the year of adoption. We are currently evaluating the effect that FIN 48 will have on our consolidated balance sheets, consolidated statements of operations or consolidated statements of cash flows.
 
Quantitative and Qualitative Disclosures about Market Risk
 
Foreign Currency Risk
 
Nearly all of our revenue is derived from transactions denominated in U.S. dollars, even though we maintain sales and business operations in foreign countries. As such, we have exposure to adverse changes in exchange rates associated with operating expenses of our foreign operations, but we believe this exposure to be immaterial at this time. As we grow our international operations, our exposure to foreign currency risk could become more significant.
 
Interest Rate Sensitivity
 
We had unrestricted cash, cash equivalents and held-to-maturity investments totaling $26.3 million at December 31, 2006. The unrestricted cash and cash equivalents are held for working capital purposes while investments, made in accordance with our low-risk investment policy, take advantage of higher interest income yields. In accordance with our investment policy, we do not enter into investments for trading or speculative purposes. Some of the securities in which we invest, however, may be subject to market risk. This means that a change in prevailing interest rates may cause the principal amount of the investment to fluctuate. To minimize this risk in the future, we intend to maintain our portfolio of cash equivalents and long-term investments in a variety of securities, including commercial paper, money market funds, debt securities and certificates of deposit. Due to the nature of these investments, we believe that we do not have any material exposure to changes in the fair value of our investment portfolio as a result of changes in interest rates.
 
Our exposure to market risk also relates to the increase or decrease in the amount of interest expense we must pay on our outstanding debt instruments, primarily certain borrowings under our bank working capital line of credit and equipment facility. Any advances under the working capital line of credit and certain advances under our equipment facility bear a variable rate of interest determined as a function of the prime rate at the time of the borrowing and is adjusted monthly based on changes in the prime rate. Other advances under our equipment facility bear interest at a fixed rate of interest. At December 31, 2006, there were no amounts outstanding under our working capital line of credit and $1,312,000 outstanding under the equipment facility. The interest rates paid on this balance at December 31, 2006 were: a fixed rate of 6.5% on $18,000; a fixed rate of 7.0% on $458,000; and a variable rate of 8.75% on $836,000.


53


Table of Contents

 
BUSINESS
 
Overview
 
We are a leading provider of intelligence driven, open source network security solutions that enable our customers to protect their computer networks in an effective, efficient and highly-automated manner. We sell our security solutions to a diverse customer base that includes over 25 of the Fortune 100 companies and over half of the 30 largest U.S. government agencies. We also manage one of the security industry’s leading open source initiatives, Snort.
 
Our family of network security products forms a comprehensive Discover, Determine and Defend, or 3D, approach to network security. Using this approach, our technology can automatically:
 
  •  Discover potential threats and points of vulnerability through use of our Intrusion Sensors coupled with our Real-time Network Awareness, or RNA, Sensors;
 
  •  Determine the potential impact of those observations to the network by aggregating threat and network intelligence, including potential attacks and points of vulnerabilities at the Defense Center; and
 
  •  Defend the network through proactive enforcement of security policy, substantially reducing the need for manual investigation and intervention by information technology, or IT, administrators.
 
 
At the heart of the Sourcefire 3D security solution is RNA, our network intelligence product that provides persistent visibility into the composition, behavior, topology (the relationship of network components) and risk profile of the network. This information provides a platform for automated decision-making and network policy compliance enforcement. The ability to continuously discover characteristics and vulnerabilities of any computing device, or endpoint, communicating on a network (such as a computer, printer or server) or endpoint intelligence, along with the ability to observe how those endpoints communicate with each other, or network intelligence, enables our Intrusion Prevention products to more precisely identify and block threatening traffic and to more efficiently classify threatening and/or suspicious behavior than products lacking network intelligence.
 
Using a broad range of analysis, reporting and automated response capabilities, the Defense Center aggregates, correlates and prioritizes network security events from RNA Sensors and Intrusion Sensors to synthesize multipoint event correlation and policy compliance analysis. The Defense Center’s policy and response subsystems are designed to leverage existing IT infrastructure such as firewalls, routers, trouble ticketing and patch management systems for virtually any task, including alerting, blocking and initiating corrective measures.
 
The traffic inspection engine used in our intrusion prevention products is the open source technology called Snort®. Martin Roesch, our founder and Chief Technology Officer, created Snort in 1998, and assigned his rights in Snort to us when we were formed. Our employees, including Mr. Roesch, have authored all major components of


54


Table of Contents

Snort, and we maintain control over the Snort project, including the principal Snort community forum, Snort.org. Snort, which has become a de facto industry standard, has been downloaded over 3 million times. We believe that a majority of the Fortune 100 companies and all of the 30 largest U.S. government agencies use Snort technology to monitor network traffic and that Snort is the most widely deployed intrusion prevention technology worldwide. The ubiquitous nature of the Snort user community represents a significant opportunity to sell our proprietary products to customers that require a complete enterprise solution.
 
For the years ended December 31, 2005 and 2006, we generated approximately 82% and 81% of our revenue from customers in the United States and 18% and 19% from customers outside of the United States respectively. We have expanded our international and indirect distribution channels and, in the future, we expect to increase sales outside of the United States and to source additional customer prospects and generate an increasing portion of product revenue through alliances with original equipment manufacturers, or OEMs, such as Nokia Inc. We increased our revenue from $32.9 million in 2005 to $44.9 million in 2006, representing a growth rate of 37%. For the year ended December 31, 2006, product revenue represented 67% of our total revenue and services revenue represented 33% of our total revenue.
 
Our Industry
 
We believe, based on our review of various industry sources, that the network security industry was estimated to be a $18.4 billion market in 2006 and is projected to grow to $26.9 billion in 2009, representing a compound annual growth rate of over 13%. Our addressable markets include intrusion prevention, vulnerability management and unified threat management, which were collectively projected to total $2.9 billion in 2006 and are expected to grow at a compound annual growth rate in excess of 21% to $5.2 billion in 2009, according to industry sources we reviewed. We expect growth should continue as organizations seek solutions to various growing and evolving security challenges, including:
 
Greater Sophistication, Severity and Frequency of Network Attacks.  The growing use of the Internet as a business tool has required organizations to increase the number of access points to their networks, which has made vast amounts of critical information more vulnerable to attack. Theft of sensitive information for financial gain motivates network attackers, who derive profit through identity theft, credit card fraud, money laundering, extortion, intellectual property theft and other illegal means. These profit-motivated attackers, in contrast to the hobbyist hackers of the past, are employing much more sophisticated tools and techniques to generate profits for themselves and their well-organized and well-financed sponsors. Their attacks are increasingly difficult to detect and their tools often establish footholds on compromised network assets with little or no discernable effect, facilitating future access to the assets and the networks on which they reside.
 
Increasing Risks from Unknown Vulnerabilities.  Vulnerabilities in computer software that are discovered by network attackers before they are discovered by security and software vendors represent a tremendous risk. These uncorrected flaws can leave networks largely defenseless and open to exploitation. According to CERT-CC data as of October 2006, the trends in the rate of vulnerability disclosure are particularly alarming, with approximately 3,780 disclosed in 2004 and more than 5,990 disclosed in 2005. During 2006, Microsoft alone issued 49 patches designated as ‘critical’ for its various software products. Many vulnerabilities have existed since the original release of the affected software products — some dating back to the 1990s — but were not corrected until recently.
 
Potential Degradation of Network Performance.  Many security products degrade network performance and are, therefore, disfavored by network administrators who generally prioritize network performance over incremental gains in network security. For example, the use of active scanners that probe networks for vulnerabilities often meet heavy resistance from administrators concerned about excessive network “noise,” clogged firewall logs, and disruption of network assets that are critical to business operations.
 
Diverse Demands on Security Administrators.  The proliferation of targeted security solutions such as firewalls, intrusion prevention systems, URL filters, spam filters and anti-spyware solutions, while critical to enhancing network security, create significant administrative burdens on personnel who must manage numerous disparate technologies that are seldom integrated and often difficult to use. Most network security products require manual, labor intensive incident response and investigation by security administrators, especially when “false


55


Table of Contents

positive” results are generated. Compounding these resource constraint issues, many organizations are increasingly challenged by the loss of key personnel as the demand for security experts has risen dramatically in traditional corporate settings, government agencies and the growing number of start-up security companies.
 
Heightened Government Regulation.  Rapidly growing government regulation is forcing compliance with increased requirements for network security, which has escalated demand for security solutions that both meet compliance requirements and reduce the burden of compliance reporting and enforcement. Examples of these laws include
 
  •  The Health Insurance Portability and Accountability Act of 1996, or HIPAA, and its related rules, which establish requirements for safeguards to protect the confidentiality, integrity and availability of electronic protected health information.
 
  •  The Financial Services Modernization Act of 1999, commonly known as the Gramm-Leach-Bliley Act, which includes provisions to protect consumers’ personal financial information held by financial institutions.
 
  •  The Sarbanes-Oxley Act of 2002, which mandates that public companies demonstrate due diligence in the disclosure of financial information and maintain internal controls and procedures for the communication, storage and protection of such data.
 
  •  The Federal Information Security Management Act, which requires federal agencies, including contractors and other organizations that work with the agencies, to develop, document and implement an agency-wide information security program.
 
Our Competitive Strengths
 
We are a leading provider of intelligence driven, open source network security solutions that enable our customers to protect their computer networks in an effective, efficient and highly automated manner. We apply the Sourcefire 3D security solution — Discover, Determine, Defend — to network security through our comprehensive family of products, which consists of our RNA, Intrusion Sensors and the Defense Center products. Our competitive strengths include:
 
Real-Time Approach to Network Security.  Our approach to network security enables our customers to secure their networks by providing real-time defense against both known and unknown threats. Our solution is designed to support a continuum of network security functions that span pre-attack hardening of assets, high fidelity attack identification and disruption and real-time compromise detection and incident response. In addition, our ability to confidently classify and prioritize threats in network traffic and determine the composition, behavior and relationships of network devices, or endpoints, allows us to reliably automate what are otherwise manual, time-intensive processes. For example, our Intrusion Sensor may trigger an alert upon identifying a Microsoft Windows-specific threat. The Defense Center would collect this alert, or security event, and classify and prioritize the event based upon a number of factors including, whether any other Intrusion Sensor generated the same alert, whether the network endpoints are vulnerable to that specific attack (based on intelligence collected by RNA Sensors and whether the threat is against a high-priority target (e.g., an e-commerce server). The response to any given security event is predicated upon this automated, real-time intelligent analysis and could range from no action (as in the case where the Defense Center has determined that the network or the individual asset is not vulnerable to the observed threat) to blocking the threat in real time, dynamically modifying firewall policy, and/or launching configuration management software to correct a vulnerability condition.
 
Comprehensive Network Intelligence.  Our innovative network security solution incorporates RNA, which provides persistent visibility into the composition, behavior, topology and risk profile of the network and serves as a platform for automated decision-making and network security policy enforcement. RNA performs passive, or non-disruptive, network discovery. This enables network behavior analysis and real-time compositional cataloging of network assets, including their configuration, thereby significantly increasing the network intelligence available to IT and security administrators. By integrating this contextual understanding of the network’s components and situational awareness of network events, our solution is effective across a broad range of security domains, especially in the area of threat identification and impact assessment. In the intrusion prevention and vulnerability


56


Table of Contents

management markets, we believe that our solution’s ability to gather this network intelligence has made our products difficult to evade, easy to tune or calibrate, and efficient, in terms of network performance as measured by aggregate throughput and latency reduction.
 
The Snort Community.  The Snort user community, with over 100,000 registered users and over 3 million downloads to date, has enabled us to establish a market footprint unlike any other in the industry. We believe that a majority of the Fortune 100 companies and all of the top 30 U.S. government agencies (as measured by total annual budgets) use Snort technology to monitor network traffic and that Snort is the most widely deployed intrusion prevention technology worldwide. We believe the Snort open source community provides us with significant benefits, including a broad threat awareness network, significant research and development leverage, and a large pool of security experts that are skilled in the use of our technology. The Snort user community enables us to cost-effectively test new algorithms and concepts on a vast number of diverse networks and significantly expedites the process of product innovation. We believe that Snort’s broad acceptance makes us one of the most trusted sources of intrusion prevention and related security solutions.
 
Leading-Edge Performance.  Our solutions are built to maintain high performance across the network while also providing high levels of network security. Specifically, our solutions have the ability to process multiple gigabits of traffic with latency as low as 100 microseconds. Our intrusion prevention technology incorporates advanced traffic processing functionality, including packet acquisition, protocol normalization and target-based traffic inspection, which yields increased inspection precision and efficiency and enables more granular inspection of network traffic. The Defense Center supports event loads as high as 1,300 events per second, which we believe meets or exceeds the requirements of the most demanding enterprise customers.
 
Significant Security Expertise.  We have a highly knowledgeable management team with extensive network security industry experience gained from past service in leading enterprises and government organizations including Symantec, McAfee, the Department of Defense and the National Security Agency. Our founder and CTO, Martin Roesch, invented Snort and the core RNA technology and is widely regarded as a network security visionary. In addition, our senior management team averages 16 years of experience in the networking and security industries. Our employees have authored all major components of the Snort source code and maintain the Snort project. In addition, our Vulnerability Research Team, or VRT, is comprised of highly experienced security experts who research new vulnerabilities and create innovative methods for preventing attempts to exploit them. By combining the strengths of our VRT with the tremendous breadth of the Snort community, we believe our aggregate industry knowledge places us at the leading edge of the network security industry.
 
Broad Industry Recognition.  We have received numerous industry awards and certifications including recognition as a “leader” in the network intrusion prevention systems market, supporting our position as one of a select few companies that best combines “completeness of vision” with “ability to execute.” RNA is one of only five network security products to receive the NSS Gold award, which is awarded by The NSS Group only to those products that are distinguished in terms of advanced or unique features, and which offer outstanding value. In addition, our technology has achieved Common Criteria Evaluation Assurance Level 2, or EAL2, which is an international evaluation standard for information technology security products sanctioned by, among others, the International Standards Organization, the National Security Agency and the National Institute for Standards and Technology.
 
Our Growth Strategy
 
We intend to become the preeminent provider of network security solutions on a global basis. The key elements of our growth strategy include:
 
Continue to Develop Innovative Network Security Technology.  We intend to maintain and enhance our technological leadership position in network security. We will continue to invest significantly in internal development and product enhancements and to hire additional network security experts to broaden our proprietary knowledge base. We believe our platform is capable of expanding into new markets such as unified threat management, security management, network behavior analysis and compliance and network management and, over time, we expect to penetrate these markets with innovative products and technologies.


57


Table of Contents

Grow Our Customer Base.  We have a substantial opportunity to grow our customer base as our products become more widely adopted. With over 3 million downloads of Snort and over 100,000 registered users, we believe Snort is the most ubiquitous network intrusion detection and prevention technology and represents a significant customer conversion and up-sell opportunity for Sourcefire. We seek to monetize the Snort installed base by targeting enterprises that implement Snort but have not yet purchased any of the components of our Sourcefire 3D security solution. We will continue to target large enterprises and government agencies that require advanced security technology and high levels of network availability and performance in sectors including finance, technology, healthcare, manufacturing and defense. Furthermore, we may attempt to create new customer conversion and up-sell opportunities by releasing select future product developments and enhancements under an open source licensing scheme, similar to the up-sell opportunities for our current products created by releasing Snort under the GNU General Public License.
 
Further Penetrate Our Existing Customer Base.  We believe our strong customer relationships provide us the opportunity to sell additional quantities of existing products and up-sell new products. Through December 31, 2006, over 1,300 customers have purchased our Intrusion Sensors and Defense Center products. We intend to sell additional Intrusion Sensors to existing customers and expand our footprint in the networks of our customers to include branch offices, remote locations and data centers. In addition, we believe we have a significant opportunity to up-sell our higher margin RNA product to existing customers because of the significant incremental benefit that increased network intelligence can bring to their security systems.
 
Expand Our OEM Alliances and Distribution Relationships.  We believe we have a significant opportunity to drive revenue growth through our OEM and distribution relationships. As part of our ongoing effort to expand our OEM alliances, we recently entered into a relationship with Nokia, Inc. whereby Nokia Enterprise Solutions will market to its enterprise customers network security solutions that utilize our proprietary software and technology. In addition, we seek to expand our strategic reseller agreements and increasingly use this channel to generate additional inbound customer prospects. For example, we have reseller agreements with True North Solutions, which has been acquired by American Systems Corporation, and Pentura Limited, a UK information technology security company, through which we expect to derive additional revenue growth in the future. We also intend to utilize our relationships with managed security service providers such as Verizon, VeriSign and Symantec, to derive incremental revenue. In 2006, we generated approximately 11% of our revenue from governmental organizations and, in the future, we believe we will generate an increasing amount of revenue from government suppliers such as Lockheed Martin, Northrop Grumman and Immix Technology, who resell our products to government agencies. In addition, we believe we have a significant opportunity to drive revenue growth by expanding our relationships with other network security vendors. For example, Crossbeam Systems, Inc. currently offers the Sourcefire 3D security solution as a blade, or server component, in its unified threat management appliance.
 
Strengthen Our International Presence.  We believe the network security needs of many enterprises located outside of North America are not being adequately served and represent a significant potential market opportunity. In 2006, we generated approximately 19% of our revenue from international customers. We have distribution agreements with several resellers having significant foreign presence, through which we now offer the Sourcefire 3D security solution. We are expanding our sales in international markets by adding distribution relationships and expanding our direct sales force, with plans in the next year to double the number of personnel in Europe and to hire a country manager for Japan. We believe that the addition of more sales personnel will lead to increased international sales.
 
Selectively Pursue Acquisitions of Complementary Businesses and Technologies.  To accelerate our expected growth, enhance the capabilities of our existing products and broaden our product and service offerings, we intend to selectively pursue acquisitions of businesses, technologies and products that could complement our existing operations. We continually seek to enhance and expand the functionality of our offerings and in the future we may pursue acquisitions that will enable us to better satisfy our customers’ rigorous and evolving network security needs. We currently have no plans, proposals or arrangements with respect to any specific acquisition.


58


Table of Contents

Products
 
Our key products consist of RNA Sensors, Intrusion Sensors and the Defense Center. When deployed in a customer’s network, these three products work together to produce an automated, unified intrusion prevention solution. The RNA Sensors and the Intrusion Sensors report network information and intelligence back to the central management center, known as the Defense Center. The Defense Center then aggregates, contextualizes, analyzes, prioritizes and acts on the event information generated by the RNA Sensors and the Intrusion Sensors. By aggregating the events from these sources, the Defense Center is designed to offer a comprehensive view of security events on a customer’s network and can identify suspicious activity that is undetectable through traditional intrusion detection/prevention products. While our customers can purchase and use the Intrusion Sensors without necessarily purchasing the Defense Center (as in the case where the customer is using a different kind of management console or where the customer can manage the sensor directly), a customer deploying an Intrusion Sensor without a corresponding Defense Center loses a significant amount of capability available when the products are used together.
 
Our approach to network security enables our customers to secure their networks by providing real-time defense against both known and unknown threats. For example, our Intrusion Sensor may trigger an alert upon identifying a Microsoft Windows-specific threat. The Defense Center would collect this alert, or security event, and classify and prioritize the event based upon a number of factors, including whether any other Intrusion Sensor generated the same alert, whether the network endpoints are vulnerable to that specific attack (based on intelligence collected by an RNA sensor) and whether the threat is against a high-priority target (e.g., an e-commerce server). The response to any given security event is predicated upon this automated, real-time intelligent analysis and could range from no action (as in the case where the Defense Center has determined that the network or the individual asset is not vulnerable to the observed threat) to blocking the threat in real time, dynamically modifying firewall policy, and/or launching configuration management software to correct a vulnerability condition.
 
 
Our products are generally sold as dedicated hardware appliances that are pre-configured with our proprietary network security technology, along with open source software, including Snort. By offering our products as turn-key solutions, our customers benefit from:
 
  •  Ease of Installation and Interoperability.  RNA and the Intrusion Sensors can be shipped to various locations, plugged in by any network or systems administrator and configured remotely, usually in less than 30 minutes, and are easy to install across geographically dispersed organizations. In addition, our products are typically interoperable with the diverse range of IT infrastructures used by our customers.
 
  •  Ease of Management and Maintenance.  Because our appliances are pre-configured with our proprietary technology, open source software, a secure operating system and a self-maintaining database, each appliance can be managed and maintained from a central console.


59


Table of Contents

 
  •  High Degree of Performance and Scalability.  Our products exhibit high levels of performance in network environments with line speeds of up to eight gigabits per second with latency as low as 100 microseconds, ideal for latency-sensitive services such as voice over internet protocol. Additionally, depending upon the volume of network traffic, the Defense Center can support up to 120 RNA Sensors and/or Intrusion Sensors, making the Sourcefire 3D security solution scalable for the most demanding customer environments. By way of comparison, a network that would require 120 RNA sensors would be one that is of significant size and complexity, and would be consistent with a network used by our largest customers. Additionally, multiple Defense Centers may be deployed on a single network.
 
In addition, RNA can be separately licensed as a standalone software solution for installation on a qualified Linux distribution environment (e.g., Red Hat Enterprise Linux).
 
We charge our customers a one-time, up-front fee for each of our appliances, which includes a perpetual license to use our proprietary technology installed on that appliance. We license the standalone software version of RNA based upon the number of nodes, or devices, on the network segment monitored by the software. We also charge our customers for annual maintenance and support, which includes the right to receive our VRT certified Rules and updates to the vulnerability database. The ability to receive up-to-date Rules and vulnerabilities is critical to the successful performance of the Sourcefire 3D security solution. Of the customer maintenance and support revenues up for renewal in the year ended December 31, 2006, we renewed approximately 82% of this value. Such services are typically paid for in advance, and recognized ratably as revenue over the period of the agreement.
 
As of December 31, 2006, the list prices of our Intrusion Sensors ranged from $3,995 to $119,500; the list prices for our RNA Sensors ranged from $1,195 to $11,995; the list prices for our RNA nodes ranged from $3 to $30; and the list prices for our Defense Center ranged from $16,995 to $41,995. Pricing for our products varies based on performance capabilities.
 
Real-Time Network Awareness, or RNA
 
RNA, available either as a software product or as an appliance, was invented to solve a very basic problem with traditional network security technologies: they have limited knowledge about the networks that they are defending. Even at the most basic level, firewalls, intrusion detection and prevention systems, patch management systems, vulnerability management systems and IT compliance solutions have limited knowledge about the assets and network they are protecting at any given point in time. Correspondingly, most of these enterprise network security technologies operate with little real-time information about composition, behavior or change within the network environment. As a result, these technologies are often blind to obvious critical security events and are unable to respond without human intervention.
 
As illustrated below, traditional intrusion prevention and detection technologies provide little automation and require IT professionals to manually perform event analysis and response. By incorporating network intelligence, the Sourcefire 3D security solution increases the amount of automated response to actionable and dismissible events, and reduces the number of security events requiring human analysis and response.
 
 
RNA Sensors are deployed at strategic points on the network to provide visibility into traffic passing that point. If RNA can observe the traffic of devices in the network, it can determine the operating system of those devices, the network, transport and application layer protocols (including tunneled protocols and protocols on non-standard ports) they are using, and the services and clients employed by those devices. Once RNA has gathered this information it can determine the topology of the network and the vulnerability state of any individual device.


60


Table of Contents

In addition to determining network behavior and device composition, RNA, coupled with the Defense Center, is capable of identifying potentially threatening or abnormal traffic that would be undetectable through traditional detection techniques and intrusion prevention products. RNA and the Defense Center accomplish this by collecting, aggregating and analyzing traffic ‘flow’ information. These flow records contain a wide variety of information about the observed network traffic, and anomalies in these flow records can be indicative of malicious or abnormal activity. The Defense Center uses this information to build models of ‘normal’ network traffic behavior. Divergence from traffic norms, especially when correlated with other network events, enables the Defense Center to identify and trigger responses to threats posed by unknown vulnerabilities, newly released exploits, worms, stealth scans, distributed denial of service and other attacks.
 
While RNA was originally invented to accumulate intelligence about the network environment and behavior, it has a number of other applications. For example, RNA can (i) inform network access control about device changes that are not compliant with network policy or user roles; (ii) drive real-time patch management by informing those systems of the presence and composition of network end-points; and (iii) inform vulnerability management systems of new hosts and their composition, enabling surgical scanning of those devices on a basis consistent with network security policy. Beyond network security, RNA is also proving to be beneficial in purely administrative tasks. For example, IT administrators use RNA inventory information to assist in asset and license management functions.
 
RNA 4.0, which we intend to release in the next several months, will allow customers to define and set compliance policies for endpoints, subnetworks or networks with the click of a mouse. Once defined, any change outside of policy would result in immediate notification followed by an array of possible corrective actions, including the sending of an alert, redirection of the asset into a ‘sandbox’ or quarantined network, blocking some or all traffic to or from the asset, and corrective measures such as patch and configuration management. RNA 4.0 will also include a sophisticated compliance dashboard that will allow administrators to monitor and report on compliance in real-time.
 
Intrusion Sensors
 
Intrusion Sensor appliances include proprietary Sourcefire components and open source Snort technology. They monitor network traffic and compare observed traffic to a set of Rules, or a set of network traffic characteristics, indicative of malicious activity. These Rules are created by our Vulnerability Research Team and are updated two to three times per month, depending on the rate that new vulnerabilities and/or exploits are discovered and disclosed. Once the Intrusion Sensors match a Rule to the observed traffic, they send an alert to the Defense Center for further analysis and prioritization.
 
The Intrusion Sensors can be used either as an intrusion prevention system, configured as an “in-line” solution, or as an intrusion detection system, passively monitoring traffic and providing alerts. The in-line configuration allows IT administrators to proactively and automatically protect their networks by, for example, blocking sessions containing malicious traffic. We offer several different models of Intrusion Sensors depending on the network traffic volume and inspection performance desired.
 
Defense Center
 
The Defense Center enables the central management of critical network security functions, including event monitoring, event correlation and prioritization, policy definition and enforcement, forensic analysis, network behavior analysis, trends analysis, management reporting, and system administration.
 
The Defense Center can also accept data from legacy Snort sensors, which are sensors built by a customer who has downloaded the open source Snort engine from www.snort.org.
 
The Defense Center, with its intuitive and easy-to-navigate web-based user interface, includes an integrated high performance database capable of correlating and analyzing events received from RNA Sensors, the Intrusion Sensors and/or Intrusion Agents in real-time to determine the:
 
  •  relevance of an event to a specific network asset;
 
  •  potential impact an event will have on the network asset; and
 
  •  criticality of an event based on the business sensitivity of the targeted network.


61


Table of Contents

 
Automated event prioritization allows IT administrators to focus their time and resources on real security events that represent the most critical threats based upon the customer’s actual, point-in-time network exposures and threats.
 
Designed to scale to virtually any size deployment, from remote site to global enterprise, the Defense Center’s data management solution is capable of handling extremely high event loads while also preserving those events for both high-level security trends analysis and in-depth forensic analysis down to the individual packet level. The forensic analysis interface features customizable workflows that enable users to tailor the graphical user interface to fit the way they prefer to monitor their networks and investigate and analyze security events. In addition, users can easily create standard or customized reports in PDF, HTML and CSV formats that can be automatically emailed for easy distribution.
 
The Defense Center also excels as an administrative platform. A flexible scheduling subsystem allows the automation of tasks including system backup, report generation, software update downloading, policy update downloading and the application of intrusion prevention policies. The Defense Center also supports high-availability deployment for management redundancy and dynamic load balancing of our Intrusion Sensors where required.
 
Services
 
Maintenance and Support.  We offer our customers ongoing product support services for both hardware and software. These maintenance programs are typically sold to customers for a one-year term at the time of the initial product sale and typically automatically renew for successive one-year periods. As part of our maintenance and support, we provide telephone and web-based support, documentation and software updates, error corrections and Rules and vulnerability updates. Additionally, we provide expedited replacement for any defective hardware under warranty.
 
The ability to receive an accurate and up-to-date set of Rules with which our sensors inspect network traffic is a part of our maintenance and support program. Because the sophistication and methods of attacks are constantly changing, our Vulnerability Research Team, or VRT, is continually crafting, refining and updating our set of Rules so that, when deployed, Intrusion Sensors can detect the most recently discovered vulnerabilities and exploits in addition to existing vulnerabilities and exploits. We typically release new and updated Rules two to three times per month; however, that rate can increase or decrease depending on the rate that new vulnerabilities and exploits are discovered and disclosed. Of the customer maintenance and support revenues up for renewal in the year ended December 31, 2006, we renewed approximately 82% of this value.
 
We make available all updates, upgrades, patches and new Rules to our customers through our web site. Our maintenance and support team is located at our corporate headquarters in Columbia, Maryland.
 
Professional Services and Training.  Our technical consultants assist our customers in the configuration of our appliances and software. These fee-based services, provided by our technical consultants, include providing advice on optimal sensor deployment strategies within the customer’s network, customization, or tuning of, Rules and configuration of appliances for the particular characteristics of the customer’s network. Additionally, we provide our customers with fee-based, hands-on training classes on subjects such as sensor deployment, Rule creation, tuning and configuration and security assessment. Our professional services and training are sold directly to our customers as well as indirectly through our resellers and can be delivered by our personnel or authorized training and service partners.
 
Technology
 
The Sourcefire 3D security solution provides our customers with a unified intrusion, vulnerability management and compliance enforcement capability. By combining the intelligence gathered by RNA and the Intrusion Sensor, along with the central management of the Defense Center, our customers can better prepare for, defend and remediate attacks on their networks.
 
Real-time Network Awareness.  RNA acquires intelligence about the network passively; that is, it listens to network traffic to determine the key characteristics of the devices on the network. For example, by watching the


62


Table of Contents

creation and termination of a transmission control protocol, or TCP, connection, RNA can determine, among other things, the operating systems and versions running on the devices communicating with each other, as well the identity of those devices, or their IP addresses. Active network discovery, by contrast, works by sending out probative traffic in order to stimulate a response from accessible devices. It then interprets the responses so that it can draw conclusions about those devices. Because active scanners rely on a “pinging” model of stimulus and response, they are “noisy,” have the potential to disrupt or degrade overall network performance, and sometimes disturb the potentially sensitive assets that they seek to interrogate. RNA’s passive network discovery methods do not generate traffic on the network and are designed not to disrupt or degrade network performance.
 
Once RNA has established a host profile for a specific device, it will update that profile dynamically as it observes traffic to or from that device. The types of information that could be updated include routing changes, new services, new protocols on existing service ports, OS vendor or version changes, changed hop count to the device, and changed vendor and version data of services.
 
In addition to determining network and device composition, RNA, coupled with the Defense Center, is capable of identifying traffic anomalies. RNA and the Defense Center accomplish this by collecting, aggregating and analyzing traffic flow information. These flow records can contain a wide variety of information about the observed network traffic, including a timestamp for the flow start and finish time, the number of bytes and packets observed in the flow, their sequence, the flow’s source and destination IP addresses, source and destination port numbers, IP protocol, the application layer protocol and, in the case of TCP flows, all TCP flags observed over the life of the flow. The Defense Center leverages this information to build models of ‘normal’ network traffic behavior. Divergence from traffic norms, especially when correlated with other network events, can enable critical protection against threats posed by unknown vulnerabilities, newly released exploits, “zero-learning” worm detection, stealth scans, and fine-grained distributed denial of service attacks, as well as network system malfunctions and misconfigurations.
 
Defense Center.  The Defense Center is a high performance management system suited for large, complex and distributed enterprise networks. It simplifies the complicated issues usually associated with intrusion detection and prevention deployments by incorporating policy management, data aggregation, correlation, analysis and reporting into a single centralized solution that enables our customers to take advantage of a distributed sensor infrastructure. The Defense Center is delivered with a built-in high performance database capable of handling millions of events and supporting in-depth forensic analysis for identification of both discrete occurrences and long-term security trends. Packaged as a complete, preconfigured system and including an intuitive, efficient interface, the Defense Center is easy to install and easy to use on a daily basis.
 
 
The Defense Center also allows IT administrators to build customized policies that combine threat, network and vulnerability management, so that IT administrators can define responses in advance to anomalous observations, including any combination of alerting, blocking or correcting the non-normal condition. Examples include alerting via email, Simple Network Management Protocol, or SNMP, traps or SYSLOG events, blocking by dynamically modifying router, firewall, switch, or IPS policies, and correcting via interaction with trouble ticketing,


63


Table of Contents

patch management, or configuration management systems. For maximum flexibility, the Defense Center provides a fully documented remediation application programming interface, or API, that allows the creation of customized responses with third-party technologies.
 
We also separately license a visualization module to the Defense Center that provides our customers a real-time map of their network using the intelligence gathered by RNA. This visualization module provides a unique, intuitive graphical interface for IT professionals to manage their network assets and enforce policy compliance.
 
Intrusion Sensors.  The Intrusion Sensors are sold as turn-key networking appliances that are composed of highly optimized proprietary Sourcefire components and open source Snort technology. The Intrusion Sensor’s threat detection algorithms are governed by a rules-based language that combines the benefits of signature, protocol and anomaly-based inspection methods. The highly flexible Snort rules language also allows administrators to write their own custom rules or to tailor existing rules to their specific networking environment. Once the Intrusion Sensor matches observed traffic with one of the many Rules deployed on the Intrusion Sensor, an alert is generated and sent to the Defense Center for additional analysis and prioritization.
 
Awards and Certifications.  We have received numerous industry awards and certifications, including:
 
  •  Gartner Magic Quadrant.  We were recognized by Gartner, Inc. as being a “Leader” in the Network Intrusion Prevention System Appliances category.
 
  •  NSS Gold Award.  Our product is one of only five network security products to be awarded the NSS Gold award. NSS is a world leader in benchmarking and independent product evaluations, and the NSS Gold Award is awarded only to those products that are distinguished in terms of advanced or unique features, and which offer outstanding value.
 
  •  EAL2.  Common Criteria Evaluation Assurance Level 2 is an international evaluation standard for information technology security products sanctioned by, among others, the International Standards Organization, the National Security Agency and the National Institute for Standards and Technology.
 
  •  National Security Agency Systems and Network Attack Center.  We have met the classified testing standards of the National Security Agency Systems and Network Attack Center, which are required in order to sell security products to certain agencies of the U.S. Government.
 
  •  DISA FAO STIG.  We have met the classified testing standards of the Defense Information Security Agency, Finance and Accounting Office — Security Technical Implementation Guide, which are required in order to sell security products to certain agencies of the U.S. Government.
 
  •  FIPS 140-2.  Federal Information Processing Standard 140-2 is a standard that describes US Federal government requirements that IT products should meet for Sensitive, but Unclassified, or SBU, use. The standard was published by the National Institute of Standards and Technology (NIST). FIPS 140-2 evaluation is required for sale of products implementing cryptography to the Federal Government. In addition, the financial community increasingly specifies FIPS 140-2 as a procurement requirement and is beginning to embrace it.
 
  •  NEBS.  Network Equipment-Building System requirements are used by service providers to qualify equipment that will provide a high level of reliability and safety to their network. These requirements are designed to ensure that products are safe and do not interfere with the reliable operation of a network. NEBS compliance is a critical issue to service providers evaluating the suitability of products for use in their networks.
 
  •  OSEC.  Open Security Evaluation Criteria is a framework for evaluating the security functionality of networked products. OSEC defines a core set of tests for any networked security product, and then adds tests for security and performance to each product space, such as network intrusion detection systems. OSEC criteria are open to view and critique, and are formulated with input from vendors, end-users, and many representatives from the security community that actively work in the product spaces for which criteria have been developed.


64


Table of Contents

 
Customers
 
We provide products and services to a variety of end users worldwide, including some of the world’s largest banks, defense contractors, hospitals, IT companies and retailers, as well as U.S. and other national, state and local government agencies. We view our primary customers as enterprise, service provider and risk management enterprises, but we have also developed products and services for the consumer and small office market. Our enterprise market customers generally have annual revenue exceeding $500 million.
 
In 2003, Northrop Grumman, a federal government reseller, accounted for 15% of our revenues. In 2004, Immix Technologies, a federal government reseller, accounted for 10% of our revenues. In 2005 and 2006, no customer accounted for over 10% of our revenues. If we failed to retain either Northrop Grumman or Immix Technologies as a reseller customer, we believe that we would find another federal government reseller through which we could sell our products. Our customers represent a broad spectrum of organizations within diverse sectors, including financial services, technology, telecommunications and government and information technology services.
 
For the years ended December 31, 2005 and 2006, we generated approximately 82% and 81% of our revenue from customers in the United States and approximately 18% and 19% from customers outside of the United States, respectively.
 
Sales and Marketing
 
We market and sell our appliances, software and services directly to our customers through our direct sales organization and indirectly through our resellers, distributors and original equipment manufacturers.
 
Sales.  As of December 31, 2006, our sales organization was comprised of approximately 75 full-time individuals organized into two groups: North America and International. We maintain sales offices in Columbia, Maryland; Vienna, Virginia; Livonia, Michigan; and Reading, United Kingdom. As of December 31, 2006, our international sales force was made up of 17 individuals, and our North America sales force was made up of 58 individuals divided into three geographic regions: East, West and Federal. Our sales personnel are responsible for market development, including managing our relationships with resellers, assisting resellers in winning and supporting key customer accounts and acting as liaisons between the end customers and our marketing and product development organizations. We expect to continue to expand our International direct sales group in Europe, the Middle East, Asia/Pacific and Latin America. We are expanding our sales in international markets by adding distribution relationships and expanding our direct sales force, with plans in the next year to double the number of personnel in Europe and to hire a country manager for Japan.
 
Each sales organization is supported by experienced sales engineers who are responsible for providing pre-sales technical support and technical training for the sales team and for our resellers and distributors. All of our sales personnel are responsible for lead follow-up and account management. Our sales personnel have quota requirements and are compensated with a combination of base salary and earned commissions.
 
Our indirect sales channel, comprised primarily of resellers and distributors, is supported by our dedicated sales force with broad experience in selling network security products to resellers. We maintain a broad network of value-added resellers throughout the United States and Canada, and distributors in Europe, Latin America and Asia/Pacific. Our arrangements with our resellers are non-exclusive, territory-specific, and generally cover all of our products and services and provide for appropriate discounts based on a variety of factors including volume purchases. These agreements are generally terminable at will by either party by providing the other party at least 90 days written notice. Our arrangements with distributors also are non-exclusive and territory-specific and provide distributors with discounts based upon the annual volume of their orders. We provide our resellers and distributors with marketing assistance, technical training and support.
 
Strategic Relationships.  We have established commercial relationships with networking and security companies to provide alternative distribution channels for our products.
 
We executed an OEM agreement with Nokia Inc. on July 14, 2006 under which Nokia is permitted to incorporate our RNA and Intrusion Sensor technology into Nokia Enterprise Solutions hardware platform for direct


65


Table of Contents

and indirect sales to its enterprise customers. In addition, Nokia has the ability to resell the Defense Center. This agreement expires on July 14, 2009. We have no other relationship with Nokia, other than this OEM agreement and there exists no material dependencies on Nokia.
 
Marketing.  Our marketing activity consists primarily of product marketing, product management and sales support programs. Marketing also includes advertising, our Web site, trade shows, direct marketing and public relations. Our marketing program is designed to build the Sourcefire and Snort brands, increase customer awareness, generate leads and communicate our product advantages. We also use our marketing program to support the sale of our products through new channels and to new markets. We have eight full-time employees in our marketing department.
 
Research and Development
 
Our research and development efforts are focused primarily on improving and enhancing our existing network security products as well as developing new features and functionality. We communicate with our customers and the open source community when considering product improvements and enhancements, and we regularly release new versions of our products incorporating these improvements and enhancements.
 
Vulnerability Research Team.  Our Vulnerability Research Team is a group of leading edge network security experts working to proactively discover, assess and respond to the latest trends in network threats and security vulnerabilities. By gathering and analyzing this information, our Vulnerability Research Team creates and updates Snort Rules and security tools that are designed to identify, characterize and defeat attacks.
 
This team comprises eight full time employees and operates from our corporate headquarters in Columbia, Maryland. Our Vulnerability Research Team participates in extensive collaboration with hundreds of network security professionals in the open source Snort community to learn of new vulnerabilities and exploits. The Vulnerability Research Team also coordinates and shares information with other security authorities such as The SANS Institute, CERT-CC (Computer Emergency Response Team), iDefense (Verisign), SecurityFocus (Bugtraq; Symantec) and Common Vulnerabilities and Exposures (Mitre). Because of the knowledge and experience of our personnel comprising the Vulnerability Research Team, as well as its extensive coordination with the open source community, we believe that we have access to one of the largest and most sophisticated groups of IT security experts researching vulnerability and threats on a real-time basis.
 
As of December 31, 2006, we had approximately 55 employees dedicated to research and development. Our research and development expense was $5.7 million, $6.8 million and $8.6 million for the years ended December 31, 2004, 2005 and 2006, respectively.
 
Manufacturing and Suppliers
 
We rely primarily on contract equipment manufacturers to assemble, integrate and test our appliances and to ship those appliances to our customers. We typically hold little inventory, relying instead on a just-in-time manufacturing philosophy. We rely on four primary integrators. We have contracted with Avnet, Inc., a leading distributor of enterprise network and computer equipment, to manufacture all of our appliances built on IBM hardware. Avnet is our sole supplier of IBM-based hardware appliances. We have also contracted with Patriot Technologies, Inc. and Intelligent Decisions Inc., or IDI, to assemble, integrate and test all our product offerings operating on an Intel platform. Our agreement with Patriot expires on December 12, 2007, and will automatically renew for successive one year periods unless either we or Patriot notify the other of an intent not to renew at least 90 days prior to expiration. We entered into a conditional purchase commitment with Patriot pursuant to which we have agreed to purchase a set quantity of new appliance inventory over an 18-month period provided that the new appliance meets certain specifications on or before November 15, 2006. The approximate value of the purchase commitment is $800,000. Our agreement with IDI expires on January 31, 2008 and will automatically renew unless either party notifies the other party of its intent not to renew at least 30 days prior to the end of the term. Finally, we have contracted with Bivio Networks, Inc. to manufacture select high performance models of our appliances. Bivio is our sole supplier of these high performance models, such as our IS3800 and IS5800, which are the highest priced Intrusion Sensors that we offer. Our agreement with Bivio expires on February 10, 2008. All of these agreements are


66


Table of Contents

non-exclusive. We would be faced with the burden, cost and delay of having to qualify and contract with a new supplier if any of these agreements terminate or expire for any reason.
 
Intellectual Property
 
To protect our intellectual property, both domestically and abroad, we rely primarily on patent, trademark, copyright and trade secret laws. As of the date hereof we had 25 patent applications pending for examination in the U.S. and foreign jurisdictions. We currently hold no issued patents. The claims for which we have sought patent protection relate to methods and systems we have developed for intrusion detection and prevention used in our RNA, Intrusion Sensor and Defense Center products. In addition, we utilize contractual provisions, such as non-disclosure and non-compete agreements, as well as confidentiality procedures to strengthen our protection.
 
Despite our efforts to protect our intellectual property, unauthorized parties may attempt to copy aspects of our products or obtain and use information that we regard as proprietary. While we cannot determine the extent to which piracy of our software products occurs, we expect software piracy to be a persistent problem. In addition, the laws of some foreign countries do not protect our proprietary rights to as great an extent as do the laws of the United States and many foreign countries do not enforce these laws as diligently as U.S. government agencies and private parties.
 
Seasonality
 
Our business is subject to seasonal fluctuations. For a discussion of seasonality affecting our business, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Seasonality.”
 
Competition
 
The market for network security monitoring, detection, prevention and response solutions is intensely competitive and we expect competition to increase in the future. Our chief competitors generally fall within the following categories:
 
  •  large companies, including Symantec Corporation, Cisco Systems, Inc., Internet Security Systems, Inc. (which has recently been acquired by IBM), Juniper Networks, Inc., 3Com Corporation, Check Point Software Technologies, LTD and McAfee, Inc., that sell competitive products and offerings, as well as other large software companies that have the technical capability and resources to develop competitive products;
 
  •  software or hardware network infrastructure companies, including Cisco Systems, Inc., 3Com Corporation and Juniper Networks, Inc., that could integrate features that are similar to our products into their own products;
 
  •  smaller software companies offering relatively limited applications for network and Internet security monitoring, detection, prevention or response; and
 
  •  small and large companies offering point solutions that compete with components of our product offerings.
 
Mergers or consolidations among these competitors, or acquisitions of our competitors by large companies, present competitive challenges to our business. For example, Symantec Corporation, Cisco Systems, Inc., McAfee, Inc., 3Com Corporation and Juniper Networks, Inc. have acquired during the past several years smaller companies, which have intrusion detection or prevention technologies and Internet Security Systems, Inc. has recently been acquired by IBM. These acquisitions will make these combined entities potentially more formidable competitors to us if such products and offerings are effectively integrated. Large companies may have advantages over us because of their longer operating histories, greater brand name recognition, larger customer bases or greater financial, technical and marketing resources. As a result, they may be able to adapt more quickly to new or emerging technologies and changes in customer requirements. They also have greater resources to devote to the promotion and sale of their products than us. In addition, these companies have reduced and could continue to reduce, the price of their security monitoring, detection, prevention and response products and managed security services, which intensifies pricing pressures within our market.
 
Several companies currently sell software products (such as encryption, firewall, operating system security and virus detection software) that our customers and potential customers have broadly adopted. Some of these


67


Table of Contents

companies sell products that perform the same functions as some of our products. In addition, the vendors of operating system software or networking hardware may enhance their products to include functions similar to those that our products currently provide.
 
We believe that the principal competitive factors affecting the market for information security solutions include security effectiveness, manageability, technical features, performance, ease of use, price, scope of product offerings, professional services capabilities, distribution relationships and customer service and support. We believe that our solutions generally compete favorably with respect to such factors.
 
Properties
 
Our principal executive offices are located in Columbia, Maryland. We also lease sales offices in Vienna, Virginia; Livonia, Michigan; and Wokingham, United Kingdom. Our lease in Columbia, Maryland expires on May 31, 2010; our lease in Vienna, Virginia expires on January 31, 2012; our lease in Livonia, Michigan expires on August 31, 2008; and our lease in Wokingham, United Kingdom expires on January 24, 2012. We believe that our facilities are generally suitable to meet our needs for the foreseeable future; however, we will continue to seek additional space as needed to satisfy our growth.
 
Employees
 
As of December 31, 2006, we had 182 employees, of whom 55 were engaged in product research and development, 84 were engaged in sales and marketing, 11 were engaged in customer service and support, 7 were engaged in professional services and 25 were engaged in administrative functions. Our current employees are not represented by a labor union and are not the subject of a collective bargaining agreement. We believe that we have good relations with our employees.
 
Legal Proceedings
 
On April 25, 2006, we were served with a complaint filed by PredatorWatch, Inc. (a.k.a. NetClarity) in the Superior Court of Suffolk County, Massachusetts. The plaintiff alleges that we and Martin F. Roesch, our Chief Technology Officer, together with Inflection Point Associates, L.P., the general partner of one of our stockholders, Inflection Point Ventures, L.P.: (i) misappropriated its trade secrets; (ii) breached an oral agreement of confidentiality; (iii) breached a covenant of good faith and fair dealing owed to the plaintiff; (iv) were unjustly enriched; (v) misrepresented certain material facts to the plaintiff upon which the plaintiff relied to its detriment; and (vi) engaged in unfair and deceptive acts in violation of Massachusetts state law. The plaintiff has sought to recover amounts to be ascertained and established, as well as double and treble damages and attorneys’ fees.
 
On May 22, 2006, we answered the plaintiff’s complaint and denied each and every count contained in the plaintiff’s complaint. As of December 31, 2006, the parties are in the process of conducting discovery and no trial date has been set. The court has scheduled a hearing on our motion for summary judgment in mid-April 2007. We have not recorded any reserve in our financial statements for potential liability for legal fees in connection with this suit. We intend vigorously to defend against the plaintiff’s case.
 
Additionally, PredatorWatch has separately notified us that it believes that our RNA technology and 3D security solution are covered by claims contained in its pending patent application. This pending patent application has not issued as a patent, but in the event it does issue, PredatorWatch could file an additional complaint to include a patent infringement claim against us.
 
From time to time, we may be involved in other disputes or litigation relating to claims arising out of our operations. However, we are not currently a party to any other material legal proceedings.


68


Table of Contents

 
MANAGEMENT
 
Directors and Executive Officers
 
The following table sets forth information concerning our directors, executive officers and other key members of our management team as of December 31, 2006:
 
             
Name
  Age    
Position
 
E. Wayne Jackson, III
    45     Chief Executive Officer and Chairman of the Board of Directors
Martin F. Roesch
    37     Chief Technology Officer and Director
Thomas M. McDonough
    52     President and Chief Operating Officer
Todd P. Headley
    44     Chief Financial Officer and Treasurer
Michele M. Perry-Boucher
    45     Chief Marketing Officer
Joseph M. Boyle
    40     General Counsel and Secretary
Thomas D. Ashoff
    45     Vice President of Engineering
John T. Czupak
    44     Vice President of International Sales and Business Development
John G. Negron
    43     Vice President of North American Sales
Asheem Chandna(2)(3)
    42     Director
Joseph R. Chinnici(1)(3)(4)
    52     Director
Tim A. Guleri(1)(2)
    41     Director
Steven R. Polk(2)(3)
    59     Director
Arnold L. Punaro(1)(5)
    60     Director
Harry R. Weller(1)(2)
    37     Director
 
(1) Member of our audit committee.
(2) Member of our compensation committee.
(3) Member of our nominating and governance committee.
(4) Mr. Chinnici also acts as our lead outside director.
(5) General Punaro joined our board of directors in January 2007.
 
Executive Officers
 
E. Wayne Jackson, III, Chief Executive Officer and Chairman of the Board of Directors
 
E. Wayne Jackson, III joined us in May 2002 as our Chief Executive Officer and a director. He was appointed Chairman of our Board of Directors in October 2006. Before joining Sourcefire, Mr. Jackson was a private investor from September 2001 until May 2002. Prior to that, Mr. Jackson co-founded Riverbed Technologies, Inc., a wireless infrastructure company, served as its CEO from January 1999 until the sale of the company to Aether Systems Inc. for more than $1.0 billion in March 2000 and continued as an employee of Aether Systems as Managing Director of Aether Capital until September 2001. Previously, Mr. Jackson built an emerging technologies profit center for Noblestar Systems Inc., a large systems integrator, and consulted to organizations including General Electric, the World Bank and the Federal Reserve. Mr. Jackson holds a B.B.A. in Finance from James Madison University.
 
Martin F. Roesch, Chief Technology Officer and Director
 
Martin F. Roesch founded Sourcefire in 2001 and served as our President and Chief Technology Officer until September 2002, since which time he has continued to serve as our Chief Technology Officer. Mr. Roesch is responsible for our technical direction and product development efforts. Mr. Roesch, who has 16 years of industry experience in network security and embedded systems engineering, is also the author and lead developer of the Snort Intrusion Prevention and Detection System that forms the foundation for the Sourcefire 3D System. Over the past ten years, Mr. Roesch has developed various network security tools and technologies, including intrusion prevention and detection systems, honeypots, network scanners and policy enforcement systems for organizations


69


Table of Contents

such as GTE Internetworking and Stanford Telecommunications, Inc. Mr. Roesch holds a B.S. in Electrical and Computer Engineering from Clarkson University.
 
Thomas M. McDonough, President and Chief Operating Officer
 
Thomas M. McDonough joined us in September 2002 as our President and Chief Operating Officer and is our executive officer in charge of sales. Before joining Sourcefire, Mr. McDonough was the Chief Executive Officer of Mountain Wave, Inc., an information security company, from March 2002 until September 2002, which was acquired by Symantec Corporation in July 2002. Prior to that, Mr. McDonough was Senior Vice President of Worldwide Sales for Riverbed Technologies from February 2000 until March 2000, when it was acquired by Aether Systems. He then served as the Senior Vice President of Worldwide Sales for Aether Systems until March 2002. Previously, Mr. McDonough spent six years with Axent Technologies, Inc. as Vice President of North American Sales and Professional Services. That company was acquired by Symantec Corporation in December 2000 for $960 million. Mr. McDonough holds a B.A. in Economics and an M.B.A. from the University of Notre Dame.
 
Todd P. Headley, Chief Financial Officer and Treasurer
 
Todd P. Headley joined us in April 2003 and serves as our Chief Financial Officer and Treasurer. Prior to joining Sourcefire, Mr. Headley was CFO for BNX Corporation, a network access management company, from September 2001 until April 2003. Prior to BNX, Mr. Headley served as CFO for FBR Technology Venture Partners, a Virginia-based venture capital firm, from September 2000 until May 2001. Mr. Headley served as Chief Financial Officer of Riverbed Technologies, a wireless infrastructure company, from March 1999 until its acquisition by Aether Systems in March 2000. Mr. Headley continued with Aether Systems until June 2000, where he was engaged in various business development and integration activities. Mr. Headley also served as Controller at POMS Corporation, a manufacturing supply chain execution company, from February 1998 until February 1999 and as Vice President and Controller of Roadshow International, Inc., a supply chain execution company, from April 1992 until February 1998. Mr. Headley began his career at Arthur Andersen in 1985 as an auditor. Mr. Headley is a C.P.A. and holds a B.S. in accounting from Virginia Polytechnic Institute and State University.
 
Michele M. Perry-Boucher, Chief Marketing Officer
 
Michele M. Perry-Boucher joined us in March 2004 and serves as our Chief Marketing Officer. From September 2001 until joining Sourcefire, Ms. Perry-Boucher operated her own strategic marketing and business development consultancy, MPB Strategies, which specialized in providing consulting and strategy services to fast growing companies. Previously, Ms. Perry-Boucher was Senior Vice President, Marketing at USinternetworking, Inc. from July 1998 until June 2001. Additionally, Ms. Perry-Boucher held senior marketing and management positions at Versatility Inc. (acquired by Oracle Corporation) from February 1997 to June 1998 and Software AG from January 1992 until January 1997. Ms. Perry-Boucher holds a B.S. from the University of Pennsylvania (Wharton School) and an M.B.A. from Harvard Business School.
 
Joseph M. Boyle, General Counsel and Secretary
 
Joseph M. Boyle joined us in April 2006 and serves as our General Counsel and Secretary. Prior to joining us, Mr. Boyle was in private practice from February 2005 until April 2006 where he focused on representing entrepreneurs, start-ups, emerging growth and technology companies. Mr. Boyle acted as the Chief of Staff to the Director of the National Cyber Security Division within the Department of Homeland Security’s Information Assurance and Infrastructure Protection Directorate from February 2004 to February 2005. From September 2001 until February 2004, Mr. Boyle served as general counsel to Riptech, Inc., an Alexandria, Virginia based managed security service provider, which was acquired by Symantec Corporation in August 2002. Prior to joining Riptech, Mr. Boyle served from April 1998 until September 2001 as general counsel to Cysive, Inc., a Reston, Virginia based IT professional services firm. Prior to Cysive, Mr. Boyle was in private practice focusing on private equity, mergers and acquisitions and corporate securities. Mr. Boyle holds a B.S. in Mechanical Engineering from the University of Detroit and received his J.D. from the University of Michigan. He is admitted to practice law in the Commonwealth of Virginia and the District of Columbia.


70


Table of Contents

Other Key Members of Management
 
Thomas D. Ashoff, Vice President of Engineering
 
Thomas D. Ashoff joined us in April 2003 as Vice President of Engineering. Prior to joining Sourcefire, Mr. Ashoff worked for Network Associates Inc. (now McAfee Inc.) in a number of capacities from April 1998 until February 2003. At Network Associates, Mr. Ashoff was Vice President, Strategic Product Engineering in the Technology Research Division as well as Vice President of Engineering for Network Associates’ PGP Security business unit. Mr. Ashoff joined Network Associates in 1998 when it acquired Trusted Information Systems (TIS). At TIS, Mr. Ashoff was the Senior Development Manager for the Gauntlet Firewall and VPN products. Prior to TIS, Mr. Ashoff developed software for GTE Spacenet/Contel ASC from 1988 to June 1994. Mr. Ashoff also provided consultancy services to the National Security Agency (NSA) through HRB Singer, Inc. from 1985 until 1988 and was employed by the NSA from 1982 until 1985. Mr. Ashoff holds a B.S. in Computer Science from the University of Pittsburgh.
 
John T. Czupak, Vice President of International Sales and Business Development
 
John T. Czupak joined us in October 2002 and serves as our Vice President of International Sales and Business Development. Before joining us, Mr. Czupak was the Senior Vice President of Worldwide Sales for Mountain Wave, Inc., an information security company, from October 2001 until October 2002, which was acquired by Symantec Corporation in July 2002. Prior to joining Mountain Wave, Mr. Czupak was the Director of International Operations for Riverbed Technologies from December 1999 until March 2000. He subsequently became the General Manager, Europe, Middle East & Asia for Aether Systems, Inc., after Aether acquired Riverbed Technologies in March 2000, and served in that position until October 2001. Previously, Mr. Czupak was with Axent Technologies, Inc., an Internet security company, where he was Vice President of Asia, Pacific & Latin America from August 1994 until December 1999. Mr. Czupak holds a B.S. in Marketing from Towson State University and an M.B.A. from the University of Maryland.
 
John G. Negron, Vice President of North American Sales
 
John G. Negron joined us in July 2002 and serves as Vice President of North American Sales. Before joining us, from December 2001 until May 2002, Mr. Negron was Vice President of Sales and Marketing at mindShift Technologies, Inc. Mr. Negron joined Riverbed Technologies in February 2000 as Director of Sales and continued to serve in that capacity following its acquisition by Aether Systems in March 2000, until October 2001. He also served as Director of Sales for Aether Systems’ Enterprise Vertical when Aether acquired Riverbed in March 2000. From September 1994 until January 2000, Mr. Negron was employed by Axent Technologies, an internet security software company, where he directed the company’s penetration into the public sector. Mr. Negron also held multiple domestic and international sales management roles at SunGard Data Systems Inc. from August 1985 until September 1991 which provided software and services in the disaster recovery segment of the security industry. Mr. Negron holds a B.S. from Bentley College.
 
Directors
 
Asheem Chandna, Director
 
Asheem Chandna joined our board of directors in May 2003 and is currently a partner with Greylock Partners, a venture capital firm. Prior to joining Greylock in September 2003, Mr. Chandna was with Check Point Software Technologies Ltd. from April 1996 until December 2002 where he was Vice-President of Business Development and Product Management. Prior to Check Point, Mr. Chandna was Vice-President of Marketing with CoroNet Systems from October 1994 to November 1995 and was with Compuware Corporation from November 1995 to April 1996, following Compuware’s acquisition of CoroNet. Previously, Mr. Chandna held strategic marketing and product management positions with SynOptics/Bay Networks from June 1991 to October 1994 and consulting positions with AT&T Bell Laboratories from September 1988 to May 1991. Mr. Chandna currently serves on the board of directors of several privately held companies including Imperva Inc., Palo Alto Networks, PortAuthority Technologies, Inc. and Securent, Inc.. He previously served on the board of directors at CipherTrust, Inc. (acquired


71


Table of Contents

by Secure Computing Corporation) and NetBoost Inc. (acquired by Intel Corporation). Mr. Chandna holds B.S. and M.S. degrees in electrical and computer engineering from Case Western Reserve University in Cleveland, Ohio.
 
Joseph R. Chinnici, Director
 
Joseph R. Chinnici joined our board of directors in July 2006. He was appointed our lead outside director in February 2007. Mr. Chinnici has served as Senior Vice President, Finance and Chief Financial Officer at Ciena Corporation since August 1997, and was previously Vice President, Finance and Chief Financial Officer from May 1995 to August 1997. Mr. Chinnici served previously as Controller since joining Ciena in September 1994. From 1993 through 1994, Mr. Chinnici served as a financial consultant for Halston Borghese Inc. From 1977 to 1993, Mr. Chinnici held a variety of accounting and finance assignments for Playtex Apparel, Inc. (now a division of Sara Lee Corporation), ending this period as Director of Operations Accounting and Financial Analysis. Mr. Chinnici serves on the board of directors for Brix Networks, Inc. He holds a B.S. degree in accounting from Villanova University and an M.B.A. from Southern Illinois University.
 
Tim A. Guleri, Director
 
Tim A. Guleri joined our board of directors in June 2002 and is currently a Managing Director with Sierra Ventures. Before joining Sierra Ventures in February 2001, Mr. Guleri was the Vice Chairman and Executive Vice President with Epiphany, Inc. from March 2000 until February 2001; the Chairman, CEO and Co-founder of Octane Software Inc. from September 1997 until March 2000; Vice President of Field Operations, Product Marketing with Scopus Technology Inc. from February 1992 until February 1996 and was part of the information technology team with LSI Logic Corporation from September 1989 until September 1991. He has been a director of: Octane Software from 1997 to 2000 (Sold to Epiphany in 2000); Net6, Inc. from March 2001 to March 2004 (acquired by Citrix Systems, Inc. in 2004); Approva, Inc. since April 2005; Spoke Software, Inc. since July 2002; CodeGreen Networks, Inc. since March 2005; AIRMEDIA, Inc. since April 2005; Steelbox Networks Inc. since 2006; and Everest, Inc. since October 2003. Mr. Guleri holds a B.S. in Electrical Engineering from Punjab Engineering College, India and an M.S. in Engineering and Operational Research from Virginia Tech.
 
Lt. Gen. Steven R. Polk (ret.), Director
 
Lt. Gen. Steven R. Polk joined our board of directors in August 2006. General Polk was the Inspector General of the Air Force, Office of the Secretary of the Air Force, Washington, D.C., from December 2003 until he retired on February 1, 2006. While at the Air Force, General Polk oversaw Air Force inspection policy, criminal investigations, counterintelligence operations, intelligence oversight, complaints, and fraud, waste and abuse programs and was also responsible for two field operating agencies — the Air Force Inspection Agency and Air Force Office of Special Investigations. Prior to this assignment, he was Vice Commander, Pacific Air Forces from March 2002 to November 2003 and Commander, 19th Air Force, Air Education and Training Command from May 1999 to March 2002. Staff appointments included Director of Operations at Headquarters Pacific Air Forces and Assistant Chief of Staff for Operations at Headquarters Allied Air Forces Northwestern Europe, NATO, as well as duty at Headquarters U.S. Air Forces in Europe and Headquarters U.S. Air Force. General Polk graduated and was commissioned from the U.S. Air Force Academy in June 1968 with a B.S. in aeronautical engineering. In 1974, he received an M.S. in engineering from Arizona State University, Tempe and in 1988 he received an M.A. in national security and strategic studies from Naval War College, Newport, R.I.
 
Maj. Gen. Arnold L. Punaro (ret.), Director
 
Maj. Gen. Arnold L. Punaro joined our board of directors in January 2007 and is currently Executive Vice President, Government Affairs, Communications and Support Operations and General Manager of Washington Operations for Science Applications International Corporation, or SAIC. He is also a member of the Secretary of Defense Gates’ Defense Business Board and is currently chairing the Statutory Commission on the National Guard and Reserves. Prior to joining SAIC in 1997, General Punaro worked for Senator Sam Nunn on national security matters from 1973 to 1997. During that time, General Punaro served as Senator Nunn’s director of national security affairs and as staff director of the Senate Armed Services Committee. General Punaro served as the director of the Marine Corps Reserve from May 2001 until his retirement in October 2003. General Punaro also served as deputy


72


Table of Contents

commanding general, Marine Corps Combat Development Command (Mobilization) from August 2000 until May 2001, and as the commanding general of the 4th Marine Division headquartered in New Orleans, Louisiana from 1997 to 2000. Prior to joining SAIC, General Punaro served on active duty as an infantry platoon commander in Vietnam where he was awarded the Bronze Star for valor and the Purple Heart. As a reserve officer, he has served in Operation Desert Shield in Saudi Arabia in December 1990, Joint Task Force Provide Promise (Forward) in the former Yugoslavia in December 1993, Operation Enduring Freedom and Operation Iraqi Freedom in May 2003 and has served as both the Headquarters Marine Corps Director of Reserve Affairs and as the Special Assistant to the Commander, U.S. European Command. General Punaro holds a B.S. from Spring Hill College in Mobile, Alabama, an M.A. in journalism from the University of Georgia and an M.A. in national security studies from Georgetown University.
 
Harry R. Weller, Director
 
Harry R. Weller joined our board of directors in February 2003. Currently a Partner with New Enterprise Associates, Mr. Weller joined New Enterprise Associates in January 2002. Prior to joining New Enterprise Associates, Mr. Weller was a partner at FBR Technology Venture Partners from 1997 until 2001, where he worked with start-up teams. Previously, Mr. Weller was with the Boston Consulting Group in 1997 and Deloitte & Touche Management Consulting from 1993 until 1996. At both firms, he managed strategy and technology initiatives in the financial, manufacturing and telecommunications industries. Mr. Weller has served on the board of directors of Vonage, Inc. since October 2003. Mr. Weller received a B.S. in Physics from Duke University and an M.B.A. from Harvard University Graduate School of Business.
 
Board of Directors
 
Our board of directors has eight members and one vacancy, which we intend to fill after completion of this offering. At each annual meeting, our stockholders will re-elect, or elect successors to, our directors. Our executive officers and key employees serve at the discretion of our board of directors. The following directors are independent as defined under The Nasdaq Stock Market listing standards: Asheem Chandna, Joseph R. Chinnici, Tim A. Guleri, Steven R. Polk, Arnold L. Punaro and Harry R. Weller.
 
Pursuant to the Fourth Amended and Restated Stockholders’ Voting Agreement, dated as of May 24, 2006, the holders of our Series A, B, C and D convertible preferred stock as well as certain holders of our common stock have agreed to vote their shares so as to elect to our board of directors: one representative of the holders of our Series A convertible preferred stock nominated by Sierra Ventures, which is currently Mr. Guleri; one representative of the holders of our Series B convertible preferred stock nominated by New Enterprise Associates 10, which is currently Mr. Weller; two representatives of the holders of our common stock, which are currently Mr. Jackson and Mr. Roesch; and one independent industry representative not affiliated with or employed by us or any holders of our preferred stock, which is currently Mr. Chandna. This agreement will terminate upon the completion of this offering. Mr. Weller has informed the board that he will not stand for re-election when his term as director expires at our next annual meeting of stockholders. Other directors may resign or choose not to stand for re-election, which could adversely affect the continuity of our board of directors.
 
After the completion of this offering, our board of directors will consist of nine directors and will be divided into three classes as follows:
 
  •  Class A will consist of Mr. Jackson, Mr. Chandna and Mr. Weller, whose terms will expire at our annual stockholders meeting to be held in 2007;
 
  •  Class B will consist of Mr. Roesch and Mr. Guleri, whose terms will expire at our annual stockholders meeting to be held in 2008; and
 
  •  Class C will consist of Mr. Chinnici, Mr. Punaro and General Polk, whose terms will expire at our annual stockholders meeting to be held in 2009.
 
At each annual meeting of stockholders following the establishment of the initial classes, the successors to directors whose terms expire at that meeting will be elected to service from the time of election and qualification


73


Table of Contents

until the third annual meeting following election. We anticipate adding one additional Class B director to the board of directors after the completion of this offering.
 
Board Committees
 
The standing committees of our board of directors consist of an audit committee, a compensation committee and a nominating and governance committee.
 
Audit Committee
 
Our audit committee consists of Joseph R. Chinnici, Tim A. Guleri, Arnold L. Punaro and Harry R. Weller, each of whom is independent, as defined under The Nasdaq Stock Market listing standards. Mr. Chinnici serves as the chairman of our audit committee. The audit committee reviews and recommends to our board of directors internal accounting and financial controls and accounting principles and auditing practices to be employed in the preparation and review of our financial statements. In addition, the audit committee has the authority to engage public accountants to audit our annual financial statements and determine the scope of the audit to be undertaken by such accountants. The board of directors has determined that Mr. Chinnici is an audit committee financial expert under the SEC rule implementing Section 407 of the Sarbanes-Oxley Act of 2002.
 
Compensation Committee
 
Our compensation committee consists of Asheem Chandna, Tim A. Guleri, Steven R. Polk and Harry R. Weller, each of whom is independent, as defined under The Nasdaq Stock Market listing standards. Mr. Guleri serves as the chairman of our compensation committee. The compensation committee reviews and recommends to our Chief Executive Officer and the board policies, practices and procedures relating to the compensation of managerial employees and the establishment and administration of certain employee benefit plans for managerial employees. The compensation committee has authority to administer our stock incentive plan and advise and consult with our officers regarding managerial personnel policies.
 
Nominating and Governance Committee
 
Our nominating and governance committee consists of Asheem Chandna, Joseph R. Chinnici and Steven R. Polk, each of whom is independent, as defined under The Nasdaq Stock Market listing standards. General Polk serves as the chairman of our nominating and governance committee. The nominating and governance committee assists the board of directors with its responsibilities regarding, among other things, the identification of individuals qualified to become directors; the selection of the director nominees for the next annual meeting of stockholders; the selection of director candidates to fill any vacancies on the board of directors; reviewing and making recommendations to the board with respect to management succession planning; developing and recommending to the board corporate governance principles; and overseeing an annual evaluation of the board.
 
From time to time, the board may establish other committees to facilitate the management of our business.
 
Compensation Committee Interlocks and Insider Participation
 
None of our executive officers serves as a member of the board of directors or compensation committee of any entity that has one or more executive officers serving as our director or as a member of our compensation committee.


74


Table of Contents

 
COMPENSATION DISCUSSION AND ANALYSIS
 
Overview
 
This compensation discussion and analysis explains the material elements of the compensation awarded to, earned by, or paid to each of our executive officers who served as our named executive officers during the last completed fiscal year.
 
Compensation Program Objectives and Philosophy
 
The compensation committee of our board of directors currently oversees the design and administration of our executive compensation program. Our compensation committee’s primary objectives in structuring and administering our executive officer compensation program are to:
 
  •  attract, motivate and retain talented and dedicated executive officers;
 
  •  tie annual and long-term cash and stock incentives to achievement of measurable corporate, business unit and individual performance objectives;
 
  •  reinforce business strategies and objectives for enhanced stockholder value; and
 
  •  provide our executive officers with long-term incentives so we can retain them and provide stability during our growth stage.
 
To achieve these goals, our compensation committee intends to implement and maintain compensation plans that tie a substantial portion of executives’ overall compensation to key strategic goals such as financial and operational performance, as measured by metrics such as revenue, gross margins and net income. Our compensation committee evaluates individual executive performance with a goal of setting compensation at levels the committee believes are comparable with those of executives at other companies of similar size and stage of growth, while taking into account our relative performance and our own strategic goals.
 
The principal elements of our executive compensation program are base salary, quarterly cash bonus awards, long-term equity incentives in the form of restricted stock and/or stock options, other benefits and perquisites, post-termination severance and acceleration of stock option vesting for certain named executive officers upon termination and/or a change in control. Our other benefits and perquisites consist of life and health insurance benefits and a qualified 401(k) savings plan.
 
We view these components of compensation as related but distinct. Although our compensation committee does review total compensation, we do not believe that significant compensation derived from one component of compensation should negate or offset compensation from other components. We determine the appropriate level for each compensation component based in part, but not exclusively, on competitive benchmarking consistent with our recruiting and retention goals, our view of internal equity and consistency, and other considerations we deem relevant, such as rewarding extraordinary performance.
 
Determination of Compensation Awards
 
Our compensation committee currently intends to perform at least annually a strategic review of our executive officers’ compensation to determine whether they provide adequate incentives and motivation to our executive officers and whether they adequately compensate our executive officers relative to comparable officers in other similarly situated companies. Our compensation committee’s most recent review occurred in January 2007 when our compensation committee retained a compensation consulting firm to assist it in evaluating our compensation practices and to assist it in developing and implementing our executive compensation program and philosophy. With the assistance of the compensation consulting firm, our compensation committee developed a competitive peer group and performed an analysis of competitive performance and compensation levels. We define our competitive market for executive talent to be established publicly traded companies with similar or comparable gross revenues, growth ratio, net income and/or market capitalization and companies that have consummated an initial public offering within the preceding twelve months and who have comparable operating metrics. Our compensation committee also met individually with members of our senior management to learn about our business


75


Table of Contents

operations and strategy, key performance metrics and target goals, and the labor and capital markets in which we compete, and developed recommendations that were reviewed and approved by our board of directors.
 
Our compensation committee meetings typically have included, for all or a portion of each meeting, not only the committee members but also our chief executive officer, our chief financial officer and our general counsel. For compensation decisions, including decisions regarding the grant of equity compensation, relating to executive officers other than our chief executive officer, our compensation committee typically considers recommendations from our chief executive officer.
 
Benchmarking of Base Compensation, Bonus and Equity Holdings
 
In January 2007, our board of directors (including our compensation committee) approved the adjustment of executive officers’ salaries to a level that is at or near the 60th percentile of salaries of executives with similar roles at comparable public companies and to set their aggregate share and option grants at a level that is at or near the 60th percentile of executives in similar positions, contingent upon the effectiveness of our registration statement. The comparable public companies used by our board of directors in its analysis include the following: ActivIdentity, Inc., Art Technology Group, Inc., Blue Coat Systems, Inc., Chordiant Software, Inc., CommVault, Inc., Docucorp International, Inc., Double-Take Software, Inc., Embarcadero Technologies, Inc, Entrust, Inc., FalconStor Software, Inc., Mobius Management Systems, Inc., Omniture, Inc., OPNET Technologies, Inc., Opsware Inc., Phoenix Technologies Ltd, Quovadx, Inc., RightNow Technologies, Inc., Secure Computing Corporation, Sonicwall, Inc., Synchronoss Technologies, Inc., Unica Corporation, VA Software Corporation and VASCO Data Security International, Inc. Our compensation committee believes that the 60th percentile for base salaries and for aggregate share and option holdings is the minimum cash and equity compensation level that will allow us to attract and retain talented officers. Our compensation committee realizes that using such a benchmark may not always be appropriate but believes that it is appropriate at this point in the life cycle of the company. In instances where an executive officer is uniquely key to our success, our compensation committee may provide compensation in excess of the benchmark percentile. Our compensation committee’s judgments with regard to market levels of base compensation and aggregate equity holdings were based on the collective experiences of the members of our compensation committee as well as the advice provided by a compensation consultant. Our compensation committee also compared our executive compensation with the executive compensation at a number of recently public companies and a number of established public companies, analyzing various factors including revenues, growth rates, net income and employee headcount. Our compensation committee chose revenues, growth rate and net income as key financial objectives because it believed that, as a “growth company,” we should reward revenue growth, but only if that revenue growth is achieved cost effectively. Thus, our compensation committee considered the chosen metrics to be the best indicators of financial success and stockholder value creation. Our compensation committee’s choice of the 60th percentile as our compensation benchmark reflected consideration of our stockholders’ interests in paying what was necessary to attract and retain key talent in a competitive market, while conserving cash and equity as much as possible. We believe that, given the industry in which we operate and the corporate culture that we have created, our benchmark base compensation and equity compensation levels should generally be sufficient to retain our existing executive officers and to hire new executive officers when and as required.
 
Base Compensation
 
We provide our named executive officers and other executives with base salaries that we believe enable us to hire and retain individuals in a competitive environment and to reward individual performance and contribution to our overall business goals. We review base salaries for our named executive officers annually in January and increases are based on our performance and individual performance. We also take into account the base compensation that is payable by companies that we believe to be our competitors and by other public companies with which we believe we generally compete for executives. The base salary of our chief executive officer, Mr. Jackson, is reviewed and recommended by our compensation committee and approved by our full board of directors with Mr. Jackson abstaining, and has been set at $275,000 for 2007, contingent on the completion of this offering. Our compensation committee and our board determined that this salary increase from $225,000 in 2006 would provide a salary commensurate with Mr. Jackson’s experience and would recognize his contributions to our growth during the past four years. Additionally, our compensation committee recommended, and our board approved, base salary increases for Messrs. McDonough and Headley and Ms. Perry-Boucher. Mr. McDonough’s annual base salary in


76


Table of Contents

2006 was set at $200,000 and in 2007 is $225,000. Mr. Headley’s annual base salary in 2006 was set at $175,000 and in 2007 is $210,000. Ms. Perry-Boucher’s annual base salary in 2006 was set at $185,000 and in 2007 is $190,000. All of the foregoing increases are contingent on the completion of this offering.
 
For 2006, the base salaries accounted for approximately 70% of total compensation for our chief executive officer and 71% on average for our other named executive officers.
 
Quarterly Cash Bonus Awards
 
Our current quarterly cash bonus plan is designed to reward our executive officers for exemplary service. Bonuses are determined and paid on a quarterly basis, when executive bonus plans are proposed to and approved by our compensation committee. We designed this quarterly cash bonus plan to focus our management on achieving key corporate financial objectives, to motivate certain desirable individual behaviors and to reward substantial achievement of our key corporate financial objectives and individual goals. These quarterly bonus plans typically contain between four and six objectives with a dollar value ascribed to each objective so that the sum total equals the approved quarterly bonus potential for each executive officer, according to his or her compensation plan. Objectives include but are not limited to: (i) revenue achievement; (ii) gross margin achievement; (iii) EBITDA achievement; (iv) cash collection goals; (v) project implementation plans; (vi) product availability goals; (vii) hiring goals and (viii) a variety of other department or company-specific objectives. We believe that our bonus target levels are moderately difficult to achieve and that our executives must perform at a high level devoting their full time and attention in order to earn their respective cash bonuses. At the conclusion of each quarter, our chief executive officer and chief financial officer provide our compensation committee with a draft of the earned bonus figures for its review and approval.
 
Our performance goals are both quantitative and qualitative. With respect to quantitative goals, no discretion may be exercised because these goals are objective. With respect to qualitative goals, a moderate amount of discretion may be exercised because these goals are subjective. For instance, qualitative goals include preparing product strategies and supporting our engineering team in meeting its milestones. It is necessary to exercise discretion in order to determine whether such goals are met.
 
In January 2007, our compensation committee recommended, and our board approved, new quarterly cash bonus award targets for our executive officers that more closely follow our compensation committee’s philosophy and objectives with respect to cash bonuses. These changes in our quarterly cash bonus awards are contingent upon the effectiveness of our registration statement. For example, our quarterly cash bonus award targets now define the maximum annual bonus as a percentage of the executive officer’s current annual salary as agreed to with our executive officers or, in the case of our chief executive officer’s percentage, our compensation committee. The percentages for 2007 are 55% for Mr. Jackson and 25%, 44%, 45%, 40% and 32% for Messrs. Roesch, McDonough, Headley and Boyle and Ms. Perry-Boucher, respectively. In 2006, these percentages were 44% for Mr. Jackson and 25%, 50%, 29%, 29% and 30% for Messrs. Roesch, McDonough, Headley and Boyle and Ms. Perry-Boucher, respectively. We pay bonuses quarterly with the maximum potential bonus in a given quarter equal to one-quarter of the maximum annual bonus. We determined to pay bonuses quarterly because our compensation committee is attempting to maximize achievement of short-term operational objectives. The individual performance objectives are determined by the executive officer to whom the potential bonus recipient reports or, in the case of our chief executive officer, by our compensation committee, after taking input from the other members of our board of directors. Mr. Jackson’s future bonus opportunities might include such objectives as developing our executive team, successfully integrating acquisitions, or developing strategic opportunities. We structure quarterly cash bonus awards so that they are taxable to our executives at the time the awards become available to them. We currently intend that all cash compensation paid will be tax deductible by us as compensation expense.
 
For 2006, all quarterly cash bonuses paid to our chief executive officer accounted for approximately 30% of his total compensation. For our other named executive officers in 2006, their quarterly cash bonuses, on average, accounted for approximately 24% of their respective total compensation.
 
Equity Compensation
 
We believe that for growth companies in the technology sector, equity awards are a significant compensation-related motivator in attracting and retaining executive-level employees. Our compensation committee’s philosophy


77


Table of Contents

in this regard has historically been to allocate a greater percentage of an employee’s total compensation to equity compensation as he or she becomes more senior in our organization.
 
Accordingly, we have provided our named executive officers and other executives with long-term equity incentive awards that incentivize those individuals to stay with us for long periods of time, which in turn should provide us with greater stability over such periods than we would experience without such awards. While the majority of our long-term equity compensation awards historically have also been in the form of non-qualified stock options, we provided grants of restricted stock to Messrs. Jackson and McDonough upon commencement of their employment with us in 2002. For 2007 our compensation committee has decided to use non-qualified stock options and restricted stock grants, in each case subject to a vesting schedule, in combination in order to provide us with additional flexibility. Stock options are attractive because they provide a relatively straightforward incentive for our executives, result in less immediate dilution of existing shareholders’ interests and create a disincentive to exercise vested options due to income tax liabilities on the part of the option holder, thus extending the term of employment. Our compensation committee also decided in certain cases to make restricted stock awards to our executive officers. We believe that restricted stock awards provide additional incentive to our executives by providing them with immediate stock ownership, which aligns their interests with those of our stockholders. We believe that a restricted stock award program may consume fewer shares than options in order to achieve similar incentive levels because restricted shares are immediately valuable to recipients, in contrast to stock options, which may or may not ultimately result in realizable value to recipients. Because of the lower share consumption rate associated with our restricted stock award program, our use of the program may lessen our equity overhang and reduce dilution for our stockholders.
 
We account for equity compensation paid to our employees under the rules of SFAS No. 123R, which requires us to estimate and record compensation expense over the service period of the award. All equity awards to our employees, including executive officers, and to our directors have been granted and reflected in our consolidated financial statements, based upon the applicable accounting guidance, at fair market value on the grant date in accordance with the valuation determined by our board of directors. Generally, the granting of a non-qualified stock option to our executive officers is not a taxable event to those employees, provided, however, that the exercise of such stock option would result in taxable income to the optionee equal to the difference between the fair market value of the stock on the exercise date and the exercise price paid for such stock. Similarly, a restricted stock award subject to a vesting requirement is also not taxable to our executive officers unless such individual makes an election under section 83(b) of the Internal Revenue Code of 1986, as amended. In the absence of a section 83(b) election, the value of the restricted stock award becomes taxable to the recipient as the restrictions lapse.
 
Prior to this offering, we have granted equity compensation to our executive officers and other employees in the form of non-qualified stock options under our 2002 Stock Incentive Plan. Prior to the consummation of this offering, our board of directors intends to supplement the 2002 Stock Incentive Plan with the 2007 Stock Incentive Plan, which we refer to as the 2007 Plan. See “—Employee Benefit Plans” below for additional information.
 
Generally, we grant long-term equity awards to our named executive officers upon commencement of their employment, and the terms of those awards are individually negotiated. Additionally, from time to time, we have granted subsequent long-term equity awards to our named executive officers based upon a number of factors, including: rewarding executives for superior performance, maintaining a sufficient number of unvested long-term equity awards as a means to retain the services of such executives, providing increased motivation to such executives and ensuring that the total long-term equity awards are competitive with those of other companies competing for our named executive officers.
 
Restricted Stock.  Over our history we have made several grants of restricted stock to our executive officers. In June 2002, in connection with the commencement of his employment, we granted to Mr. Jackson a restricted stock award equal to 559,729 shares of our common stock at a price of $0.000541 per share. In December 2003, we granted to Mr. Jackson 64,655 shares of restricted common stock at a purchase price of $0.00162 per share. In November 2002, in connection with the commencement of his employment, we granted to Mr. McDonough 312,192 shares of restricted stock at a per share purchase price of $0.00162. In December 2003, we granted to Mr. McDonough 129,310 shares of restricted stock at a per share purchase price of $0.00162. As of December 31, 2006, all shares of restricted stock granted to Messrs. Jackson and McDonough are fully vested pursuant to the terms


78


Table of Contents

of their respective restricted stock agreements. We have also granted restricted stock to certain of our directors. See “—Summary of Director Compensation” below for additional information.
 
Stock Options.  Upon commencement of their employment, we granted Messrs. Headley and Boyle and Ms. Perry-Boucher non-qualified stock options to purchase 105,911, 123,152 and 123,152 shares of our common stock, respectively, at exercise prices of $0.325, $5.26 and $1.14, respectively. In December 2004, we granted Mr. Headley an additional non-qualified stock option to purchase 24,630 shares of our common stock at an exercise price of $1.62. In June of 2005, in connection with our merger agreement with Check Point Software Technologies Ltd, we granted all of our named executive officers additional grants of non-qualified stock options in order to motivate those individuals to perform all our obligations under that merger agreement. Accordingly, Messrs. Jackson, McDonough, Roesch and Headley and Ms. Perry-Boucher received non-qualified stock options to purchase 98,522, 92,364, 61,576, 23,399 and 21,551 shares of our common stock, respectively, each at an exercise price of $2.03 per share.
 
In 2006, our compensation committee determined that our named executive officers had a sufficient equity stake in us, consisting of shares of common stock and/or existing options, to align their interests with ours and our stockholders and consequently there were no grants in 2006 to our named executive officers other than the grant to Mr. Boyle of 123,152 non-qualified stock options at a price of $5.26 per share in April 2006 at the commencement of his employment.
 
In January 2007, in connection with its benchmarking of equity holdings, our compensation committee recommended, and our board of directors approved (subject to the effectiveness of our registration statement), that we grant our named executive officers additional long-term equity awards in order to implement our compensation philosophy of setting aggregate share and option holdings at a level that is at or near the 60th percentile of equity compensation for executives in similar positions within our peer group. In determining the amount of the long-term equity awards, our compensation committee first developed a value range (in dollars) of the equity compensation component that other similarly situated executives within the 60th percentile of our peer group received. For example, our compensation committee concluded that, with respect to the position of chief executive officer for companies within our peer group, the 60th percentile of annual dollar value of the equity component of chief executive officer compensation ranged from $350,000 to $450,000. Thus, our compensation committee concluded and recommended, and our board of directors approved, that the appropriate annual dollar value of the long-term equity component of the compensation to be provided to our chief executive officer should be $400,000. Using the same methodology the compensation committee also recommended, and our board approved, that we provide Messrs. McDonough, Roesch, Headley and Boyle and Ms. Perry-Boucher with long-term equity compensation of $225,000, $65,000, $160,000, $25,000 and $85,000, respectively. Furthermore, our compensation committee has determined that the aggregate economic value of equity compensation payable to the executive officers should be roughly one-half restricted stock and one-half non-qualified stock options, although individual cases may vary depending on the personal preferences, if any, of the named executive officers. All of our non-qualified stock options will be subject to a four year vesting schedule with one-quarter vesting on the first anniversary of such grant and the remainder vesting equally on a monthly basis over the next three years. Our restricted stock awards will be subject to the achievement of performance targets, which we intend to establish when we grant such awards.
 
In determining the number of non-qualified stock options and/or restricted stock to award our named executive officers in order to convey the annual dollar value outlined above, our compensation committee intends to determine the estimated fair value for such awards on the grant date by performing a Black-Scholes calculation using factors relevant to the company. Using that estimated fair value, our compensation committee will be able to ascertain the number of non-qualified stock options and/or restricted stock grants to provide to our named executive officers by dividing the dollar value of the long-term equity component of the compensation for each named executive officer by the estimated fair value of the applicable equity award.
 
For 2007, based on an assessment of the foregoing factors, the compensation committee recommended, and our board of directors approved, subject to the effectiveness of our registration statement, that we grant our chief executive officer $300,000 worth of non-qualified stock options and $100,000 worth of restricted stock. Similarly, our compensation committee recommended that Mr. McDonough receive $56,250 worth of non-qualified stock options and $168,750 worth of restricted stock; that Mr. Roesch receive $65,000 worth of non-qualified stock options; that Mr. Headley receive $120,000 worth of non-qualified stock options and $40,000 worth of restricted stock; that


79


Table of Contents

Mr. Boyle receive $12,500 worth of non-qualified stock options and $12,500 worth of restricted stock; and that Ms. Perry-Boucher receive $42,500 worth of non-qualified stock options and $42,500 worth of restricted stock.
 
For a discussion of the determination of the fair market value of these grants, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Critical Accounting Policies — Stock-Based Compensation.”
 
Our stock options have a 10-year contractual exercise term. In general, the option grants are also subject to the following post-termination and change in control provisions:
 
         
Event
 
Award vesting
 
Exercise term
 
Termination by us for reason other than death, total and permanent disability, voluntary resignation or cause   Unvested terminate   30 days following cessation of employment, but in no event after the expiration date of such options
Total and permanent disability or death (prior to vesting of any options)   Immediate vesting of an amount equal to total number of options granted, multiplied by 25%, multiplied by a fraction equal to the number of days since the vesting start date, divided by 365; remaining unvested terminate   6 months following cessation of employment, but in no event after the expiration date of such options
Voluntary resignation; termination for cause; misconduct   Vested and unvested terminate   None
Change in control   Vested and unvested terminate unless provision is made in connection with the transaction   At least 20 days prior to effective time of change in control
 
The vesting of certain of our named executive officers’ stock options is accelerated pursuant to the terms of their stock option grant agreement in certain termination and/or change in control events. These terms are more fully described below in “— Employment Agreements” and “— Potential Payments upon Termination or Change in Control.”
 
Executive Benefits and Perquisites
 
In General.  We provide the opportunity for our named executive officers and other executives to receive certain perquisites and general health and welfare benefits. We also offer participation in our defined contribution 401(k) plan. We do not match employee contributions under our 401(k) plan. We provide these benefits to create additional incentives for our executives and to remain competitive in the general marketplace for executive talent.
 
Change in Control and Severance Benefits
 
In General.  We generally do not offer our employees severance benefits or change of control provisions within their option grant agreements unless specifically authorized by our board of directors or our compensation committee. We provide the opportunity for certain of our named executive officers to receive additional compensation or benefits under the severance and change in control provisions contained in their employment agreements. We provide this opportunity to attract and retain an appropriate caliber of talent in key positions. Our severance and change in control provisions for the named executive officers are summarized below in “— Employment Agreements” and “— Potential Payments Upon Termination or Change in Control.” Our analysis indicates that our severance and change in control provisions are consistent with the provisions and benefit levels of other companies disclosing such provisions as reported in public SEC filings. We believe our arrangements are reasonable in light of the fact that severance benefits are limited to six months, in the case of Messrs. Jackson, McDonough and Roesch, and three months, in the case of Messrs. Headley and Boyle, and no increase in severance benefits would occur on a change in control.


80


Table of Contents

 
Executive Compensation
 
The following table shows information concerning the annual compensation for services provided to us by our Chief Executive Officer, our Chief Financial Officer and our four other most highly compensated executive officers during 2006.
 
Summary Compensation Table
 
                                         
                Non-equity
             
                incentive plan
    Total
       
    Salary
    Stock awards
    compensation(1)
    compensation
       
Name and principal position
  ($)     ($)     ($)     ($)        
 
E. Wayne Jackson, III
    225,000             97,000       322,000          
Chief Executive Officer
                                       
Todd P. Headley
    175,000             49,320       224,320          
Chief Financial Officer and Treasurer
                                       
Thomas M. McDonough
    200,000             97,265       297,265          
President and Chief Operating Officer
                                       
Martin F. Roesch
    200,000             50,895       250,895          
Chief Technology Officer
                                       
Joseph M. Boyle(2)
    120,705       84,239       21,535       226,479          
General Counsel and Secretary
                                       
Michele M. Perry-Boucher
    175,000             48,600       223,600          
Chief Marketing Officer
                                       
 
 
(1) The amounts in this column represent total performance-based bonuses earned for services rendered in 2006. These bonuses were based on our financial performance and the executive officer’s performance against his or her specified individual objectives.
 
(2) Mr. Boyle’s employment with us began on April 24, 2006 at an annual salary of $175,000.
 
2006 Grants of Plan-Based Awards
 
The following table provides information with regard to potential cash bonuses paid or payable in 2006 under our performance-based, non-equity incentive plan, and with regard to each stock option granted to each named executive officer during 2006.
 
                                                         
          Estimated future payouts
    All other option
             
          under non-equity incentive
    awards: number of
    Exercise or
       
          plan awards(1)     securities underlying
    base price of
    Grant date
 
          Threshold
    Target
    Maximum
    options
    option awards
    fair value of
 
Name
  Grant date     ($)     ($)     ($)     (#)     ($/sh)     option awards  
 
E. Wayne Jackson, III
          90,000       100,000       100,000                    
Todd P. Headley
          23,500       50,000       50,000                    
Thomas M. McDonough
          72,000       100,000       100,000                    
Martin F. Roesch
          29,000       52,000       52,000                    
Joseph M. Boyle
    4/27/06       9,500       37,500       37,500       123,152       5.26     $ 470,480  
Michele M. Perry-Boucher
          25,250       52,500       52,500                    
 
 
(1) In the table above, the “Threshold” column represents the smallest total bonus that would have been paid in 2006 to each named executive officer if, in each quarter of 2006, we had achieved the minimum corporate financial objectives required for the payment of any bonus but the executive officer did not meet any of his or her individual objectives. In the table above, the “Target” column represents the amount payable if the specified corporate financial and individual target objectives were met in each quarter of 2006. The “Maximum” column represents the largest total bonus that could have been paid to each named executive officer if all corporate financial and individual objectives were met in each quarter of 2006. The actual bonus amount earned by each named executive officer in 2006 is shown in the “Summary Compensation Table” above.


81


Table of Contents

 
Employee Benefits Plans
 
2002 Stock Incentive Plan
 
In January 2002, we adopted and our stockholders approved the Sourcefire, Inc. 2002 Stock Incentive Plan, which we refer to as the 2002 Plan.
 
As of December 31, 2006, there was an aggregate of 5,100,841 shares of common stock reserved for issuance under the 2002 Plan, of which options to purchase 3,199,903 shares of common stock were outstanding, 1,093,596 shares of common stock were granted as restricted stock awards and were outstanding, and 181,934 shares of common stock remained available for future awards. Upon the effective date of this offering, no further awards will be made under the 2002 Plan and all shares remaining available for grant will be transferred into the 2007 Plan discussed below.
 
The 2002 Plan allows for the grant of incentive stock options, non-qualified stock options, restricted and unrestricted stock awards, stock appreciation rights, phantom stock awards, performance awards and other stock-based awards, which we collectively refer to as awards. Our and our affiliates’ employees, officers, non-employee directors and consultants are eligible to receive awards, except that incentive stock options may be granted only to employees. Upon the effectiveness of our 2007 Stock Incentive Plan, as described below, we will cease to make grants under the 2002 Plan.
 
Administration.  The board of directors has appointed our compensation committee as the administrator of the 2002 Plan. Subject to the terms of the 2002 Plan, our compensation committee determines, among other things, the:
 
  •  individuals eligible to receive an award;
 
  •  number of shares of common stock covered by the awards, the dates upon which such awards become exercisable and expire and the dates on which any restrictions lapse;
 
  •  form of award and the price and method of payment for each such award;
 
  •  vesting period; and
 
  •  exercise price or purchase price of awards.
 
Incentive Stock Options.  Incentive stock options are intended to qualify as incentive stock options under Section 422 of the Internal Revenue Code. Our compensation committee determines the exercise price for an incentive stock option, which may not be less than 100% of the fair market value of the stock underlying the option determined on the date of grant. However, incentive stock options granted to employees who own, or are deemed to own, more than 10% of our voting stock, must have an exercise price not less than 110% of the fair market value of the shares underlying the option determined on the date of grant. As of December 31, 2006, we have not granted any incentive stock options.
 
Restricted Stock and Other Stock-Based Awards.  Stock appreciation rights and restricted stock, phantom stock and other stock-based awards may be granted on such terms as may be approved by our compensation committee. Rights to acquire shares under a restricted stock or other stock-based award may be transferable only to the extent determined by our compensation committee.
 
Transfer of Awards.  Except as otherwise determined by our compensation committee, and in any event in the case of an incentive stock option or a stock appreciation right granted with respect to an incentive stock option, no award shall be transferable otherwise than by will or the laws of descent and distribution.
 
Change of Control of Company.  In the event of a change of control of our company, as such term is defined in the 2002 Plan, outstanding awards will terminate upon the effective time of such change of control unless provision is made in connection with the transaction for the continuation, assumption or substitution of such awards by the successor entity. Our compensation committee shall also have the discretion to accelerate outstanding options or terminate the company’s repurchase rights with respect to restricted stock awards and otherwise modify, amend or extend outstanding awards.


82


Table of Contents

 
2007 Stock Incentive Plan.
 
On February 22, 2007, we adopted the Sourcefire, Inc. 2007 Stock Incentive Plan, which we refer to as the 2007 Plan, contingent on the effectiveness of this registration statement. The number of shares of common stock that may be issued pursuant to awards granted under the 2007 Plan initially shall be 3,142,452, which number will be increased annually on the first day of each fiscal year, beginning in January 1, 2008 and until January 1, 2017, to a number equal to 4.0% of the outstanding shares of common stock of the company as of December 31 of the immediately preceding year.
 
The 2007 Plan will allow for the grant of incentive stock options, non-qualified stock options, restricted and unrestricted stock awards, stock appreciation rights, dividend equivalent rights and other stock-based awards, which we collectively refer to as awards. Our and our affiliates’ employees, officers, non-employee directors and consultants are eligible to receive awards, except that incentive stock options may be granted only to employees.
 
Administration.  The administrator of the 2007 Plan will be the compensation committee of our board of directors. Subject to the terms of the 2007 Plan, our compensation committee shall determine, among other things:
 
  •  the individuals eligible to receive an award;
 
  •  the number of shares of common stock covered by the award, the dates upon which such awards become exercisable and expire and the dates on which any restrictions lapse;
 
  •  the form of award and the price and method of payment for each such award;
 
  •  the vesting period; and
 
  •  the exercise price or purchase price of awards.
 
Incentive Stock Options.  Incentive stock options are intended to qualify as incentive stock options under Section 422 of the Internal Revenue Code. Our compensation committee determines the exercise price for an incentive stock option, which may not be less than 100% of the fair market value of the stock underlying the option determined on the date of grant. However, incentive stock options granted to employees who own, or are deemed to own, more than 10% of our voting stock, must have an exercise price not less than 110% of the fair market value of the shares underlying the option determined on the date of grant.
 
Transfer of Awards.  Incentive stock options shall only be transferable by will or the laws of descent and distribution. Other awards shall be transferable by will or the laws of descent and distribution during the lifetime of the grantee to the extent and in the manner authorized by our compensation committee.
 
Change of Control of Company.  In the event of a change of control of our company or a corporate transaction, as such terms are defined in the 2007 Plan, outstanding awards will terminate upon the effective time of such change of control or such corporate transaction unless provision is made in connection with the transaction for the continuation, assumption or substitution of such awards by the successor entity. Our compensation committee shall also have the discretion to accelerate outstanding options, terminate the company’s repurchase rights with respect to restricted stock awards and otherwise modify, amend or extend outstanding awards.


83


Table of Contents

 
Outstanding Equity Awards at December 31, 2006
 
The following table summarizes the number of securities underlying outstanding 2002 Plan awards for each named executive officer as of December 31, 2006. There are no outstanding unvested shares of restricted stock held by our named executive officers as of December 31, 2006.
 
                                 
    Option awards  
    Number of
    Number of
             
    securities
    securities
             
    underlying
    underlying
             
    unexercised
    unexercised
    Option exercise
    Option
 
    options (#)     options (#)     price
    expiration
 
Name
  Exercisable     Unexercisable     ($)     date  
 
E. Wayne Jackson, III
    36,945       61,576 (1)     2.03       6/24/15  
Todd P. Headley
    92,672       13,238 (2)     0.32       4/18/13  
      12,315       12,315 (3)     1.62       12/21/14  
      8,774       14,624 (1)     2.03       6/24/15  
Thomas M. McDonough
    34,636       57,727 (1)     2.03       6/24/15  
Martin F. Roesch
    23,091       38,485 (1)     2.03       6/24/15  
Joseph M. Boyle
    26,939       96,213 (4)     5.26       4/24/16  
Michele M. Perry-Boucher
    84,667       38,485 (5)     1.14       4/22/14  
      8,081       13,469 (1)     2.03       6/24/15  
 
 
(1) These options were granted pursuant to our 2002 Stock Incentive Plan and vest 25% on the first anniversary of June 24, 2005 and in equal monthly installments of 2.083% over the subsequent three years. In addition, these options accelerate and become fully vested if there is a change in control and the holder’s employment is terminated without cause within one year after the change in control subsequent to the change in control.
 
(2) These options were granted pursuant to our 2002 Stock Incentive Plan and vest in equal quarterly installments over four years, commencing on April 21, 2003. In addition, these options accelerate and become fully vested if there is a change in control and the holder’s employment is terminated without cause (actual or constructive) subsequent to the change in control.
 
(3) These options were granted pursuant to our 2002 Stock Incentive Plan and vest in equal quarterly installments over four years, commencing on December 1, 2004. In addition, these options accelerate and become fully vested if there is a change in control and the holder’s employment is terminated without cause.
 
(4) These options were granted pursuant to our 2002 Stock Incentive Plan and vest as to 75% of the options in equal quarterly installments over four years, commencing on April 24, 2006. An additional 12.5% of the options vested upon the filing of this Registration Statement on Form S-1 on October 25, 2006 and an additional 12.5% of the options will vest upon the first to occur of (i) the Snort OEM license business unit successfully reaching agreement with its third OEM customer and (ii) April 24, 2010. In addition, with respect to the options that vest quarterly, the lesser of (i) 50% of such options and (ii) the number of such options that are unvested shall accelerate and become fully vested if there is a change in control and the holder’s employment is terminated without cause (actual or constructive) subsequent to the change in control.
 
(5) These options were granted pursuant to our 2002 Stock Incentive Plan and vest in equal quarterly installments over four years, commencing on April 22, 2004. In addition, these options accelerate and become fully vested if there is a change in control and the holder’s employment is terminated without cause subsequent to the change in control.


84


Table of Contents

 
Option Exercises and Stock Vested
 
The following table provides information regarding exercises of stock options and vesting of restricted stock held by each of our named executive officers during 2006.
 
                                 
    Option awards              
    Number of
          Stock awards  
    shares
    Value
    Number of
    Value
 
    acquired on
    realized on
    shares
    realized on
 
    exercise
    exercise
    acquired on
    vesting
 
Name
  (#)     ($)     vesting     ($)  
 
E. Wayne Jackson, III
                21,568 (1)     155,798  
Todd P. Headley
                       
Thomas M. McDonough
                53,879 (2)     511,000  
Martin F. Roesch
                       
Joseph M. Boyle
                       
Michele M. Perry-Boucher
                       
 
 
(1) These shares of restricted stock were granted pursuant to our 2002 Stock Incentive Plan and vested in equal quarterly installments over three years, commencing on August 1, 2003.
 
(2) These shares of restricted stock were granted pursuant to our 2002 Stock Incentive Plan and vested in full in October 2006.
 
Employment Agreements
 
Employment Agreement with E. Wayne Jackson III
 
We entered into an employment agreement with E. Wayne Jackson III, our Chief Executive Officer, in August 2002, effective as of May 6, 2002. The term of his employment agreement is one year and may be renewed by a vote of our board of directors for consecutive one-year periods. Under this agreement, Mr. Jackson’s initial base salary was $150,000 per annum, which is subject to annual increases in the sole discretion of our board of directors. Mr. Jackson’s current annual base salary, as approved by our board of directors, is $225,000. Also, Mr. Jackson is currently eligible to receive a cash bonus of up to $100,000 per annum paid quarterly in the event that he and Sourcefire achieve deliverables or reasonable goals approved by Mr. Jackson and our board of directors or compensation committee. Mr. Jackson is eligible to participate in any and all plans providing general benefits to our employees, subject to the provisions, rules and regulations applicable to each such plan.
 
In June 2002, in connection with the commencement of his employment, we granted Mr. Jackson 559,729 shares of restricted stock at a per share purchase price of $0.000541. This grant of restricted stock was subject to the terms and conditions of a restricted stock agreement which, among other things, provided us the unconditional right to repurchase a certain percentage of this restricted stock at a per share repurchase price to be determined by our board of directors in the event we terminated Mr. Jackson’s employment for cause or he terminated his employment without good reason, in each case, within three years of date of the restricted stock agreement. The percentage of the restricted stock that we could repurchase under the restricted stock agreement began at 100% and decreased by 8.33% every three months thereafter (being reduced to 0% in June 2005). Correspondingly, we no longer have any contractual rights under this restricted stock agreement to repurchase any of Mr. Jackson’s shares of restricted stock.
 
In December 2003, we granted Mr. Jackson 64,655 shares of restricted stock at a per share purchase price of $0.00162. This grant of restricted stock was subject to the terms and conditions of a restricted stock grant agreement which, among other things, provided us the unconditional right to repurchase a certain percentage of this restricted stock at a per share repurchase price of $0.325 in the event we terminated Mr. Jackson’s employment for cause or he terminated his employment without good reason, in each case, within three years of date of the restricted stock agreement. The percentage of the restricted stock that we could repurchase under the restricted stock grant agreement began at 100% and decreased by 8.33% every three months thereafter (being reduced to 0% in August 2006). Correspondingly, we no longer have any contractual rights under this restricted stock agreement to repurchase any of Mr. Jackson’s shares of restricted stock.


85


Table of Contents

 
Mr. Jackson is also eligible to participate in our stock incentive plan. In June 2005, we granted Mr. Jackson an option to purchase 98,522 shares of our common stock at a per share exercise price of $2.03, with one quarter of the option vesting on the first anniversary of the vest start date and the balance of the option vesting equally on a monthly basis over the following three years. All vesting requirements with respect to this June 2005 option would be removed if we terminate Mr. Jackson’s employment without cause within one year following a change of control (as defined in our 2002 Stock Incentive Plan).
 
Mr. Jackson’s employment agreement may be terminated, with or without cause, by us or him at any time. If we terminate the employment agreement for cause (as defined in the agreement) or on account of death, or if Mr. Jackson terminates the agreement for any reason other than for good reason (as defined in the agreement), Mr. Jackson is entitled to no further compensation or benefits other than those earned through the date of termination. If we terminate the agreement for any reason other than for cause or death, if we terminate the agreement in the event Mr. Jackson becomes permanently disabled (as defined in the agreement) or if Mr. Jackson terminates the agreement for good reason (as defined in the agreement), we will provide continued payment of base salary and medical benefits for the six months following the termination of employment, conditioned upon the execution by Mr. Jackson of a release. In addition, our obligation to provide these severance payments expires if Mr. Jackson secures employment following a termination without cause or for good reason. The terms and provisions of the assignment of inventions, non-disclosure, non-solicitation, and non-competition agreement, or NDA, entered into with Mr. Jackson, shall survive the termination of Mr. Jackson’s employment; provided, however, that if Mr. Jackson is terminated without cause or resigns for good reason, and agrees to waive his rights to the six months of post-termination compensation described above, the non-solicitation and the 12 month non-competition provisions of the NDA shall terminate and be of no further force or effect as of the date of termination.
 
Mr. Jackson’s employment agreement expires on May 5, 2008 and may be renewed by our board of directors for consecutive one-year terms.
 
Employment Agreement with Thomas M. McDonough
 
We entered into an employment agreement with Thomas M. McDonough, our President and Chief Operating Officer, in August 2002. The term of this employment agreement is one year and may be renewed by our board of directors for consecutive one year periods. Under this agreement, Mr. McDonough’s initial base salary was $150,000 per annum, which is subject to annual increases in the sole discretion of our board of directors. Mr. McDonough’s current annual base salary, as approved by our board of directors, is $200,000. In addition, as originally drafted, Mr. McDonough was eligible to receive a cash bonus of up to $200,000 per annum, payable quarterly, in the event that he and Sourcefire achieve deliverables or reasonable goals approved by Mr. McDonough and our board of directors or our compensation committee. Mr. McDonough’s current annual cash bonus target is $100,000. Mr. McDonough is eligible to participate in any and all plans providing general benefits to our employees, subject to the provisions, rules and regulations applicable to each such plan. Mr. McDonough also executed our standard employee proprietary information, inventions and non-competition agreement.
 
In November of 2002, in connection with the commencement of his employment, we granted Mr. McDonough 312,192 shares of restricted stock at a per share purchase price of $0.00162. This grant of restricted stock was subject to the terms and conditions of a restricted stock agreement which, among other things, provided us the unconditional right to repurchase a certain percentage of this restricted stock at a per share repurchase price of $0.244 in the event we terminate Mr. McDonough’s employment for cause or he terminates his employment without good reason, in each case, within three years of date of the restricted stock agreement. The percentage of the restricted stock that we can repurchase under the restricted stock agreement began at one hundred percent and decreased by 8.33 percent every three months thereafter (being reduced to zero percent in September 2005). Correspondingly, we no longer have any contractual rights under the restricted stock agreement to repurchase Mr. McDonough’s shares of restricted stock.
 
In December of 2003, we granted Mr. McDonough 129,310 shares of restricted stock at a per share purchase price of $0.00162. This grant of restricted stock was subject to the terms and conditions of a restricted stock agreement which, among other things, provided us the unconditional right to repurchase up to seventy five percent of this restricted stock at a per share repurchase price of $0.325. With respect to 64,655 shares of this restricted stock, our right to repurchase those shares terminated upon the achievement of certain performance metrics or the passage of time. With respect to 32,328 shares of this restricted stock, our right to repurchase those shares


86


Table of Contents

terminated upon the third anniversary of the vest start date, or October 2006. Currently all our rights to repurchase Mr. McDonough’s restricted stock granted in December 2003 have lapsed.
 
Mr. McDonough is also eligible to participate in our stock incentive plan. In June 2005, we granted Mr. McDonough an option to purchase 92,364 shares of our common stock at a per share exercise price of $2.03 with one quarter of the option vesting on the first anniversary of the vest start date and the balance of the option vesting equally on a monthly basis over the following three years. All vesting requirements with respect to this June 2005 option would be removed if we terminate Mr. McDonough’s employment without cause within one year following a change of control (as defined in our 2002 Stock Incentive Plan).
 
Mr. McDonough’s employment agreement may be terminated, with or without cause, by us or him at any time. If we terminate the employment agreement for cause (as defined in the agreement) or on account of death, or if Mr. McDonough terminates the agreement for any reason other than for good reason (as defined in the agreement), Mr. McDonough is entitled to no further compensation or benefits other than those earned through the date of termination. If we terminate the agreement for any reason other than for cause or death, if we terminate the agreement in the event Mr. McDonough becomes permanently disabled (as defined in the agreement) or if Mr. McDonough terminates the agreement for good reason (as defined in the agreement), we will provide continued payment of base salary and medical benefits for the six months following the termination of employment, conditioned upon the execution by Mr. McDonough of a release. In addition, our obligation to provide his severance payment expires if Mr. McDonough secures employment following a termination without cause or for good reason. The terms and provisions of the employee proprietary information, inventions and non-competition agreement entered into with Mr. McDonough shall survive Mr. McDonough’s termination; provided, however, that if Mr. McDonough is terminated without cause or resigns for good reason, and agrees to waive his rights to the six months of post-termination compensation described above, the non-solicitation and the 12-month non-competition provisions shall terminate and be of no further force or effect as of the date of termination.
 
Mr. McDonough’s employment agreement expires on September 8, 2008 and may be renewed by our board of directors for consecutive one-year terms.
 
Employment Agreement with Martin F. Roesch
 
We entered into an employment agreement with Martin F. Roesch, our Chief Technology Officer, in February 2002 and amended that agreement effective July 2002. The term of this employment agreement is one year and may be renewed by our board of directors for consecutive one year periods. Under this agreement, Mr. Roesch’s initial base salary was $150,000 per annum, which is subject to annual increases in the sole discretion of our board of directors. Mr. Roesch’s current annual base salary, as approved by our board of directors, is $200,000. In addition, Mr. Roesch is eligible to receive a cash bonus of up to $50,000 per annum, contingent upon Mr. Roesch’s ability to achieve deliverables or reasonable goals approved by Mr. Roesch and our board of directors or compensation committee. Mr. Roesch is eligible to participate in any and all plans providing general benefits to our employees, subject to the provisions, rules and regulations applicable to each such plan. Mr. Roesch executed our assignment of inventions, non-disclosure, non-solicitation and non-competition agreement.
 
In February of 2002, we entered into a restricted stock agreement with Mr. Roesch which provided us the unconditional right to repurchase a certain percentage of his restricted stock at a per share repurchase price of $.00162 in the event we terminate Mr. Roesch’s employment for cause or he terminates his employment without good reason, in each case, within three years of the date of the restricted stock agreement. The percentage of the restricted stock that we can repurchase under the restricted stock agreement began at fifty percent and decreased by one-third on each anniversary of the date of the restricted stock agreement (being reduced to zero percent in February 2005). Correspondingly, we no longer have any contractual rights under the restricted stock agreement to repurchase Mr. Roesch’s shares of restricted stock.
 
Mr. Roesch is also eligible to participate in our stock incentive plan. In June of 2005, we granted Mr. Roesch an option to purchase 61,576 shares of our common stock at a per share exercise price of $2.03 with one quarter of the option vesting on the first anniversary of the vest start date and the balance of the option vesting equally on a monthly basis over the following three years. All vesting requirements with respect to this June 2005 option would be removed if we terminate Mr. Roesch’s employment without cause within one year following a change of control (as defined in our 2002 Stock Incentive Plan).


87


Table of Contents

 
Mr. Roesch’s employment agreement may be terminated, with or without cause, by us or him at any time. If we terminate the employment agreement for cause (as defined in the agreement) or on account of death, or if Mr. Roesch terminates the agreement for any reason other than for good reason (as defined in the agreement), Mr. Roesch is entitled to no further compensation or benefits other than those earned through the date of termination. If we terminate the agreement for any reason other than for cause or death, if we terminate the agreement in the event Mr. Roesch becomes permanently disabled (as defined in the agreement) or if Mr. Roesch terminates the agreement for good reason (as defined in the agreement), we will provide continued payment of base salary and medical benefits for the six months following the termination of employment, conditioned upon the execution by Mr. Roesch of a release. In addition, our obligation to provide Mr. Roesch’s severance payment expires if he secures employment following a termination without cause or for good reason. The terms and provisions of the assignment of inventions, non-disclosure, non-solicitation and non-competition agreement entered into with Mr. Roesch shall survive the termination of Mr. Roesch’s employment; provided, however, that if Mr. Roesch is terminated without cause or resigns for good reason, and agrees to waive his rights to the six months of post-termination compensation described above, the non-solicitation and the 12-month non-competition provisions shall terminate and be of no further force or effect as of the date of termination.
 
Mr. Roesch’s employment agreement expires on July 1, 2008 and may be renewed by our board of directors for consecutive one-year terms.
 
Employment Agreement with Todd P. Headley
 
We entered into an employment agreement with Todd P. Headley, our Chief Financial Officer and Treasurer, in March 2003. The employment agreement provides for an initial base salary of $125,000 per annum, and eligibility to receive a quarterly incentive bonus at the discretion of the compensation committee of our board of directors, contingent upon the executive’s ability to achieve management objectives. Compensation for Mr. Headley is subject to normal periodic review by our compensation committee. Mr. Headley’s current annual base salary, as approved by our board of directors, is $175,000 and his current annual bonus is targeted at $50,000. Mr. Headley is eligible to participate in any and all plans providing general benefits to our employees, subject to the provisions, rules and regulations applicable to each such plan.
 
Mr. Headley’s employment agreement also provides that he is eligible to participate in our stock incentive plan. In April of 2003, we granted Mr. Headley an option to purchase 105,911 shares of our common stock at an exercise price of $0.325. This option vests equally on a quarterly basis over a four year period commencing on the vest start date, and all vesting requirements would be removed if we terminate Mr. Headley’s employment (actually or constructively) without cause following a change of control (as defined in our 2002 Stock Incentive Plan). In addition, in December of 2004 and again in June of 2005, we granted Mr. Headley additional options to purchase 24,630 and 23,399 shares of our common stock, respectively. The December 2004 option was granted at an exercise price of $1.62 per share and vests equally on a quarterly basis over a four year period commencing on the vest start date. This vesting requirement would be accelerated in an amount equal to the lesser of fifty percent of the shares reserved for issuance thereunder or the remaining unvested portion of that option if we terminate Mr. Headley’s employment (actually or constructively) without cause following a change of control (as defined in our 2002 Stock Incentive Plan). The June 2005 option was granted at an exercise price of $2.03 per share with one quarter of the option vesting on the first anniversary of the vest start date and the balance of the option vesting equally on a monthly basis over the following three years. All vesting requirements with respect to the June 2005 option would be removed if we terminate Mr. Headley’s employment without cause within one year following a change of control (as defined in our 2002 Stock Incentive Plan). Mr. Headley also executed our standard employee proprietary information, inventions, and non-competition agreement.
 
Mr. Headley’s employment may be terminated at any time, with or without cause and with or without notice, by Mr. Headley or by us. If Mr. Headley’s employment is terminated by us without cause (as defined in the agreement), we will provide payment of salary and benefits for the three months following the termination of employment as well as any bonus earned as of the date of termination. Any obligation to pay severance would be conditioned upon the execution of a release by Mr. Headley.
 
The employment agreement states that Mr. Headley’s employment is of no set duration.


88


Table of Contents

 
Employment Agreement with Joseph M. Boyle
 
We entered into an employment agreement with Joseph M. Boyle, our General Counsel and Secretary, in April 2006. The employment agreement provides for an initial base salary of $175,000 per annum, and eligibility to receive a performance bonus up to an initial amount of $50,000 per annum, payable quarterly, contingent upon the executive’s ability to achieve objectives established jointly by Mr. Boyle and our Chief Executive Officer. Mr. Boyle is also eligible to receive a one-time $50,000 bonus payable upon the closing of a definitive merger or acquisition in which we receive proceeds in excess of $200.0 million, which was provided as an incentive for Mr. Boyle to join us following the termination of our agreement to be acquired by Check Point Software Technologies Ltd. in light of the significant demands to which our general counsel would be subject should we agree to be acquired in another transaction. We believe that the $200.0 million threshold was appropriate because the anticipated consideration to be paid under the terms of the merger agreement with Check Point were $225.0 million. Mr. Boyle is also eligible to receive a one-time $25,000 bonus once we reach an agreement with our third OEM customer following the launch of the Project X IP business unit. Compensation for Mr. Boyle is subject to normal periodic review by the compensation committee of our board of directors. Mr. Boyle’s current annual base salary, as approved by our board of directors, is $175,000. Mr. Boyle is eligible to participate in any and all plans providing general benefits to our employees, subject to the provisions, rules and regulations applicable to each such plan.
 
The employment agreement also provides that Mr. Boyle is eligible to participate in our stock incentive plan. Upon commencement of his employment in April 2006, we granted Mr. Boyle an option to purchase 123,512 shares of our common stock, with 92,364 shares vesting over a four year period at quarterly intervals, 15,394 shares vesting upon the first to occur of the filing of a registration statement with the SEC to raise a minimum of $50 million or the fourth anniversary of the vesting start date, and 15,394 shares vesting on the first to occur of the Company reaching an agreement with its third OEM customer following the launch of the Project X IP business unit or the fourth anniversary of the vesting start date. In addition, the options are subject to acceleration of vesting of the lesser of 50% of the 92,364 shares subject to quarterly vesting or the remaining unvested shares of the 92,364 shares subject to quarterly vesting, upon a change of control (as defined in our stock incentive plan) and a termination other than for cause (either an actual or constructive termination) subsequent to the change of control. Mr. Boyle also executed our standard employee proprietary information, inventions, and non-competition agreement.
 
Mr. Boyle’s employment may be terminated at any time, with or without cause and with or without notice, by Mr. Boyle or by us. If Mr. Boyle’s employment is terminated by us without cause (as defined in the agreement), we will provide payment of salary and benefits for the three months following the termination of employment, as well as any bonus earned as of the date of termination. Any obligation to pay severance would be conditioned upon the execution by Mr. Boyle of a release.
 
The employment agreement states that Mr. Boyle’s employment is of no set duration.
 
Employment Agreement with Michele M. Perry-Boucher
 
We entered into an employment agreement with Michele M. Perry-Boucher, our Chief Marketing Officer, in February 2004. The employment agreement provides for an initial base salary of $150,000 per annum, and eligibility to receive a performance bonus up to an initial amount of $50,000 per annum, payable quarterly, contingent upon the executive’s ability to achieve objectives established jointly by Ms. Perry-Boucher and our Chief Executive Officer. Compensation for Ms. Perry-Boucher is subject to normal periodic review by our compensation committee. Ms. Perry-Boucher’s current annual base salary, as approved by our board of directors, is $185,000. Ms. Perry-Boucher is eligible to participate in any and all plans providing general benefits to our employees, subject to the provisions, rules and regulations applicable to each such plan.
 
The employment agreement also provides that Ms. Perry-Boucher is eligible to participate in our stock incentive plan. In April of 2004, we granted Ms. Perry-Boucher an initial option to purchase 123,512 shares of our common stock at an exercise price of $1.14 with vesting over a four year period at quarterly intervals. In the event of a change of control (as defined in our stock incentive plan) and Ms. Perry-Boucher’s employment is terminated (actually or constructively) without cause following such change of control, this vesting requirement shall be accelerated in an amount of the lesser of 50% of the initial grant (or 61,576 shares) or the remaining unvested portion of the option. In addition, in June 2005 we granted Ms. Perry-Boucher an additional option to purchase 21,551 shares of our common stock at an exercise price of $2.03. This option vests over a four year period, with one


89


Table of Contents

quarter vesting on the one year anniversary of the vest commencement date and the remaining vesting equally on a monthly basis over the following three years. All vesting requirements with respect to the June 2005 option would be removed if we terminate Ms. Perry-Boucher’s employment without cause within one year following a change of control (as defined in our 2002 Stock Incentive Plan). The employment agreement was contingent upon Ms. Perry-Boucher executing our employee proprietary information, inventions, and non-competition agreement.
 
Ms. Perry-Boucher’s employment may be terminated at any time, with or without cause and with or without notice, by Ms. Perry-Boucher or by us.
 
The employment agreement states that Ms. Perry-Boucher’s employment is of no set duration.
 
Potential Payments Upon Termination or Change in Control
 
Pursuant to the employment agreement of each of Mr. Jackson, Mr. McDonough and Mr. Roesch, if we terminate the agreement for any reason other than for cause or death, if we terminate the agreement in the event Mr. Jackson, Mr. McDonough or Mr. Roesch, as applicable, become permanently disabled, or if Mr. Jackson, Mr. McDonough or Mr. Roesch, as applicable, terminate the agreement for good reason, we will provide continued payment of Mr. Jackson’s, Mr. McDonough’s or Mr. Roesch’s, as applicable, base salary and medical benefits for the six months following the termination of employment. Our obligations to provide severance payments expire if Mr. Jackson, Mr. McDonough or Mr. Roesch, as applicable, secures employment following a termination without cause or for good reason. Pursuant to the employment agreement of each of Mr. Headley and Mr. Boyle, if we terminate the agreement without cause, we will provide continued payment of Mr. Headley’s or Mr. Boyle’s, as applicable, base salary, benefits and bonus earned for the three months following the termination of employment. Assuming the employment of Messrs. Jackson, McDonough and Roesch were to be terminated by us without cause, by us in the event Mr. Jackson, Mr. McDonough or Mr. Roesch become permanently disabled, or by Mr. Jackson for good reason, and assuming the employment of Messrs. Headley and Boyle were to be terminated by us without cause, as of December 31, 2006, the following individuals would be entitled to payments in the amounts set forth opposite their names in the below table:
 
         
Name
 
Cash severance
 
Benefits
 
E. Wayne Jackson, III
  $18,750 per month for six months   Benefits have an estimated value of $1,002 per month for six months
Todd P. Headley
  $14,583 per month for three months plus any earned bonus   Benefits have an estimated value of $1,001 per month for three months
Thomas M. McDonough
  $16,667 per month for six months   Benefits have an estimated value of $983 per month for six months
Martin F. Roesch
  $16,667 per month for six months   Benefits have an estimated value of $997 per month for six months
Joseph M. Boyle
  $14,583 per month for three months plus any earned bonus   Benefits have an estimated value of $936 per month for three months
Michele M. Perry-Boucher
  None   None
 
We are not obligated to make any cash payments to these executives if their employment is terminated by us for cause or on account of death or by the executive other than for good reason.
 
Pursuant to Mr. Boyle’s employment agreement, upon the closing of a definitive merger or acquisition transaction whereby the Company receives proceeds in excess of $200.0 million, Mr. Boyle will receive a one-time bonus equal to $50,000.
 
In addition, each of Messrs. Jackson, McDonough, Roesch, Headley and Boyle and Ms. Perry-Boucher hold options that would vest if such executive ceases to be employed by us as a result of a change in control and the termination of such executive without cause following such change in control. Assuming the employment of our named executive officers were to be terminated without cause within one year of a change in control, each as of


90


Table of Contents

December 31, 2006, the following individuals would be entitled to accelerated vesting of their outstanding stock options as described in the table below:
 
     
Name
  Value of accelerated equity awards: termination without cause following change in control(1)
 
E. Wayne Jackson, III
  Immediate vesting of 61,576 options with a value of $674,257
Todd P. Headley
  Immediate vesting of 40,178 options with a value of $468,088
Thomas M. McDonough
  Immediate vesting of 57,727 options with a value of $632,122
Martin F. Roesch
  Immediate vesting of 38,485 options with a value of $421,411
Joseph M. Boyle
  Immediate vesting of 46,182 options with a value of $357,449
Michele M. Perry-Boucher
  Immediate vesting of 51,955 options with a value of $616,186
 
 
(1) Assumes a price per share of our common stock of $13.00 per share, which represents the midpoint of the range set forth on the cover of this prospectus.
 
In connection with a termination without cause, a termination due to the executive becoming permanently disabled or a termination for good reason, no payments are due unless the executive executes a general release and waiver releasing us from any obligations and liabilities of any type whatsoever, except for our obligations with respect to any severance benefits. Under the terms and conditions of the assignment of inventions, non-disclosure, non-solicitation and non-competition agreement, or NDA, executed by each of Messrs. Jackson, McDonough and Roesch, which survive the termination of such executive’s employment, such executive cannot, among other things, (i) disclose confidential information (as defined in the NDA) during or after employment with us, (ii) provide services, similar to those the executive provided to us, to any competitor (as defined in the NDA) within the United States during employment with us and for a period of one year following termination for any reason, and (iii) induce, solicit or attempt to induce or solicit, any of our employees, customers, clients, vendors or strategic business partners during employment with us and for a period of one year following termination for any reason. In the event of a termination without cause or for good reason, the restrictions set forth in clauses (ii) and (iii) of the preceding sentence shall terminate and be of no further force or effect, provided the executive agrees to waive any rights to any severance or other termination benefits under such executive’s employment agreement.
 
The following definitions apply to the termination and change in control provisions in the employment agreements and stock option grant agreements.
 
A termination for “Cause” occurs under the employment agreements and stock option grant agreements of Messrs. Jackson, McDonough and Roesch if we terminate employment for any of the following reasons:
 
(i) the executive’s conviction of, or plea of guilty or nolo contendere to, (a) a felony or (b) any crime involving moral turpitude that may reasonably be expected to have an adverse impact on our reputation or standing in the community;
 
(ii) misconduct in connection with the executive’s duties or willful failure to perform such duties (including, without limitation, material breach by the executive of any provision of the employment agreement or that certain assignment of inventions, non-disclosure, non-solicitation and non-competition agreement, executed by and between us and the executive, or any similar agreement executed by the executive for our benefit); or
 
(iii) engaging in behavior that would constitute grounds for liability for harassment (as proscribed by the U.S. Equal Employment Opportunity Commission Guidelines or any other applicable state or local regulatory body) or other conduct that violates laws governing the workplace;
 
provided, however, that the foregoing events or actions shall not constitute “Cause” unless our board of directors shall have provided the executive with written notice of the event or action allegedly constituting


91


Table of Contents

“Cause” and the executive has not cured such event or action within thirty (30) days of executive’s receipt of such written notice.
 
A termination for “Cause” occurs under the employment agreements and stock option grant agreements of Messrs. Headley and Boyle if we terminate employment for any of the following reasons:
 
(i) conviction of, or plea of guilty or nolo contendere to, (a) a felony or (b) any crime involving moral turpitude that may reasonably be expected to have an adverse impact on our reputation or standing in the community;
 
(ii) fraud on or misappropriation of any of our funds or property, or the funds or property of any of our affiliates, customers or vendors;
 
(iii) personal dishonesty, incompetence, willful misconduct, willful violation of any law, rule or regulation (other than minor traffic violations or similar offenses), or breach of fiduciary duty involving personal profit;
 
(iv) violation of any of our rules, regulations, procedures or policies;
 
(v) breach of the Employee Proprietary Information, Inventions, and Non-Competition Agreement executed by the executive, or any similar agreement executed by the executive for our benefit;
 
(vi) engaging in behavior that would constitute grounds for liability for harassment (as proscribed by the U.S. Equal Employment Opportunity Commission Guidelines or any other applicable state or local regulatory body) or other conduct that violates laws governing the workplace; or
 
(vii) chronic use of alcohol, drugs or other substances which affects the executive’s performance.
 
Per Mr. Boyle’s employment agreement, the events of actions listed above shall not constitute “Cause” unless Mr. Boyle is provided written notice of the event or action allegedly constituting “Cause” and Mr. Boyle has not cured such event or action within thirty (30) days of his receipt of such written notice.
 
A termination for “Cause” occurs under the stock option grant agreement of Ms. Perry-Boucher if we terminate employment for any of the following reasons:
 
(i) conviction of, or a plea of nolo contendere to, a felony or crime involving moral turpitude;
 
(ii) fraud on or misappropriation of any funds or property of the Company, any affiliate, customer or vendor;
 
(iii) personal dishonesty, incompetence, willful misconduct, willful violation of any law, rule or regulation (other than minor traffic violations or similar offenses), or breach of fiduciary duty which involves personal profit;
 
(iv) willful misconduct in connection with the executive’s duties or willful failure to perform the executive’s responsibilities in the best interests of the Company;
 
(v) chronic use of alcohol, drugs or similar substances which affects the executive’s work performance;
 
(vi) violation of any Company rule, regulation, procedure or policy; or
 
(vii) breach of any provision of any employment, non-disclosures, non-competition, non-solicitation or other similar agreement executed by the executive for the benefit of the Company.
 
A termination for “Good Reason” occurs under the employment agreements of Messrs. Jackson, McDonough and Roesch if the executive terminates his employment for any of the following reasons:
 
(i) willful failure by us to provide the executive the base salary and benefits described in the employment agreement, except for any reduction or other concessionary arrangement affecting all employees or affecting senior executive officers generally;
 
(ii) there is an adverse change in executive’s title, position, responsibilities or there is otherwise a diminution in executive’s duties (other than a change due to the executive’s total and permanent disability or as an accommodation under the Americans with Disabilities Act); or
 
(iii) a relocation of our principal executive office to a location outside of the Washington, D.C. metropolitan area or requiring the executive to be based anywhere other than our principal executive office,


92


Table of Contents

except for required business travel to the extent that such travel is substantially consistent with executive’s present travel obligations;
 
provided, however, that the foregoing events or actions shall not constitute “Good Reason” unless the executive shall have provided us with written notice of the event or action allegedly constituting Good Reason and we have not cured such event or action within thirty (30) days of our receipt of such written notice.
 
“Permanently Disabled” under the employment agreements of Messrs. Jackson, McDonough and Roesch means the executive’s inability, due to physical or mental ill health, to perform the essential functions of his or her job, with or without a reasonable accommodation, for a period in excess of 120 consecutive days or in excess of 180 days in any consecutive 12-month period.
 
“Change in Control” means:
 
(i) the acquisition (other than from us) in one or more transactions by any Person, of the beneficial ownership (within the meaning of Rule 13d-3 promulgated under the Securities Exchange Act of 1934, as amended) of 50% or more of (A) the then outstanding shares of our securities, or (B) the combined voting power of our then outstanding securities entitled to vote generally in the election of directors (the “Company Voting Stock”);
 
(ii) the closing of a sale or other conveyance of all or substantially all of our assets; or
 
(iii) the effective time of any merger, share exchange, consolidation or other business combination of ours if immediately after such transaction persons who hold a majority of the outstanding voting securities entitled to vote generally in the election of directors of the surviving entity (or the entity owning 100% of such surviving entity) are not persons who, immediately prior to such transaction, held the Company Voting Stock;
 
provided, however, that a Change in Control shall not include (Y) a public offering of our capital stock or (Z) any transaction pursuant to which shares of our capital stock are transferred or issued to any trust, charitable organization, foundation, family partnership or other entity controlled directly or indirectly by, or established for the benefit of Martin Roesch or his immediate family members (including spouses, children, grandchildren, parents and siblings, in each case to include adoptive relations) or transferred to any such immediate family members. For purposes of this definition, “Person” means any individual, entity or group within the meaning of Rule 13d-3 of the Securities Exchange Act of 1934, as amended, other than: employee benefit plans sponsored or maintained by us and corporations controlled by us.
 
Director Compensation
 
The following table summarizes compensation that our directors (other than directors who are named executive officers) earned during 2006 for services as members of our board of directors.
 
                         
    Fees earned
      Total
    or paid in cash
  Stock awards
  compensation
Name
  ($)   ($)(1)   ($)
 
Asheem Chandna
                 
Joseph R. Chinnici
    12,823 (2)     48,958 (4)     61,781  
Tim A. Guleri
                 
Steven R. Polk
    7,152 (3)     31,333 (5)     38,485  
Arnold L. Punaro(6)
                 
Harry R. Weller
                 
 
 
(1) Valuation based on the dollar amount of option grants recognized for financial statement reporting purposes pursuant to FAS 123R with respect to 2006. The assumptions we used with respect to the valuation of option grants are set forth in Note 2 to our consolidated financial statements.
 
(2) We agreed to pay Mr. Chinnici $30,000 annually to serve on our board of directors and to serve as chairman of our audit committee. Mr. Chinnici joined our board of directors in July 2006.
 
(3) We agreed to pay General Polk $20,000 annually to serve on our board of directors and to serve as chairman of our nominating and governance committee. General Polk joined our board of directors in August 2006.


93


Table of Contents

 
(4) On July 28, 2006 we agreed to issue Mr. Chinnici 15,394 shares of restricted common stock at a price of $0.001624 per share and vesting on the earliest to occur of (i) the consummation of a firm commitment underwritten public offering of our common stock, along with the expiration of any applicable lock-up agreements, (ii) a change in control of Sourcefire or (iii) June 30, 2008. As of December 31, 2006, Mr. Chinnici owns 15,394 shares of restricted common stock, none of which have vested.
 
(5) On September 23, 2006 we agreed to issue General Polk 12,315 shares of restricted common stock at a price of $0.001624 per share and vesting on the earliest to occur of (i) the consummation of a firm commitment underwritten public offering of our common stock, along with the expiration of any applicable lock-up agreements, (ii) a change in control of Sourcefire or (iii) June 30, 2008. As of December 31, 2006, General Polk owns 12,315 shares of restricted common stock, none of which have vested.
 
(6) General Punaro joined our board of directors in January 2007.
 
Summary of Director Compensation
 
In 2006 we agreed to pay Joseph R. Chinnici $30,000 annually to serve on our board of directors and to serve as chairman of our audit committee, and Steven R. Polk $20,000 annually to serve on our board of directors and to serve as chairman of our nominating and governance committee, in each case until the consummation of this offering. Following the consummation of this offering, we will pay each of our directors an annual fee of $15,000 to serve on our board of directors. In addition, we will pay the chairman of our audit committee an annual fee of $10,000, the chairman of our compensation committee an annual fee of $5,000, and the chairman of our nominating and governance committee an annual fee of $4,000. We will also pay each of our directors a fee of $1,500 per meeting of the full board of directors attended, and $1,000 per meeting of a committee of the board of directors attended. Directors will be also be reimbursed for reasonable travel and other expenses incurred in connection with attending meetings of the board and its committees.
 
Under our 2002 Plan, directors are eligible to receive stock option and restricted stock grants at the discretion of our compensation committee or other administrator of the plan. We have made the following grants to our directors under our 2002 Plan:
 
  •  On October 23, 2003 we granted Asheem Chandna an option to purchase 98,522 shares of our common stock at an exercise price of $0.325 per share, which our board of directors determined to be the fair market value of our common stock on the date of grant. Mr. Chandna exercised this option in full on December 21, 2004.
 
  •  On July 28, 2006 we agreed to issue Joseph R. Chinnici 15,394 shares of restricted common stock at a price of $0.001624 per share and vesting on the earliest to occur of (i) the consummation of a firm commitment underwritten public offering of our common stock, along with the expiration of any applicable lock-up agreements, (ii) a change in control of Sourcefire or (iii) June 30, 2008.
 
  •  On September 23, 2006 we agreed to issue Steven R. Polk 12,315 shares of restricted common stock at a price of $0.001624 per share and vesting on the earliest to occur of (i) the consummation of a firm commitment underwritten public offering of our common stock, along with the expiration of any applicable lock-up agreements, (ii) a change in control of Sourcefire or (iii) June 30, 2008.
 
  •  On January 24, 2007 we agreed to issue Arnold L. Punaro 12,315 shares of restricted common stock at a price of $0.001624 per share, 4,926 shares of which will vest on January 24, 2008, 6,157 shares of which will vest in 1,231 share increments on completion of each of the five 90-day periods thereafter, and the remaining 1,231 shares of which will vest on the date of our 2009 annual meeting of stockholders.
 
In addition, upon the effectiveness of our registration statement, we intend to grant our non-employee directors restricted stock as additional compensation for their services through our 2008 annual stockholders meeting. The amount of restricted stock that we intend to grant these non-employee directors is 8,209 shares, 6,157 of which will vest on the first anniversary of the grant date and the remaining 2,052 shares of which will vest on the date of our 2008 annual stockholders meeting.


94


Table of Contents

 
CERTAIN RELATIONSHIPS AND RELATED PERSONS TRANSACTIONS
 
Series D Financing
 
In May and June 2006, we sold 3,264,449 shares of Series D convertible preferred stock, or approximately 9.5% of our total outstanding equity securities on an as-converted fully-diluted basis, in exchange for approximately $23 million in cash, or $7.0456 per share. Entities affiliated with each of Inflection Point Ventures, Sierra Ventures, Core Capital, New Enterprise Associates and Sequoia Capital were all 5% or greater stockholders immediately before the time of the sale and purchased an aggregate of 1,886,902 shares of Series D convertible preferred stock. Our director Tim Guleri is currently a managing director with Sierra Ventures. Our director Harry Weller is currently a partner with New Enterprise Associates.
 
Investor Rights Agreement
 
In May and June 2006, we and the holders of all series of our convertible preferred stock entered into the fourth amended and restated investor rights agreement, which is included as an exhibit to the registration statement of which this prospectus is a part. Under the agreement, the holders of registrable securities (as defined in the agreement) have the right, upon the occurrence of certain events to require us to file with the SEC and cause to be declared effective a registration statement covering the resale of shares of common stock issued or issuable upon the conversion of the shares of our Series A, B, C and D convertible preferred stock. Also, if we propose to register any of our capital stock under the Securities Act, the holders of all series of our convertible preferred stock will be entitled to customary “piggyback” registration rights with respect to shares of common stock issued or issuable upon the conversion of the shares of our Series A, B, C and D convertible preferred stock. In addition, the holders of our convertible preferred stock also have a right of first refusal to acquire any offered securities (as defined in the agreement) issued, sold or exchanged by us. This right of first refusal is not applicable in this offering. The agreement also includes certain negative covenants that restrict us and the holders of our convertible preferred stock. This agreement will terminate upon the closing of the offering contemplated by this prospectus, except for the registration rights and confidentiality provisions of the agreement.
 
Right of First Refusal and Co-Sale Agreement
 
In May and June 2006, we and certain key holders of our common stock and the holders of our preferred stock entered into the fourth amended and restated right of first refusal and co-sale agreement, which is included as an exhibit to the registration statement of which this prospectus is a part. Under this agreement, certain key holders of our common stock are subject to contractual restrictions relating to their proposed transfer of our common stock. In addition, in the event such key holders desire to transfer their shares of our common stock to a third party, such transfer is subject to a right of first refusal held by us and, in the event we do not exercise this right, in whole or in part, then the holders of our preferred stock have a right, on a pro-rata basis, to purchase such shares of common stock proposed to be transferred. The holders of our convertible preferred stock also have a right of co-sale under this agreement to sell their own stock, on a pro-rata basis, in the event of a proposed transfer of stock by such key holders. Under this agreement, we were also granted certain “drag-along” rights to require certain security holders to participate in the event of a proposed sale or merger of the company. This agreement will terminate upon the closing of the offering contemplated by this prospectus.
 
Stockholders’ Voting Agreement
 
In May and June 2006, we and certain key holders of our common stock and the holders of our preferred stock entered into the fourth amended and restated stockholders’ voting agreement, which is included as an exhibit to the registration statement of which this prospectus is a part. Under this agreement, key holders of our common stock and holders of our preferred stock agreed to vote all shares of capital stock owned by such holders for the election of our directors in accordance with the terms set forth in such agreement. This agreement will terminate upon the closing of the offering contemplated by this prospectus.


95


Table of Contents

Restricted Stock Grants
 
We have granted restricted stock to certain of our directors, as described in “Compensation Discussion & Analysis — Director Compensation.” We have also granted restricted stock to Messrs. Jackson and McDonough, as described in “Compensation Discussion & Analysis — Employment Agreements.”
 
Employment Agreements
 
We have employment agreements with certain of our named executive officers, as described in “Compensation Discussion & Analysis — Employment Agreements.”
 
Policies and Procedures With Respect To Related Person Transactions
 
We have not adopted formal policies or procedures for the review, approval or ratification of transactions with related persons. Prior to the completion of this offering, we expect to adopt formal policies and procedures for approving related person transactions.


96


Table of Contents

 
PRINCIPAL AND SELLING STOCKHOLDERS
 
The following table provides certain information regarding the beneficial ownership of our outstanding capital stock with respect to:
 
  •  each person or group who beneficially owns more than 5% of our capital stock on a fully diluted basis;
 
  •  each of our executive officers named in the Summary Compensation Table;
 
  •  each of our directors; and
 
  •  all of our directors and executive officers as a group
 
This table assumes conversion of all outstanding shares of preferred stock into 14,302,128 shares of common stock immediately prior to the completion of this offering. The percentage of ownership indicated before this offering is based on 17,793,892 shares of common stock outstanding as of December 31, 2006. The percentage of ownership indicated after this offering is based on 23,113,892 shares, including the shares offered by this prospectus and assuming no exercise of the underwriters’ over-allotment option and no exercise of options outstanding after December 31, 2006.
 
Beneficial ownership of shares is determined under the rules of the Securities and Exchange Commission and generally includes any shares over which a person exercises sole or shared voting or investment power. Except as indicated by footnote, and subject to applicable community property laws, each person identified in the table possesses sole voting and investment power with respect to all shares of common stock held by them. Shares of common stock subject to options currently exercisable or exercisable within 60 days of December 31, 2006 and not subject to repurchase as of that date are deemed outstanding for calculating the percentage of outstanding shares of the person holding these options, but are not deemed outstanding for calculating the percentage of any other person.
 
Unless otherwise noted, the address for each director and executive officer is c/o Sourcefire, Inc., 9770 Patuxent Woods Drive, Columbia, Maryland 21046.
 
                                         
    Shares beneficially
    Shares
    Shares beneficially
 
    owned prior
    to be sold
    owned after this
 
    to this offering     in this
    offering  
Name of beneficial owner
  Number     Percent     offering     Number     Percent  
 
Beneficial owners of 5% or more of the outstanding common stock
                                       
Entities affiliated with Sierra Ventures(1)
    5,120,519       28.8 %     255,831       4,864,688       21.0 %
Entities affiliated with New Enterprise Associates(2)
    3,217,565       18.1 %           3,217,565       13.9 %
Entities affiliated with Inflection Point(3)
    1,570,711       8.8 %     78,476       1,492,235       6.5 %
Martin F. Roesch(4)
    1,503,489       8.4 %           1,503,489       6.5 %
Entities affiliated with Core Capital Partners(5)
    1,350,810       7.6 %     66,616       1,284,194       5.6 %
Entities affiliated with Sequoia Capital(6)
    1,340,797       7.5 %           1,340,797       5.8 %
Named executive officers
                                       
E. Wayne Jackson, III(7)
    797,565       4.5 %     39,848       757,717       3.3 %
Thomas M. McDonough(8)
    479,987       2.7 %           479,987       2.1 %
Todd P. Headley(9)
    122,895       *             122,895       *  
Joseph M. Boyle(10)
    32,712       *             32,712       *  
Michele M. Perry-Boucher(11)
    93,647       *             93,647       *  
Directors
                                       
Asheem Chandna(12)
    198,167       1.1 %           198,167       *  
Joseph R. Chinnici
                               
Tim A. Guleri(13)
    5,120,519       28.8 %     255,831       4,864,688       21.0 %
Steven R. Polk
                             
Arnold L. Punaro
                             
Harry R. Weller(14)
    3,217,565       18.1 %           3,217,565       13.9 %
All directors and executive officers as a group (12 persons)
    11,556,546       63.7 %     295,679       11,270,867       48.0 %
Other Selling Stockholder
                                       
Northcutt Family Revocable Living Trust
of 2002
    184,729       1.0 %     9,229       175,500       *  


97


Table of Contents

 
Less than 1% beneficial ownership.
 
(1) Includes 1,599,495 shares of common stock issuable upon conversion of preferred stock held by Sierra Ventures VIII, L.P., 3,153,956 shares of common stock issuable upon conversion of preferred stock held by Sierra Ventures VIII-A, L.P., 30,759 shares of common stock issuable upon conversion of preferred stock held by Sierra Ventures VII-B, L.P., 107,255 shares of common stock issuable upon conversion of preferred stock held by Sierra Ventures Associates VII, L.L.C., as nominee for its members and 229,054 shares of common stock issuable upon conversion of preferred stock held by Sierra Ventures Associates VIII, L.L.C., as nominee for its members. The address of these stockholders is c/o Sierra Ventures, 2884 Sand Hill Road, Suite 100, Menlo Park, CA 94025.
 
(2) Includes 3,209,580 shares of common stock issuable upon conversion of preferred stock held by New Enterprise Associates 10, Limited Partnership and 7,985 shares of common stock issuable upon conversion of preferred stock held by NEA Ventures 2003, Limited Partnership. The address of these stockholders is c/o New Enterprise Associates, 1119 St. Paul Street, Baltimore, MD 21202.
 
(3) Includes 1,099,498 shares of common stock issuable upon conversion of preferred stock held by Inflection Point Ventures II, L.P. and 471,213 shares of common stock issuable upon conversion of preferred stock held by Inflection Point Ventures, L.P. The address of these stockholders is c/o Inflection Point Ventures, 7903 Sleaford Place, Bethesda, MD 20814.
 
(4) Includes 1,477,832 shares of common stock and options exercisable within 60 days of December 31, 2006 to purchase 25,657 shares of common stock.
 
(5) Includes 1,080,649 shares of common stock issuable upon conversion of preferred stock held by Core Capital Partners, L.P., 252,682 shares of common stock issuable upon conversion of preferred stock held by Minotaur Funds, LLC and 17,479 shares of common stock issuable upon conversion of preferred stock held by Minotaur Annex Fund LLC. The address of these stockholders is c/o Core Capital Partners, 901 15th Street, N.W. Suite 950, Washington, D.C. 20005.
 
(6) Includes 1,179,902 shares of common stock issuable upon conversion of preferred stock held by Sequoia Capital Franchise Fund and 160,895 shares of common stock issuable upon conversion of preferred stock held by Sequoia Capital Franchise Partners. The address of these stockholders is c/o Sequoia Capital, 3000 Sand Hill Road, Bldg. 4, Suite 180, Menlo Park, CA 94025.
 
(7) Includes options exercisable within 60 days of December 31, 2006 to purchase 41,051 shares of common stock. Also includes 624,384 shares of common stock and 132,130 shares of common stock issuable upon conversion of preferred stock held by The E. Wayne Jackson III “Sourcefire, Inc.” GRAT. Mr. Jackson has voting and investment control with respect to the shares held by The E. Wayne Jackson III “Sourcefire, Inc.” GRAT.
 
(8) Includes options exercisable within 60 days of December 31, 2006 to purchase 38,485 shares of common stock. Also includes 441,502 shares of common stock held by The Revocable Trust of Thomas Michael McDonough, u/a July 19, 2005, Thomas M. McDonough, Trustee. Mr. McDonough has voting and investment control with respect to the shares held by The Revocable Trust of Thomas Michael McDonough, u/a July 19, 2005, Thomas M. McDonough, Trustee.
 
(9) Includes options exercisable within 60 days of December 31, 2006 to purchase 122,895 shares of common stock.
 
(10) Includes options exercisable within 60 days of December 31, 2006 to purchase 32,712 shares of common stock.
 
(11) Includes options exercisable within 60 days of December 31, 2006 to purchase 93,647 shares of common stock.
 
(12) Includes 98,522 shares of common stock and 99,645 shares of common stock issuable upon conversion of preferred stock held by Asheem Chandna and Aarti Chandna, as Trustees of the Chandna Family Revocable Trust of April 13, 1998. Ms. Chandna has voting and investment control with respect to the shares held by Asheem Chandna and Aarti Chandna, as Trustees of the Chandna Family Revocable Trust of April 13, 1998.
 
(13) Includes 1,599,495 shares of common stock issuable upon conversion of preferred stock held by Sierra Ventures VIII, L.P., 3,153,956 shares of common stock issuable upon conversion of preferred stock held by Sierra Ventures VIII-A, L.P., 30,759 shares of common stock issuable upon conversion of preferred stock held by Sierra Ventures VIII-B, L.P., 107,255 shares of common stock issuable upon conversion of preferred stock held by Sierra Ventures Associates VII, L.L.C., as nominee for its members and 229,054 shares of common stock issuable upon conversion of preferred stock held by Sierra Ventures Associates VIII, L.L.C., as nominee for its members. Mr. Guleri is a managing director of Sierra Ventures Associates VII, L.L.C., which is the general partner of Sierra Ventures VII, L.P. and a managing director of Sierra Ventures Associates VIII, L.L.C., which is the general partner of Sierra Ventures VIII-A, L.P. and Sierra Ventures VIII-B, L.P. Mr. Guleri does not have voting or dispositive power with respect to any of these shares listed. Therefore, Mr. Guleri disclaims beneficial ownership of all these shares listed, except to the extent of his proportionate pecuniary interest therein.
 
(14) Includes 3,209,580 shares of common stock issuable upon conversion of preferred stock held by New Enterprise Associates 10, Limited Partnership, for which voting and investment power is shared by M. James Barrett, Peter J. Barris, C. Richard Kramlich, Peter T. Morris, Charles W. Newhall III, Mark W. Perry, Scott D. Sandell and Eugene A. Trainor III, each of whom is a general partner of NEA Partners 10, Limited Partnership, the general partner of New Enterprise Associates 10, Limited Partnership and 7,985 shares of common stock issuable upon conversion of preferred stock held by NEA Ventures 2003, Limited Partnership, for which voting and investment power is held by its general partner, J. Daniel Morre. Mr. Weller, a partner of NEA Partners 10, Limited Partnership, and each of the general partners of NEA Partners 10, Limited Partnership and NEA Ventures 2003, Limited Partnership disclaims beneficial ownership of the shares held by each of the aforementioned entities except to the extent of his pecuniary interest therein. Mr. Weller does not have voting power or dispositive power with respect to any of the shares listed.


98


Table of Contents

 
DESCRIPTION OF CAPITAL STOCK
 
Our certificate of incorporation will be restated prior to the consummation of this offering. The following description of the material terms of our capital stock contained in the restated certificate of incorporation is only a summary. You should read it together with our restated certificate of incorporation and our amended and restated bylaws, which are included as exhibits to the registration statement of which this prospectus is a part. The descriptions of the common stock and preferred stock reflect changes to our capital structure that will occur immediately prior to the closing of this offering.
 
General
 
As of December 31, 2006, there were 3,491,764 shares of common stock issued and outstanding and 18,276,107 shares of preferred stock issued and outstanding. As of December 31, 2006, there were 52 holders of record of our common stock.
 
Immediately prior to the completion of this offering, all outstanding shares of our preferred stock will be converted into shares of our common stock pursuant to a written consent executed by the holders of the requisite number of shares of each class of our preferred stock to voluntarily convert their shares of our preferred stock into shares of our common stock. Upon the completion of this offering, our authorized capital stock will consist of 240,000,000 shares of common stock, par value $0.001 per share, and 20,000,000 shares of preferred stock, par value $0.001 per share, all of which shares of preferred stock will be undesignated. Our board of directors may establish the rights and preferences of the preferred stock from time to time, without stockholder approval.
 
Common Stock
 
Subject to any preferential voting rights of any outstanding preferred stock, each holder of our common stock is entitled to one vote for each share on all matters to be voted upon by the stockholders, and there are no cumulative rights. Subject to any preferential rights of any outstanding preferred stock, holders of our common stock will be entitled to receive ratably the dividends, if any, as may be declared from time to time by our board of directors out of funds legally available therefor. If there is a liquidation, dissolution or winding up of our company, holders of our common stock would be entitled to receive all assets of Sourcefire available for distribution to its stockholders, subject to any preferential rights of any outstanding preferred stock.
 
Holders of our common stock will have no preemptive or conversion rights or other subscription rights, and there will be no redemption or sinking fund provisions applicable to the common stock. All outstanding shares of our common stock will be fully paid and non-assessable. The rights, preferences and privileges of the holders of our common stock will be subject to, and may be adversely affected by, the rights of the holders of shares of any series of preferred stock which we may designate and issue in the future.
 
Preferred Stock
 
Under the terms of our restated certificate of incorporation, our board of directors is authorized to designate and issue shares of preferred stock in one or more series without stockholder approval. Our board of directors has the discretion to determine the rights, preferences, privileges and restrictions, including voting rights, dividend rights, conversion rights, redemption privileges and liquidation preferences, of each series of preferred stock.
 
The purpose of authorizing our board of directors to issue preferred stock and determine its rights and preferences is to eliminate delays associated with a stockholder vote on specific issuances. The issuance of preferred stock, while providing flexibility in connection with possible future acquisitions and other corporate purposes, will affect, and may adversely affect, the rights of holders of common stock. It is not possible to state the actual effect of the issuance of any shares of preferred stock on the rights of holders of common stock until the board of directors determines the specific rights attached to that preferred stock. The effects of issuing preferred stock could include one or more of the following:
 
  •  restricting dividends on the common stock;
 
  •  diluting the voting power of the common stock;


99


Table of Contents

 
  •  impairing the liquidation rights of the common stock; or
 
  •  delaying or preventing changes in control or management of our Company.
 
We have no present plans to issue any shares of preferred stock.
 
Registration Rights for Holders of Our Currently Outstanding Convertible Preferred Stock
 
Immediately prior to the completion of this offering, all outstanding shares of all series of our convertible preferred stock will be converted into shares of common stock according to the formula set forth in our current certificate of incorporation.
 
In May and June 2006, we and the holders of all series of our convertible preferred stock entered into the fourth amended and restated investor rights agreement, which is included as an exhibit to the registration statement of which this prospectus is a part.
 
Under the agreement, upon the request of the holders of at least 20% of the registrable shares (as defined in the agreement) at any time commencing six months after the closing of this offering, we are required to file with the SEC and cause to be declared effective a registration statement on Form S-1 covering the resale of all shares of common stock issued or issuable upon the conversion of the shares of our Series A, B, C and D convertible preferred stock. If requested by the holders of at least 10% of the registrable shares (as defined in the agreement), we will effect, subject to certain terms and conditions, a registration on Form S-3, if it is available, to facilitate the sale and distribution of the shares of common stock issued or issuable upon the conversion of their shares of Series A, B, C and D convertible preferred stock. Finally, if we propose to register any of our capital stock under the Securities Act, the holders of all series of our convertible preferred stock will be entitled to customary “piggyback” registration rights with respect to shares of common stock issued or issuable upon the conversion of the shares of our Series A, B, C and D convertible preferred stock.
 
Transfer Agent and Registrar
 
Continental Stock Transfer & Trust Company is the transfer agent and registrar for the common stock.


100


Table of Contents

 
SHARES ELIGIBLE FOR FUTURE SALE
 
If our stockholders sell substantial amounts of our common stock, including shares issued upon the exercise of outstanding options or warrants, in the public market following the offering, the market price of our common stock could decline. These sales also might make it more difficult for us to sell equity or equity- related securities in the future at a time and price that we deem appropriate.
 
Upon completion of the offering, we will have outstanding an aggregate of 23,113,892 shares of our common stock, assuming no exercise of the underwriters’ over-allotment option and no exercise of outstanding options. Of these shares, all of the shares sold in the offering will be freely tradeable without restriction or further registration under the Securities Act, unless the shares are purchased by “affiliates” as that term is defined in Rule 144 under the Securities Act. This leaves shares eligible for sale in the public market as follows:
 
         
Number of
   
Shares
 
Date
16,185
  After 90 days from the date of this prospectus (subject, in some cases, to volume limitations).
17,777,707
  At various times after 180 days from the date of this prospectus as described below under “Lock-up Agreements.”
 
Rule 144
 
In general, under Rule 144 as currently in effect, beginning 90 days after the date of this prospectus, a person who has beneficially owned shares of our common stock for at least one year would be entitled to sell within any three-month period a number of shares that does not exceed the greater of:
 
  •  1.0% of the number of shares of our common stock then outstanding, which will equal approximately 235,639 shares immediately after the offering; or
 
  •  the average weekly trading volume of our common stock on the Nasdaq Global Market during the four calendar weeks preceding the filing of a notice on Form 144 with respect to that sale.
 
Sales under Rule 144 are also subject to manner of sale provisions and notice requirements and to the availability of current public information about us.
 
Rule 144(k)
 
Under Rule 144(k), a person who is not deemed to have been one of our affiliates at any time during the three months preceding a sale, and who has beneficially owned the shares proposed to be sold for at least two years, including the holding period of any prior owner other than an affiliate, is entitled to sell those shares without complying with the manner of sale, public information, volume limitation or notice provisions of Rule 144.
 
Lock-Up Agreements
 
All of our officers and directors and certain of our stockholders have entered into lock-up agreements under which they agreed not to transfer or dispose of, directly or indirectly, any shares of our common stock or any securities convertible into or exercisable or exchangeable for shares of our common stock, for a period of 180 days after the date of this prospectus, without the prior written consent of Morgan Stanley & Co. Incorporated on behalf of the underwriters.
 
Rule 701 and Form S-8
 
In general, under Rule 701 of the Securities Act as currently in effect, any of our employees, consultants or advisors who is not one of our affiliates and who purchases shares of our common stock from us in connection with a compensatory stock or option plan or other written agreement is eligible to resell those shares 90 days after the effective date of this prospectus in reliance on Rule 144, but without compliance with some of the restrictions, including the holding period, contained in Rule 144.
 
Following the offering, we intend to file a registration statement on Form S-8 under the Securities Act covering approximately 6,362,672 shares of common stock issued or issuable upon the exercise of stock options, subject to outstanding options or reserved for issuance under our employee and director stock benefit plans. Accordingly, shares registered under that registration statement will, subject to Rule 144 provisions applicable to affiliates, be available for sale in the open market, except to the extent that the shares are subject to vesting restrictions or the contractual restrictions described above. See “Compensation Discussion and Analysis — Employee Benefits Plans.”


101


Table of Contents

 
CERTAIN MATERIAL U.S. FEDERAL INCOME TAX
CONSIDERATIONS TO NON-U.S. HOLDERS
 
The following summary describes certain material United States federal income tax consequences of the ownership and disposition of our common stock by a Non-U.S. Holder (as defined below) holding shares of our common stock as capital assets as of the date of this prospectus. This discussion does not address all aspects of United States federal income taxation and does not deal with estate, gift, foreign, state and local tax consequences that may be relevant to such Non-U.S. Holders in light of their personal circumstances. Special U.S. tax rules may apply to certain Non-U.S. Holders, such as “controlled foreign corporations,” “passive foreign investment companies,” corporations that accumulate earnings to avoid U.S. federal income tax, investors in partnerships or other pass-through entities for U.S. federal income tax purposes, dealers in securities, holders of securities held as part of a “straddle,” “hedge,” “conversion transaction” or other risk reduction transaction, and certain former citizens or long-term residents of the United States that are subject to special treatment under the Internal Revenue Code of 1986, as amended (the “Code”). Such entities and persons should consult their own tax advisors to determine the U.S. federal, state, local and other tax consequences that may be relevant to them. Furthermore, the discussion below is based upon the provisions of the Code and Treasury regulations promulgated thereunder, and rulings and judicial decisions interpreting the foregoing as of the date hereof; such authorities may be repealed, revoked or modified with or without retroactive effect so as to result in United States federal income tax consequences different from those discussed below.
 
If a partnership (or an entity treated as a partnership for U.S. federal income tax purposes) holds our common stock, the tax treatment of a partner will generally depend on the status of the partner and the activities of the partnership. Accordingly, persons who are partners in partnerships holding our common stock should consult their tax advisors.
 
The authorities on which this summary is based are subject to various interpretations, and any views expressed within this summary are not binding on the Internal Revenue Service (the “IRS”) or the courts. No assurance can be given that the IRS or the courts will agree with the tax consequences described in this prospectus.
 
As used herein, a “Non-U.S. Holder” means a beneficial owner of our common stock that is not any of the following for U.S. federal income tax purposes:
 
  •  a citizen or resident of the United States,
 
  •  a corporation (or other entity treated as a corporation for United States federal income tax purposes) created or organized in or under the laws of the United States, any state thereof or the District of Columbia,
 
  •  an estate the income of which is subject to United States federal income taxation regardless of its source, or
 
  •  a trust (i) which is subject to primary supervision by a court situated within the United States and as to which one or more United States persons have the authority to control all substantial decisions of the trust, or (ii) that has a valid election in effect under applicable U.S. Treasury regulations to be treated as a United States person.
 
PROSPECTIVE PURCHASERS ARE URGED TO CONSULT THEIR OWN TAX ADVISORS REGARDING THE U.S. FEDERAL INCOME TAX CONSEQUENCES, AS WELL AS OTHER U.S. FEDERAL, STATE, AND LOCAL INCOME AND ESTATE TAX CONSEQUENCES, AND NON-U.S. TAX CONSEQUENCES, TO THEM OF ACQUIRING, OWNING, AND DISPOSING OF OUR COMMON STOCK.
 
Dividends
 
If we make distributions on our common stock, such distributions paid to a Non-U.S. Holder will generally constitute dividends for U.S. federal income tax purposes to the extent such distributions are paid from our current or accumulated earnings and profits, as determined under U.S. federal income tax principles. If a distribution exceeds our current and accumulated earnings and profits, the excess will be treated as a tax-free return of the Non-U.S. Holder’s investment to the extent of the Non-U.S. Holder’s adjusted tax basis in our common stock. Any remaining excess will be treated as capital gain. See “— Gain on Disposition of Common Stock” below for additional information.


102


Table of Contents

Dividends paid to a Non-U.S. Holder generally will be subject to withholding of United States federal income tax at a 30% rate or such lower rate as may be specified by an applicable income tax treaty. A Non-U.S. Holder of common stock who wishes to claim the benefit of an exemption from withholding under provisions of an applicable treaty or an applicable treaty rate for dividends will be required to (a) complete IRS Form W-8BEN (or appropriate substitute form) and certify, under penalty of perjury, that such holder is not a U.S. person and is eligible for the benefits with respect to dividends allowed by such treaty or (b) hold common stock through certain foreign intermediaries and satisfy the certification requirements for treaty benefits of applicable Treasury regulations. Special certification requirements apply to certain Non-U.S. Holders that are “pass-through” entities for U.S. federal income tax purposes. A Non-U.S. Holder eligible for a reduced rate of United States withholding tax pursuant to an income tax treaty may obtain a refund of any excess amounts withheld by timely filing an appropriate claim for refund with the IRS.
 
Subject to variations under applicable treaties, this United States withholding tax generally will not apply to dividends that are effectively connected with the conduct of a trade or business by the Non-U.S. Holder within the United States. Dividends effectively connected with the conduct of a United States trade or business are instead subject to United States federal income tax generally in the same manner as if the Non-U.S. Holder were a U.S. person, as defined under the Code. In order to obtain this exemption from withholding on effectively connected dividends, a Non-U.S. Holder must provide to the payor or withholding agent a valid IRS Form W-8ECI or other successor form properly certifying such exemption. Any such effectively connected dividends received by a Non-U.S. Holder that is a foreign corporation may, under certain circumstances, be subject to an additional “branch profits tax” at a 30% rate or such lower rate as may be specified by an applicable income tax treaty.
 
Gain on Disposition of Common Stock
 
A Non-U.S. Holder generally will not be subject to United States federal income tax (or any withholding thereof) with respect to gain recognized on a sale or other disposition of our common stock unless:
 
  •  the gain is effectively connected with a trade or business of the Non-U.S. Holder in the United States or, where a tax treaty applies, is attributable to a United States permanent establishment or fixed base of the Non-U.S. Holder,
 
  •  the Non-U.S. Holder is an individual who is present in the United States for 183 or more days during the taxable year of disposition and meets certain other requirements, or
 
  •  we are or have been a “U.S. real property holding corporation” within the meaning of Section 897(c)(2) of the Code, also referred to as a USRPHC, for United States federal income tax purposes at any time within the five-year period preceding the disposition (or, if shorter, the Non-U.S. Holder’s holding period for the common stock).
 
Gain recognized on the sale or other disposition of our common stock that is effectively connected with a United States trade or business, or attributable to a United States permanent establishment or fixed base of the Non-U.S. Holder under an applicable treaty, is subject to United States federal income tax on a net income basis generally in the same manner as if the Non-U.S. Holder were a U.S. person, as defined under the Code. Any such effectively connected gain from the sale or disposition of our common stock received by a Non-U.S. Holder that is a foreign corporation may, under certain circumstances, be subject to an additional “branch profits tax” at a 30% rate or such lower rate as may be specified by an applicable income tax treaty.
 
An individual Non-U.S. Holder who is present in the United States for 183 or more days during the taxable year of disposition generally will be subject to a 30% tax imposed on the gain derived from the sale or disposition of our common stock, which may be offset by U.S. source capital losses realized in the same taxable year.
 
In general, a corporation is a USRPHC if the fair market value of its “U.S. real property interests” equals or exceeds 50% of the sum of the fair market value of its worldwide (domestic and foreign) real property interest and its other assets used or held for use in a trade or business. For this purpose, real property interests include land, improvements and associated personal property.


103


Table of Contents

We believe that we currently are not a USRPHC. In addition, based on our financial statements and current expectations regarding the value and nature of our assets and other relevant data, we do not anticipate becoming a USRPHC.
 
If we become a USRPHC, a Non-U.S. Holder nevertheless will not be subject to United States federal income tax if our common stock is regularly traded on an established securities market, within the meaning of applicable Treasury regulations, and the Non-U.S. Holder holds no more than five percent of our outstanding common stock, directly or indirectly, during the applicable testing period. We have applied to list our common stock for quotation on the Nasdaq Global Market and we expect that our common stock may be regularly traded on an established securities market in the United States so long as it is so quoted.
 
Information Reporting and Backup Withholding
 
We must report annually to the IRS and to each Non-U.S. Holder the amount of dividends paid to such holder and the tax withheld with respect to such dividends, regardless of whether withholding was required. Copies of the information returns reporting such dividends and withholding may also be made available to the tax authorities in the country in which the Non-U.S. Holder resides under the provisions of an applicable income tax treaty.
 
The United States imposes a backup withholding tax on dividends and certain other types of payments to United States persons (currently at a rate of 28%) of the gross amount. Dividends paid to a Non-U.S. Holder will not be subject to backup withholding if proper certification of foreign status (usually on the forms described above) is provided, and the payor does not have actual knowledge or reason to know that the beneficial owner is a United States person, or the holder is a corporation or one of several types of entities and organizations that qualify for exemption.
 
Backup withholding is not an additional tax. Any amounts withheld under the backup withholding rules may be allowed as a refund or a credit against such holder’s U.S. federal income tax liability provided the required information is timely furnished to the IRS.


104


Table of Contents

 
UNDERWRITERS
 
Under the terms and subject to the conditions contained in an underwriting agreement dated the date of this prospectus, the underwriters named below, for whom Morgan Stanley & Co. Incorporated is acting as representative, have severally agreed to purchase, and we and the selling stockholders have agreed to sell to them, severally, the number of shares indicated below:
 
         
    Number of
 
Name
  Shares  
 
Morgan Stanley & Co. Incorporated
       
Lehman Brothers Inc. 
       
UBS Securities LLC
       
Jefferies & Company, Inc. 
                     
         
Total
    5,770,000  
         
 
The underwriters are offering the shares of common stock subject to their acceptance of the shares from us and the selling stockholders and subject to prior sale. The underwriting agreement provides that the obligations of the several underwriters to pay for and accept delivery of the shares of common stock offered by this prospectus are subject to the approval of certain legal matters by their counsel and to certain other conditions. The underwriters are obligated to take and pay for all of the shares of common stock offered by this prospectus if any such shares are taken. However, the underwriters are not required to take or pay for the shares covered by the underwriters’ over-allotment option described below.
 
In the agreement among the underwriters, sales may be made between the underwriters of any number of shares as may be mutually agreed. The per share price of any shares sold by the underwriters shall be the public offering price listed on the cover page of this prospectus, less an amount not greater than the per share amount of the concession to dealers described below.
 
The underwriters initially propose to offer part of the shares of common stock directly to the public at the public offering price listed on the cover page of this prospectus and part to certain dealers at a price that represents a concession not in excess of $      a share under the public offering price. After the initial offering of the shares of common stock, the offering price and other selling terms may from time to time be varied by the representative.
 
We have granted to the underwriters an option, exercisable for 30 days from the date of this prospectus, to purchase up to an aggregate of 865,500 additional shares of common stock at the public offering price listed on the cover page of this prospectus, less underwriting discounts and commissions. The underwriters may exercise this option solely for the purpose of covering over-allotments, if any, made in connection with the offering of the shares of common stock offered by this prospectus. To the extent the option is exercised, each underwriter will become obligated, subject to certain conditions, to purchase about the same percentage of the additional shares of common stock as the number listed next to the underwriter’s name in the preceding table bears to the total number of shares of common stock listed next to the names of all underwriters in the preceding table. If the underwriters’ option is exercised in full, the total price to the public would be $     , the total underwriting discounts and commissions paid by us and the selling stockholders would be $      and $     , respectively; and total proceeds to us and the selling stockholders would be $           and $     , respectively. Any shares sold pursuant to the over-allotment option will be sold by the Company.
 
The underwriters have informed us that they do not intend sales to discretionary accounts to exceed five percent of the total number of shares of common stock offered by them.
 
We have applied for quotation of our common stock on the Nasdaq Global Market under the symbol “FIRE.”


105


Table of Contents

We, our directors, executive officers, the selling stockholders and certain other stockholders of Sourcefire, Inc. have agreed that, without the prior written consent of Morgan Stanley & Co. Incorporated on behalf of the underwriters, we and they will not, during the period ending 180 days after the date of this prospectus:
 
  •  offer, pledge, sell, contract to sell, sell any option or contract to purchase, purchase any option or contract to sell, grant any option, right or warrant to purchase, lend, or otherwise transfer or dispose of, directly or indirectly, any shares of common stock or any securities convertible into or exercisable or exchangeable for common stock;
 
  •  enter into any swap or other arrangement that transfers to another, in whole or in part, any of the economic consequences of ownership of the common stock; or
 
  •  file any registration statement with the SEC relating to the offering of any shares of common stock or any securities convertible into or exercisable or exchangeable for common stock, except for registration statements on Form S-8 (or other equivalent forms);
 
whether any such transaction described above is to be settled by delivery of common stock or such other securities, in cash or otherwise.
 
The restrictions described in this paragraph do not apply to:
 
  •  the sale of shares to the underwriters;
 
  •  the issuance by us of restricted shares of common stock or options to acquire common stock pursuant to our employee benefit plans, stock option plans or employee compensation plans described herein;
 
  •  the issuance by us of shares of common stock upon the exercise of an option that was issued pursuant to our employee benefit plans, stock option plans or other employee compensation plans;
 
  •  the issuance by us of shares of common stock upon the exercise of a warrant or the conversion of a security outstanding on the date of this prospectus pursuant to our existing employee benefit plans or of which the underwriters have been advised in writing;
 
  •  transactions relating to shares of common stock or other securities acquired in open market transactions after the completion of the offering of the shares;
 
  •  transfers of shares of common stock or any security convertible into common stock as a bona fide gift; or
 
  •  transfers of shares of common stock to any trust, partnership or limited liability company for the direct or indirect benefit of the signer or the immediate family of the signer;
 
  •  distributions of shares of common stock or any security convertible into common stock to limited partners or stockholders of the signer; or
 
  •  the issuance by us of up to 300,000 shares of common stock in connection with an acquisition or other business combination;
 
provided that (i) each recipient shall sign and deliver a lock-up agreement and (ii) no filing under Section 16(a) of the Exchange Act, reporting a reduction in beneficial ownership of shares of common stock, shall be required or shall be voluntarily made in connection with such transfer or distribution during the 180 day restricted period (including extensions).
 
The 180 day restricted period described in the preceding paragraph will be extended if:
 
  •  during the last 17 days of the 180 day restricted period, we issue an earnings release or material news or a material event relating to us occurs; or
 
  •  prior to the expiration of the 180 day restricted period, we announce that we will release earnings results during the 16 day period beginning on the last day of the 180 day period,


106


Table of Contents

in which case the restrictions described in the preceding paragraph will continue to apply until the expiration of the 18 day period beginning on the issuance of the earnings release or the occurrence of material news or a material event.
 
The following table shows the per share and total underwriting discounts and commissions that we and the selling stockholders are to pay to the underwriters in connection with this offering. These amounts are shown assuming both no exercise and full exercise of the underwriters’ option to purchase additional shares of our common stock.
 
                                                 
    Paid by Us     Paid by Selling Stockholders     Total  
          Full
          Full
          Full
 
    No Exercise     Exercise     No Exercise     Exercise     No Exercise     Exercise  
 
Per Share
  $                $               $                $               $                $            
Total
  $                $               $                $               $                $            
 
In order to facilitate the offering of the common stock, the underwriters may engage in transactions that stabilize, maintain or otherwise affect the price of the common stock. Specifically, the underwriters may sell more shares than they are obligated to purchase under the underwriting agreement, creating a short position. A short sale is covered if the short position is no greater than the number of shares available for purchase by the underwriters under the over-allotment option. The underwriters can close out a covered short sale by exercising the over-allotment option or purchasing shares in the open market. In determining the source of shares to close out a covered short sale, the underwriters will consider, among other things, the open market price of shares compared to the price available under the over-allotment option. The underwriters may also sell shares in excess of the over-allotment option, creating a naked short position. The underwriters must close out any naked short position by purchasing shares in the open market. A naked short position is more likely to be created if the underwriters are concerned that there may be downward pressure on the price of the common stock in the open market after pricing that could adversely affect investors who purchase in the offering. As an additional means of facilitating the offering, the underwriters may bid for, and purchase, shares of common stock in the open market to stabilize the price of the common stock. The underwriting syndicate may also reclaim selling concessions allowed to an underwriter or a dealer for distributing the common stock in the offering, if the syndicate repurchases previously distributed common stock to cover syndicate short positions or to stabilize the price of the common stock. These activities may raise or maintain the market price of the common stock above independent market levels or prevent or retard a decline in the market price of the common stock. The underwriters are not required to engage in these activities, and may end any of these activities at any time.
 
From time to time, Morgan Stanley & Co. Incorporated or the other underwriters and their respective affiliates may provide investment banking services to us.
 
A prospectus in electronic format may be made available on the web sites maintained by one or more of the underwriters, and one or more of the underwriters may distribute prospectuses electronically. The underwriters may agree to allocate a number of shares to underwriters for sale to their online brokerage account holders. Internet distributions will be allocated by the underwriters that make Internet distributions on the same basis as other allocations.
 
We, the selling stockholders, and the underwriters have agreed to indemnify each other against certain liabilities, including liabilities under the Securities Act.
 
Pricing of the Offering
 
Prior to this offering, there has been no public market for the shares of our common stock. The initial public offering price will be determined by negotiations among us, the selling stockholders and the representative of the underwriters. Among the factors to be considered in determining the initial public offering price will be our future prospects and those of our industry in general, our sales, earnings and certain other financial operating information in recent periods, and the price-earnings ratios, price-sales ratios, market prices of securities and certain financial and operating information of companies engaged in activities similar to ours. The estimated initial public offering price range set forth on the cover page of this preliminary prospectus is subject to change as a result of market conditions and other factors.


107


Table of Contents

 
LEGAL MATTERS
 
The validity of the shares of common stock offered hereby will be passed upon for us by our counsel, Morrison & Foerster LLP, McLean, Virginia. Various legal matters relating to this offering will be passed upon for the underwriters by Latham & Watkins LLP, New York, New York.
 
EXPERTS
 
The consolidated financial statements of Sourcefire, Inc. at December 31, 2005 and 2006 and for each of the three years in the period ended December 31, 2006 appearing in this prospectus and registration statement have been audited by Ernst & Young LLP, independent registered public accounting firm, as set forth in their report thereon appearing elsewhere herein, and are included in reliance upon such report given on the authority of such firm as experts in accounting and auditing.
 
WHERE YOU CAN FIND MORE INFORMATION
 
We have filed with the SEC a registration statement under the Securities Act with respect to the shares of our common stock offered by this prospectus. This prospectus, filed as a part of the registration statement, does not contain all of the information set forth in the registration statement or the exhibits and schedules thereto as permitted by the rules and regulations of the SEC. For further information about us and our common stock, you should refer to the registration statement. This prospectus summarizes provisions that we consider material of certain contracts and other documents to which we refer you. Because the summaries may not contain all of the information that you may find important, you should review the full text of those documents. We have included copies of those documents as exhibits to the registration statement.
 
The registration statement and the exhibits thereto filed with the SEC may be inspected, without charge, and copies may be obtained at prescribed rates, at the public reference facility maintained by the SEC at 100 F Street, N.E., Washington, D.C. 20549. You may obtain information on the operation of the public reference room by calling the SEC at 1-800-SEC-0330. The registration statement and other information filed by us with the SEC are also available at the SEC’s website at www.sec.gov.
 
As a result of the offering, we and our stockholders will become subject to the proxy solicitation rules, annual and periodic reporting requirements, restrictions of stock purchases and sales by affiliates and other requirements of the Securities Exchange Act of 1934, as amended. We will furnish our stockholders with annual reports containing audited financial statements certified by independent auditors and quarterly reports containing unaudited financial statements for the first three quarters of each fiscal year.


108


Table of Contents

SOURCEFIRE, INC.
 
CONSOLIDATED FINANCIAL STATEMENTS
 
Contents
 
         
    F-2  
         
Consolidated Financial Statements:
       
         
    F-3  
         
    F-5  
         
    F-6  
         
    F-7  
         
    F-8  


F-1


Table of Contents

 
REPORT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTING FIRM
 
 
The Board of Directors and Stockholders of Sourcefire, Inc.
 
We have audited the accompanying consolidated balance sheets of Sourcefire, Inc. (the Company) as of December 31, 2005 and 2006, and the related consolidated statements of operations, changes in convertible preferred stock and stockholders’ deficit, and cash flows for each of the three years in the period ended December 31, 2006. These financial statements are the responsibility of the Company’s management. Our responsibility is to express an opinion on these financial statements based on our audits.
 
We conducted our audits in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. We were not engaged to perform an audit of the Company’s internal control over financial reporting. Our audit included consideration of internal control over financial reporting as a basis for designing audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the Company’s internal control over financial reporting. Accordingly, we express no such opinion. An audit also includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements, assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe that our audits provide a reasonable basis for our opinion.
 
In our opinion, the financial statements referred to above present fairly, in all material respects, the consolidated financial position of Sourcefire, Inc. at December 31, 2005 and 2006, and the consolidated results of its operations and its cash flows for each of the three years in the period ended December 31, 2006 in conformity with U.S. generally accepted accounting principles.
 
As discussed in Note 2 to the financial statements, in 2006 the Company changed its method of accounting for stock-based compensation.
 
 
/s/ Ernst & Young LLP
Baltimore, Maryland
January 30, 2007
(except with respect to the matter discussed in Note 14,
as to which the date is February 22, 2007)


F-2


Table of Contents

SOURCEFIRE, INC.
 
CONSOLIDATED BALANCE SHEETS
 
                         
                Pro forma
 
    December 31     December 31
 
    2005     2006     2006  
    (dollars in thousands, except share and per share data)  
                (unaudited)  
 
Assets
Current assets:
                       
Cash and cash equivalents
  $ 1,106     $ 13,029     $ 13,029  
Held-to-maturity investments
    2,005       12,385       12,385  
Accounts receivable, net of allowance for doubtful accounts of $127 in 2005 and $166 in 2006
    12,917       16,507       16,507  
Inventory
    1,755       2,099       2,099  
Prepaid expenses and other current assets
    758       919       919  
                         
Total current assets
    18,541       44,939       44,939  
Property and equipment, net
    2,522       2,546       2,546  
Held-to-maturity investments, less current portion
          908       908  
Other assets
    187       1,559       1,559  
                         
Total assets
  $ 21,250     $ 49,952     $ 49,952  
                         
                         
Liabilities, convertible preferred stock and
stockholders’ equity (deficit)
                       
Current liabilities:
                       
Accounts payable
  $ 2,134     $ 3,081     $ 3,081  
Accrued compensation and related expenses
    1,552       1,783       1,783  
Other accrued expenses
    652       1,312       1,312  
Current portion of deferred revenue
    9,137       11,735       11,735  
Current portion of long-term debt
    514       675       675  
Other current liabilities
    417       501       501  
                         
Total current liabilities
    14,406       19,087       19,087  
Deferred revenue, less current portion
    1,458       2,380       2,380  
Long-term debt, less current portion
    476       637       637  
                         
Total liabilities
    16,340       22,104       22,104  
Series A convertible preferred stock, $0.001 par value; 2,495,410 shares authorized, 2,475,410 shares issued and outstanding at December 31, 2005 and 2006 and no shares outstanding on a pro forma basis; aggregate liquidation preference of $13,489 and $14,093 at December 31, 2005 and 2006, respectively
    9,598       10,308        
Warrants to purchase Series A convertible preferred stock
    25       25        


F-3


Table of Contents

 
SOURCEFIRE, INC.
 
CONSOLIDATED BALANCE SHEETS — (Continued)

                         
                Pro forma
 
    December 31     December 31
 
    2005     2006     2006  
    (dollars in thousands, except share and per share data)  
                (unaudited)  
 
Series B convertible preferred stock, $0.001 par value; 7,132,205 shares authorized, issued and outstanding at December 31, 2005 and 2006 and no shares outstanding on a pro forma basis; aggregate liquidation preference of $19,067 and $19,947 at December 31, 2005 and 2006, respectively
    13,318       14,265        
Series C convertible preferred stock, $0.001 par value; 5,404,043 shares authorized, issued and outstanding at December 31, 2005 and 2006 and no shares outstanding on a pro forma basis; aggregate liquidation preference of $24,850 and $26,050 at December 31, 2005 and 2006, respectively
    17,066       18,270        
Series D convertible preferred stock, $0.001 par value; 3,264,449 shares authorized, issued and outstanding at December 31, 2006 and no shares outstanding on a pro forma basis; aggregate liquidation preference of $29,847 at December 31, 2006
          23,879        
                         
Total convertible preferred stock
    40,007       66,747        
                         
Commitments and contingent liabilities
                       
Stockholders’ equity (deficit):
                       
Common stock, $0.001 par value; 35,000,000 and 36,500,000 shares authorized at December 31, 2005 and 2006, respectively; 3,407,682 and 3,491,764 shares issued and outstanding at December 31, 2005 and 2006, respectively, and 17,793,892 shares outstanding on a pro forma basis
    3       3       18  
Additional paid-in capital
                66,732  
Unearned compensation
    (20 )            
Accumulated deficit
    (35,080 )     (38,902 )     (38,902 )
                         
Total stockholders’ equity (deficit)
    (35,097 )     (38,899 )     27,848  
                         
Total liabilities, convertible preferred stock and stockholders’ equity (deficit)
  $ 21,250     $ 49,952     $ 49,952  
                         
 
See accompanying notes.


F-4


Table of Contents

SOURCEFIRE, INC.

CONSOLIDATED STATEMENTS OF OPERATIONS
 
                         
    Year Ended December 31  
    2004     2005     2006  
 
Revenue:
                       
Products
  $ 12,738     $ 23,589     $ 30,219  
Technical support and professional services
    3,955       9,290       14,707  
                         
Total revenue
    16,693       32,879       44,926  
Cost of revenue:
                       
Products
    4,533       6,610       8,440  
Technical support and professional services
    872       1,453       2,632  
                         
Total cost of revenue
    5,405       8,063       11,072  
Gross profit
    11,288       24,816       33,854  
Operating expenses:
                       
Research and development
    5,706       6,831       8,612  
Sales and marketing
    12,585       17,135       20,652  
General and administrative
    2,905       5,120       5,017  
Depreciation and amortization
    752       1,103       1,230  
                         
Total operating expenses
    21,948       30,189       35,511  
                         
Loss from operations
    (10,660 )     (5,373 )     (1,657 )
Other income (expense):
                       
Interest and investment income
    162       101       784  
Interest expense
    (66 )     (98 )     (87 )
Other income (expense)
    68       (88 )     95  
                         
Total other income (expense)
    164       (85 )     792  
                         
Loss before income taxes
    (10,496 )     (5,458 )     (865 )
Income tax expense
                (67 )
                         
Net loss
    (10,496 )     (5,458 )     (932 )
Accretion of preferred stock
    (2,451 )     (2,668 )     (3,819 )
                         
Net loss attributable to common stockholders
  $ (12,947 )   $ (8,126 )   $ (4,751 )
                         
Net loss attributable to common stockholders per share:
                       
Basic and diluted
  $ (4.97 )   $ (2.54 )   $ (1.40 )
Pro forma (unaudited)
                    (0.06 )
Weighted average shares outstanding used in computing per share amounts:
                       
Basic and diluted
    2,602,743       3,200,318       3,389,527  
Pro forma (unaudited)
                    16,885,981  
 
See accompanying notes.


F-5


Table of Contents

SOURCEFIRE, INC.
CONSOLIDATED STATEMENTS OF CHANGES IN CONVERTIBLE PREFERRED STOCK AND STOCKHOLDERS’ DEFICIT
 
                                                                                                                                 
                      Warrants to
                                                                         
                Subscription
    Purchase
                                                                         
                Receivable For
    Series A
                                        Stockholders’ Deficit  
    Series A Convertible
    Series A
    Convertible
    Series B Convertible
    Series C Convertible
    Series D Convertible
                Additional
                   
    Preferred Stock     Convertible
    Preferred
    Preferred Stock     Preferred Stock     Preferred Stock     Common Stock     Paid-in
    Unearned
    Accumulated
       
    Shares     Amount     Preferred Stock     Stock     Shares     Amount     Shares     Amount     Shares     Amount     Shares     Amount     Capital     Compensation     Deficit     Total  
    (Dollars in thousands)  
 
Balance at January 1, 2004
    2,475,410     $ 8,323     $  —         $25       7,132,205     $ 11,610           $  —               $ —          3,042,117       $3     $  —       $ (167 )   $ (14,644 )   $ (14,808 )
Exercise of common stock options
                                                                250,765             78                   78  
Compensation expense for stock option modifications
                                                                            85                   85  
Issuance of Series C redeemable convertible preferred stock, net of direct costs
                                                                                                                               
of issuance of $70
                                        5,404,043       14,930                                                  
Accretion of convertible preferred stock to redemption value
          615                         825             1,011                               (163 )           (2,288 )     (2,451 )
Amortization of unearned compensation
                                                                                  92             92  
Net loss for 2004
                                                                                        (10,496 )     (10,496 )
                                                                                                                                 
Balance at December 31, 2004
    2,475,410       8,938             25       7,132,205       12,435       5,404,043       15,941                   3,292,882       3             (75 )     (27,428 )     (27,500 )
                                                                                                                                 
Exercise of common stock options
                                                                114,800             59                   59  
Compensation expense for stock option modifications
                                                                            415                   415  
Accretion of convertible preferred stock to redemption value
          660                         883             1,125                               (474 )           (2,194 )     (2,668 )
Amortization of unearned compensation
                                                                                  55             55  
Net loss for 2005
                                                                                        (5,458 )     (5,458 )
                                                                                                                                 
Balance at December 31, 2005
    2,475,410       9,598             25       7,132,205       13,318       5,404,043       17,066                   3,407,682       3             (20 )     (35,080 )     (35,097 )
Exercise of common stock options
                                                                84,082             143                   143  
Issuance of restricted common stock
                                                                            83                   83  
Compensation expense for stock option vesting
                                                                            703                   703  
Issuance of Series D redeemable convertible preferred stock, net of direct issuance costs of $79
                                                    3,264,449       22,921                                      
Accretion of convertible preferred stock to redemption value
          710                         947             1,204             958                   (929 )           (2,890 )     (3,819 )
Amortization of unearned compensation
                                                                                  20             20  
Net loss for 2006
                                                                                        (932 )     (932 )
                                                                                                                                 
Balance at December 31, 2006
    2,475,410     $ 10,308     $  —         $25       7,132,205     $ 14,265       5,404,043     $ 18,270       3,264,449       $23,879       3,491,764       $3     $  —      $  —       $ (38,902 )   $ (38,899 )
                                                                                                                                 
 
See accompanying notes.


F-6


Table of Contents

SOURCEFIRE, INC.
 
CONSOLIDATED STATEMENTS OF CASH FLOWS
 
                         
    Year Ended December 31  
    2004     2005     2006  
    (dollars in thousands)  
 
Operating activities
                       
Net loss
  $ (10,496 )   $ (5,458 )   $ (932 )
Adjustments to reconcile net loss to net cash (used in) provided by operating activities:
                       
Depreciation and amortization
    756       1,127       1,261  
Provision for doubtful accounts
    70       57       55  
Amortization of unearned compensation
    92       55       20  
Other non-cash stock compensation
    85       415       786  
Amortization of (premium) discount on held-to-maturity investments
    175       126       (81 )
Loss on disposal of assets
    27              
Changes in operating assets and liabilities:
                       
Accounts receivable
    (4,681 )     (5,120 )     (3,645 )
Inventory
    (409 )     (1,065 )     (344 )
Prepaid expenses and other assets
    (358 )     (229 )     (238 )
Accounts payable
    1,089       360       901  
Accrued expenses
    626       11       681  
Deferred revenue
    3,069       4,994       3,520  
Other current liabilities
    144       269       84  
                         
Net cash (used in) provided by operating activities
    (9,811 )     (4,458 )     2,068  
Investing activities
                       
Purchase of property and equipment
    (1,107 )     (2,207 )     (1,285 )
Purchase of held-to-maturity investments
    (10,028 )           (13,207 )
Proceeds from maturities of held-to-maturity investments
    4,103       3,620       2,000  
                         
Net cash (used in) provided by investing activities
    (7,032 )     1,413       (12,492 )
Financing activities
                       
Borrowings under revolving promissory note
          2,250        
Repayments of borrowings under revolving promissory note
          (2,250 )      
Borrowings of long-term debt
    420       1,000       887  
Repayments of long-term debt
    (304 )     (471 )     (565 )
Proceeds from issuance of Series C convertible preferred stock, net of offering costs
    14,930              
Proceeds from issuance of Series D convertible preferred stock, net of offering costs
                22,921  
Proceeds from exercise of stock options
    78       59       143  
Payment of deferred equity offering costs
                (1,039 )
Other
    (33 )            
                         
Net cash provided by financing activities
    15,091       588       22,347  
                         
Net increase (decrease) in cash and cash equivalents
    (1,752 )     (2,457 )     11,923  
Cash and cash equivalents at beginning of year
    5,315       3,563       1,106  
                         
Cash and cash equivalents at end of year
  $ 3,563     $ 1,106     $ 13,029  
                         
Supplemental cash flow information
                       
Cash paid for interest
  $ 46     $ 70     $ 68  
Cash paid for income taxes
  $     $     $ 25  
 
See accompanying notes.


F-7


Table of Contents

SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS
 
1.   Description of Business and Basis of Presentation
 
Organization and Description of Business
 
Sourcefire, Inc. (the “Company”) provides real-time network defense solutions for information technology (“IT”) infrastructures of commercial enterprise, healthcare, manufacturing, technology, educational, and federal and state organizations. The Company’s appliance products and software products provide a comprehensive intelligent network defense system that unifies intrusion detection, intrusion prevention, and vulnerability management technologies. The Company is the creator of Snort, a widely deployed open-source intrusion detection technology. The Snort technology is incorporated into the Sourcefire 3D (Discover, Determine, Defend) product suite that includes the following product trade names: Sourcefire Intrusion Sensors and Agents, Sourcefire RNA Sensors, and the Sourcefire Defense Center. The Company was founded in January 2001.
 
Unaudited Pro Forma Financial Information
 
The unaudited pro forma balance sheet gives effect to the conversion of the convertible preferred stock and the warrants to purchase convertible preferred stock as if each occurred on December 31, 2006. The conversion of the outstanding preferred stock into common stock will occur immediately prior to, or contemporaneously with, the consummation of the Company’s initial public offering. In addition, the warrants to purchase shares of Series A convertible preferred stock will become exercisable for shares of common stock upon completion of the Company’s initial public offering. The unaudited pro forma net loss attributable to common stockholders per share for the year ended December 31, 2006 gives effect to the conversion of the outstanding Series A, Series B, and Series C convertible preferred stock as if these transactions occurred on January 1, 2006 and the conversion of the outstanding Series D convertible preferred stock as if it occurred on its date of issuance.
 
2.   Summary of Significant Accounting Policies
 
Basis of Presentation
 
During 2006, the Company formed a wholly-owned subsidiary, Sourcefire Limited, located in the United Kingdom. The consolidated financial statements include the accounts of the Company and its wholly-owned subsidiary after elimination of all intercompany accounts and transactions.
 
Use of Estimates
 
The preparation of financial statements in conformity with accounting principles generally accepted in the United States requires management to make estimates and assumptions that affect the amounts reported in the financial statements and accompanying notes. Actual results could differ from those estimates.
 
Cash and Cash Equivalents
 
The Company considers all highly liquid investments with maturities of three months or less when purchased to be cash equivalents.
 
Held-to-Maturity Investments
 
Management determines the appropriate classification of debt securities at the time of purchase and reevaluates such designation as of each balance sheet date. Debt securities are classified as held-to-maturity when the Company has the positive intent and ability to hold the securities to maturity. The Company has historically held all of these investments until their full maturity. Held-to-maturity securities are stated at amortized cost, adjusted for amortization of premiums and accretion of discounts to maturity computed under the effective interest method. Such amortization is included in interest and investment income. Interest on securities classified as held-to-maturity is also included in interest and investment income.


F-8


Table of Contents

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)

 
As of December 31, 2005 and 2006, held-to-maturity investments, consisting solely of corporate debt instruments for which the estimated fair value is not materially different from the amortized cost, have contractual maturities as follows: $12,385,000 mature in 2007 and $908,000 mature in 2008.
 
Accounts Receivable and Allowance for Doubtful Accounts
 
The Company reports accounts receivable at net realizable value. The Company maintains an allowance for doubtful accounts for estimated losses resulting from the inability of its customers to make required payments. The Company calculates the allowance based on a specific analysis of past due balances and also considers historical trends of write-offs. Actual collection experience has not differed significantly from the Company’s estimates, due primarily to the Company’s credit and collections practices and the financial strength of its customers.
 
The Company offers standard payment terms that range from 30 to 60 days from the invoice date. Invoices are typically generated when the Company delivers the product and/or service to the customer. Standard terms do not require a down payment from the customer or any other collateral and payments terms are not tied to specific milestones or acceptance clauses. Additionally, the Company does not generally accept product returns or offer refunds.
 
Inventories
 
Inventories are stated at the lower of cost or market. Cost is determined by the first-in, first-out method.
 
Property and Equipment
 
Property and equipment is stated at cost and depreciation is computed using the straight-line method over estimated useful lives ranging from three to seven years. Amortization of leasehold improvements is computed using the straight-line method over the lesser of the useful life of the asset or the remaining term of the lease.
 
Assets held under capital leases are stated at the lesser of the present value of future minimum lease payments using the Company’s incremental borrowing rate at the inception of the lease or the fair value of the property at the inception of the lease. The assets recorded under capital leases are amortized over the lesser of the lease term or the estimated useful life of the assets in a manner consistent with the Company’s depreciation policy for owned assets. Amortization of assets under capital leases is included in depreciation and amortization expense.
 
Deferred Equity Offering Costs
 
Costs have been incurred in connection with the planned initial public offering of the Company’s common stock. As of December 31, 2006, costs aggregating approximately $1,300,000 have been deferred and are classified as a component of other assets in the accompanying consolidated balance sheet. Upon the consummation of the offering, these costs will be treated as a reduction of the proceeds from the offering and will be included as a component of additional paid-in capital. If the offering is terminated, the costs will be charged to expense in the period that it is probable that the costs are no longer realizable.
 
Convertible Preferred Stock
 
The Company accounts for stock subject to provisions for redemption outside of its control as mezzanine equity. These securities are recorded at fair value at the date of issue and are accreted to the minimum redemption amount at each balance sheet date (see Note 6). The resulting increases in the carrying amount of the redeemable stock are reflected through decreases in additional paid-in capital or, in the absence of additional paid-in capital, through accumulated deficit.


F-9


Table of Contents

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)

 
Revenue Recognition
 
The Company derives revenue from arrangements that include products with embedded software, software licenses and royalties, technical support, and professional services. Revenue from products in the accompanying consolidated statements of operations consists primarily of sales of software-based appliances, but also includes fees and royalties for the license of the Company’s technology in a software-only format and subscriptions to receive rules released by the Company’s Vulnerability Research Team (“VRT”) that are used to update the appliances for current exploits and vulnerabilities. Revenues derived from the non-product components of products currently represent less than 10% of total “products” revenue in the accompanying consolidated statements of operations. Technical support, which typically has a term of 12 to 36 months, includes telephone and web-based support, software updates, and rights to software upgrades on a when-and-if-available basis. Professional services include training and consulting.
 
For each arrangement, the Company defers revenue recognition until: (a) persuasive evidence of an arrangement exists; (b) delivery of the product has occurred and there are no remaining obligations or substantive customer acceptance provisions; (c) the fee is fixed or determinable; and (d) collection of the fee is probable.
 
The Company allocates the total arrangement fee among each deliverable based on the fair value of each of the deliverables, determined based on vendor-specific objective evidence. If vendor-specific objective evidence of fair value does not exist for each of the deliverables, all revenue from the arrangement is further deferred until the earlier of the point at which sufficient vendor-specific objective evidence of fair value can be determined or all elements of the arrangement have been delivered. However, if the only undelivered elements are technical support and/or professional services, elements for which the Company currently has vendor specific objective evidence of fair value, the Company recognizes revenue for the delivered elements based on the residual method as prescribed by SOP 98-9, Modification of SOP 97-2, Software Revenue Recognition with Respect to Certain Transactions. The Company has established vendor specific objective evidence of fair value for its technical support based upon actual renewals of technical support for each type of technical support that is offered and for each customer class. Technical support and technical support renewals are currently priced based on a percentage of the list price of the respective product or software and historically have not varied from a narrow range of values in the substantial majority of the Company’s arrangements. Revenue related to technical support is deferred and recognized ratably over the contractual period of the technical support arrangement, which ranges from 12 to 36 months in most arrangements.
 
The vendor specific objective evidence of fair value of the Company’s other services is based on the price for these same services when they are sold separately. Revenue for services that are sold either on a stand-alone basis or included in multiple element arrangements is deferred and recognized as the services are performed.
 
All amounts billed or received in excess of the revenue recognized are included in deferred revenue. In addition, the Company defers all direct costs associated with revenue that has been deferred. These amounts are included in either prepaid expenses and other current assets or inventory in the accompanying balance sheets, depending on the nature of the costs and the reason for the deferral.
 
For sales through resellers and distributors, the Company recognizes revenue upon the shipment of the product only if those resellers and distributors provide the Company at the time of placing their order with the identity of the end user customer to whom it has been sold through. The Company does not currently offer any rights to return products sold to resellers and distributors. To the extent that a reseller or distributor requests an inventory or stock of products, the Company defers revenue on that product until it receives notification that it has been sold through to an identified end user.
 
For the year ended December 31, 2004, the Company had one significant reseller customer, which accounted for 11% of the revenue recognized. For the years ended December 31, 2005 and 2006, the Company had no significant customers that accounted for greater than 10% of the revenue recognized.


F-10


Table of Contents

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)

 
Warranty
 
The Company warrants that its software will perform in accordance with its documentation for a period of ninety days from the date of shipment. Similarly, the Company warrants that the hardware will perform in accordance with its documentation for a period of one year from date of shipment. The Company further agrees to repair or replace software or products that do not conform to those warranties. The one year warranty on hardware coincides with the hardware warranty that the Company obtains from the manufacturer. The Company estimates the costs that may be incurred under its warranties and records a liability at the time product revenue is recognized. Factors that affect the Company’s warranty liability include the number of installed units, historical and anticipated rates of warranty claims and the estimated cost per claim. The Company periodically assesses the adequacy of its recorded warranty liability and adjusts the amounts as necessary. While warranty costs have historically been within management’s expectations, it is possible that warranty rates will change in the future based on new product introductions and other factors.
 
Commissions
 
The Company records commission expense for orders that include products in the same period in which the product revenue is recognized. The Company records commission expense for arrangements that consist solely of service in the period in which the non-cancelable order for the services is received.
 
Shipping and Handling Costs
 
All amounts billed to customers related to shipping and handling are included in product revenues and all costs of shipping and handling are included in the cost of products in the accompanying consolidated statements of operations.
 
Research and Development Costs
 
Costs for the development of new software products and substantial enhancements to existing software products are expensed as research and development costs as incurred until technological feasibility has been established, at which time any additional development costs are capitalized until the product is available for general release to customers. The Company defines the establishment of technological feasibility as the completion of a working model of the software product that has been tested to be consistent with the product design specifications and that is free of any uncertainties related to known high-risk development issues. During the years ended December 31, 2004, 2005 and 2006, the Company has not capitalized any significant software development costs.
 
Advertising Costs
 
The Company expenses advertising costs as incurred. Advertising expense totaled $59,000, $27,000 and $55,000 for the years ended December 31, 2004, 2005 and 2006, respectively.
 
Income Taxes
 
The Company uses the liability method in accounting for income taxes. Under this method, deferred tax assets and liabilities are determined based on differences between the financial reporting and tax basis of assets and liabilities and are measured using the enacted tax rates and laws that will be in effect when the differences are expected to reverse. A valuation allowance is provided on deferred tax assets if it is determined that it is more likely than not that the asset will not be realized.
 
Stock-Based Compensation
 
Prior to January 1, 2006, the Company accounted for stock-based compensation using the intrinsic value method prescribed in Accounting Principles Board Opinion No. 25, Accounting for Stock Issued to Employees


F-11


Table of Contents

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)

(“ABP No. 25”), and related interpretations. Accordingly, compensation cost for stock options generally was measured as the excess, if any, of the estimated fair value of the Company’s common stock over the amount an employee must pay to acquire the common stock on the date that both the exercise price and the number of shares to be acquired pursuant to the option are fixed. The Company had adopted the disclosure-only provisions of Statement of Financial Accounting Standard (“SFAS”) No. 123, Accounting for Stock-Based Compensation (“SFAS No. 123”) and SFAS No. 148, Accounting for Stock-Based Compensation — Transition and Disclosure (“SFAS No. 148”), which was released in December 2002 as an amendment to SFAS No. 123, and used the minimum value method of valuing stock options as allowed for non-public companies.
 
In December 2004, the Financial Accounting Standards Board issued SFAS No. 123(R), Share-Based Payment (“SFAS No. 123(R)”), which revised SFAS No. 123 and supersedes the APB No. 25. SFAS No. 123(R), focuses primarily on transactions in which an entity obtains employee services in exchange for share-based payments. Under SFAS No. 123(R), an entity generally is required to measure the cost of employee services received in exchange for an award of equity instruments based on the grant-date fair value of the award, with such cost recognized over the applicable requisite service period. In addition, SFAS No. 123(R) requires an entity to provide certain disclosures in order to assist in understanding the nature of share-based payment transactions and the effects of those transactions on the financial statements. The provisions of SFAS No. 123(R) are required to be applied as of the beginning of the first interim or annual reporting period of the entity’s first fiscal year that begins after December 15, 2005.
 
Effective January 1, 2006, the Company adopted the fair value recognition provisions of SFAS No. 123(R) using the prospective transition method, which requires the Company to apply its provisions only to awards granted, modified, repurchased or cancelled after the effective date. Under this transition method, stock-based compensation expense recognized beginning January 1, 2006 is based on the grant-date fair value of stock awards granted or modified after January 1, 2006. As the Company had used the minimum value method for valuing its stock options under the disclosure requirements of SFAS No. 123, all options granted prior to January 1, 2006 continue to be accounted for under APB No. 25. Additionally, the pro forma disclosures that were required under the original provisions of SFAS No. 123 are no longer provided for outstanding awards accounted for under the intrinsic-value method of APB No. 25 beginning in periods after the adoption of SFAS No. 123(R).
 
The following table summarizes the grants made by the Company since January 1, 2006:
 
                                 
                Estimated
       
                Fair Value of
       
    Number of
    Exercise Price of
    Common
    Intrinsic Value
 
Date of Grant
  Options Granted     Options Granted     Stock     (if any)  
 
January 2006
    171,489     $ 8.36     $ 8.36     $  
April 2006(1)
    453,178     $ 5.26     $ 5.26     $  
October 2006
    399,603     $ 9.48     $ 9.48     $  
November 2006
    56,955     $ 10.41     $ 10.41     $  
December 2006
    38,484     $ 11.34     $ 11.34     $  
 
(1) Includes 165,332 shares originally granted at an exercise price of $8.36 per share that were cancelled and reissued at an exercise price of $5.26 per share.
 
The fair value of the Company’s common stock underlying each stock option grant was estimated by the Company’s board of directors and management using either the market approach or the income approach, or a combination of both approaches. The market approach uses direct comparisons to other enterprises and their equity securities to estimate the fair value of the common shares of privately-held companies. The Company’s estimates of fair value using the market approach considered guideline company valuations, including public companies and acquisitions, which were discounted based on the lack of marketability and the minority interest nature of the


F-12


Table of Contents

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)

Company’s common stock. The income approach estimates the fair value of the enterprise based on expectations of future income and cash flows. Refer to Note 8 for further information.
 
As a result of adopting SFAS No. 123(R) on January 1, 2006, based on the estimated grant-date fair value of employee stock options subsequently granted or modified, the Company recognized aggregate compensation expense of $703,000 for the year ended December 31, 2006. The Company uses the Black-Scholes option pricing model to estimate the fair value of granted stock options. The use of option valuation models requires the input of highly subjective assumptions, including the expected term and the expected stock price volatility. However, the Company is currently a nonpublic company without sufficient information available on which to base a reasonable and supportable estimate of the expected volatility of its share prices. Accordingly, the Company uses an alternative method (defined as “calculated value”) that incorporates each of the inputs required by SFAS No. 123(R), with the exception of the expected volatility of its stock. Rather than use the expected volatility of the Company’s own stock, the Company has identified similar public entities for which share price information is available and has considered the historical volatility of those entities’ share prices in estimating expected volatility. Additionally, the Company has estimated the expected term of granted options to be the weighted-average mid-point between the vesting date and the end of the contractual term of an award, in accordance with SEC Staff Accounting Bulletin No. 107. The weighted-average estimated fair value of stock options granted during the year ended December 31, 2006 was $5.47 per share, calculated using the following weighted average assumptions:
 
         
Average risk-free interest rate
    4 .68%
Expected dividend yield
    0 .0%
Expected useful life
    6 .25 years
Expected volatility
    77 .2%
 
The grant date fair value of options not yet recognized as expense as of December 31, 2006 aggregated $3,389,000, net of estimated forfeitures, which will be recognized using the straight-line method over a weighted-average period of approximately four years.
 
The Company’s net loss for the year ended December 31, 2006 is $703,000 higher than if the Company had continued to account for stock-based compensation under APB No. 25. Basic and diluted net loss per share for the year ended December 31, 2006 would have been $0.21 lower if the Company had not adopted SFAS No. 123(R).
 
The Company accounts for stock option grants to non-employees who are not directors in accordance with SFAS No. 123(R) and Emerging Issues Tax Free (“EITF”) Issue No. 96-18, Accounting for Equity Instruments That Are Issued to Other Than Employees for Acquiring, or in Conjunction with Selling, Goods or Services, which require that the estimated fair value of these instruments measured at the earlier of the performance commitment date or the date at which performance is complete be recognized as an expense ratably over the period in which the related services are rendered. The Company determines the fair value of these instruments using the Black-Scholes option pricing model.
 
Net Loss Attributable to Common Stockholders Per Share
 
Basic net loss attributable to common stockholders per share is computed by dividing net loss attributable to common stockholders by the weighted average number of common shares outstanding for the period. Diluted net loss attributable to common stockholders per share includes the potential dilution that could occur if securities or other contracts to issue common stock were exercised or converted into common stock.


F-13


Table of Contents

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)

 
The following summarizes the potential outstanding common stock of the Company as of the end of each period:
 
                         
    December 31  
    2004     2005     2006  
 
Options to purchase common stock
    1,928,222       2,412,223       3,199,903  
Shares of common stock into which outstanding preferred stock would be convertible upon exercise of preferred stock warrants
    36,944       36,944       36,944  
Shares of common stock into which outstanding preferred stock is convertible
    12,292,005       12,292,005       14,302,128  
Unvested shares of restricted common stock
    290,160       75,448       27,709  
                         
Total
    14,547,331       14,816,620       17,566,684  
                         
 
If the outstanding options, warrants, unvested restricted stock, and preferred stock were exercised or converted into common stock, the result would be anti-dilutive. Accordingly, basic and diluted net loss attributable to common stockholders per share are identical for all periods presented in the accompanying consolidated statements of operations.
 
The pro forma net loss per share is calculated by dividing the pro forma net loss attributable to common stockholders by the pro forma weighted average number of common shares outstanding during the period. The pro forma weighted average number of common shares assumes the conversion of the outstanding Series A, Series B and Series C convertible preferred stock into common stock on January 1, 2006 and the conversion of the outstanding Series D convertible preferred stock into common stock on the date of issuance. The following details the computation of the unaudited pro forma net loss per share for the year ended December 31, 2006 (dollars in thousands, except per share data):
 
         
Net loss
  $ (932 )
Pro forma accretion of preferred stock
     
         
Pro forma net loss attributable to common stockholders
  $ (932 )
         
Weighted average shares calculation:
       
Basic and diluted weighted average shares outstanding
    3,389,527  
Conversion of preferred stock
    13,496,454  
         
Pro forma basic and diluted weighted average shares outstanding
    16,885,981  
         
Pro forma basic and diluted loss attributable to common stockholders per share
  $ (0.06 )
         
 
Fair Value of Financial Instruments
 
The Company’s financial instruments consist primarily of cash and cash equivalents, held-to-maturity investments, accounts receivable, accounts payable, and long-term debt. The fair value of these financial instruments approximates their carrying amounts reported in the consolidated balance sheets.
 
Reclassifications
 
Where appropriate, certain amounts in the 2004 and 2005 financial statements have been reclassified to conform to the 2006 presentation.


F-14


Table of Contents

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)

 
Recent Account Pronouncements
 
On July 13, 2006, the Financial Accounting Standards Board (“FASB”) issued FASB Interpretation No. 48, Accounting for Uncertainty in Income Taxes, (“FIN 48”). FIN 48 clarifies the accounting for uncertainty in income taxes recognized in an enterprise’s financial statements in accordance with FASB Statement No. 109, Accounting for Income Taxes.  FIN 48 prescribes a recognition threshold and measurement attribute for the financial statement recognition and measurement of a tax position taken or expected to be taken in a tax return. FIN 48 also provides guidance on derecognition, classification, interest and penalties, accounting in interim periods, disclosure, and transition. FIN 48 is effective for fiscal years beginning after December 15, 2006. The Company will adopt FIN 48 on January 1, 2007. An enterprise is required to disclose the cumulative effect of the change on retained earnings in the statement of financial position as of the date of adoption and such disclosure is required only in the year of adoption. The Company is currently evaluating the effect FIN 48 will have on the consolidated financial statements and related disclosures, but does not believe that the impact will be material to the consolidated financial statements taken as a whole.
 
3.   Property and Equipment
 
Property and equipment consists of the following (dollars in thousands):
 
                 
    December 31  
    2005     2006  
 
Furniture, fixtures and equipment
  $ 3,958     $ 5,025  
Leasehold improvements
    766       969  
                 
      4,724       5,994  
Less accumulated depreciation and amortization
    2,202       3,448  
                 
    $ 2,522     $ 2,546  
                 


F-15


Table of Contents

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)

4.   Income Taxes
 
The significant components of the Company’s deferred tax assets and liabilities are as follows (dollars in thousands):
 
                 
    December 31  
    2005     2006  
 
Deferred tax assets:
               
Net operating loss carryforward
  $ 9,650     $ 9,721  
Accrued expenses
    101       127  
Deferred rent
    39       55  
Deferred revenue
    1,076       451  
Allowance for doubtful accounts
    46       62  
Unearned compensation
          292  
Property and equipment
    116       171  
Other
    1       11  
                 
Total deferred tax assets
    11,029       10,890  
Deferred tax liabilities:
               
Unearned compensation
    (7 )      
Prepaid expenses
    (285 )     (174 )
                 
Total deferred tax liabilities
    (292 )     (174 )
                 
Net future income tax benefit
    10,737       10,716  
Valuation allowance for deferred tax assets
    (10,737 )     (10,716 )
                 
Net deferred tax asset
  $  —     $  —  
                 
 
The Company has reported a net loss since inception. This loss has not resulted in a reported tax benefit because of an increase in the valuation allowance for deferred tax assets that results from the inability to determine the realizability of those assets. The Company’s provision for income taxes for the year ended December 31, 2006 consists primarily of foreign income taxes related to international operations including those of Sourcefire Limited. Income before income taxes of the Company’s foreign operations aggregated approximately $92,000 for the year ended December 31, 2006. Deferred income taxes were not provided on these undistributed earnings aggregating $92,000 because such undistributed earnings are expected to be indefinitely reinvested outside of the United States. If these amounts were not considered permanently reinvested, additional deferred taxes of approximately $14,000 would have been provided with an offsetting reduction in the valuation allowance of $14,000.
 
At December 31, 2006, the Company has net operating loss carryforwards of approximately $28,120,000 (including $806,000 of deduction related to stock option exercises) that will begin to expire in 2022. The utilization of these net operating losses could be limited by the Internal Revenue Code as a result of certain ownership changes, including the issuance of equity securities. The Company has not determined the annual amount of the limitation on these net operating losses or whether these net operating loss carryforwards will expire prior to use as a result of these limitations. At December 31, 2006, $806,000 of deferred deductions related to stock option exercises have been generated by the Company. The resulting benefit of approximately $300,000 will be recorded to stockholders equity when realized. The realization of these deductions is currently offset by utilization of net operating losses. The Company has state net operating loss carryforwards available that expire through 2025. The utilization of state net operating losses will be limited in a manner similar to the federal net operating loss carryforwards. The


F-16


Table of Contents

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)

Company has established a full valuation allowance with respect to these federal and state loss carryforwards and other net deferred tax assets due to uncertainties surrounding their realization.
 
At December 31, 2006, the Company has a federal alternative minimum tax (AMT) credit carryforward of $11,000. A valuation allowance of $11,000 was recorded for the AMT credit. This credit will not expire.
 
A reconciliation of the reported income tax expense to the amount that would result by applying the U.S. federal statutory rate to the loss for the years ended December 31 is as follows (dollars in thousands):
 
                         
    Years Ended December 31  
    2004     2005     2006  
 
Tax benefit at U.S. statutory rate of 34%
  $ (3,596 )   $ (1,856 )   $ (294 )
Effect of permanent differences
    28       (71 )     48  
Effect of foreign income taxed a different rate
                11  
State income taxes, net of federal benefit
    (245 )     (129 )     9  
Effect of change in valuation allowance for deferred tax assets
    3,813       2,056       293  
                         
Total
  $     $     $ 67  
                         
 
5.   Debt and Warrants
 
In March 2005, the Company entered into an amended Loan and Security Agreement with a bank under which it may borrow up to $5 million under an Amended and Restated Revolving Promissory Note and up to $1 million under a supplemental equipment term note. Borrowings under the revolving promissory note bear interest at the prime rate, as defined, plus 0.5% per annum. Interest on borrowings under the revolving promissory note is payable monthly and all outstanding principal is due on March 28, 2007. As of December 31, 2006, the Company has no outstanding borrowings under the revolving promissory note, but has issued a $201,000 standby letter of credit which reduces the available borrowings under the agreement.
 
The Company was able to make borrowings under the supplemental equipment term note through March 31, 2006 and such borrowings bear interest, at the option of the Company, at the prime rate, plus 1.0% per annum, or a fixed rate of 7.0% per annum. Borrowings under the equipment term notes are payable in equal monthly payments of principal plus accrued interest over terms ranging from 30 to 36 months. The Company is also able to make borrowings under a prior equipment term loan facility through September 30, 2004 and such borrowings bear interest, at the option of the Company, at the prime rate, plus 1.5% per annum or a fixed rate ranging from 6.5% to 7.0% per annum. Borrowings under these equipment term notes are payable in equal monthly payments of principal plus accrued interest over terms ranging from 24 to 30 months.
 
In June 2005 and August 2005, the Company entered into additional amendments to the Loan and Security Agreement with the bank to modify certain financial covenants related to the agreement.
 
In July 2006, the Company entered into an amended Loan and Security Agreement with its bank under which it may borrow up to an additional $1 million under a second supplemental equipment term note. The Company was able to make borrowings under the supplemental equipment term note through January 31, 2007 and such borrowings bear interest, at the option of the Company, at the prime rate, plus 0.5% per annum, or a fixed rate of 9.0% per annum. Borrowings under the second supplemental equipment term note are payable in equal monthly payments of principal plus accrued interest over a 36 month period. In connection with this amendment, borrowings under the revolving promissory note will bear interest at the prime rate during any period where the Company has maintained EBITDA (as defined) of at least $1.00 for the prior three consecutive calendar month period.


F-17


Table of Contents

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)

 
Borrowings outstanding under the equipment term notes consisted of the following as of December 31 (dollars in thousands):
 
                 
    2005     2006  
 
Notes payable initially dated May 28, 2004, as amended, bearing interest at 6.5% and due from May 1, 2006 through November 1, 2006. Monthly payments ranging from $1 to $6 are due under these notes
  $ 61     $  
Notes payable initially dated August 5, 2004, as amended, bearing interest at 6.5% and due from August 1, 2006 through February 1, 2007. Monthly payments of $3 are due under these notes
    59       6  
Notes payable initially dated September 27, 2004, as amended, bearing interest at 6.5% and due from September 1, 2006 through March 1, 2007. Monthly payments of $4 are due under these notes
    61       12  
Notes payable initially dated June 1, 2005, bearing interest at 7.0% and due from November 1, 2007 through May 1, 2008. Monthly payments of $31 are due under these notes through November 2007 and $16 thereafter through May 2008
    749       420  
Note payable initially dated September 1, 2005, bearing interest at 7.0% and due August 1, 2008. Monthly payments of $2 are due under this note
    60       38  
Note payable initially dated August 14, 2006, bearing interest at prime plus 0.5% (8.75% at December 31, 2006) and due August 1, 2009. Monthly principal payments of $11 plus accrued interest are due under this note
          341  
Note payable initially dated October 30, 2006, bearing interest at prime plus 0.5% (8.75% at December 31, 2006) and due October 1, 2009. Monthly principal payments of $4 plus accrued interest are due under this note
          148  
Note payable initially dated December 22, 2006, bearing interest at prime plus 0.5% (8.75% at December 31, 2006) and due December 1, 2009. Monthly principal payments of $10 plus accrued interest are due under this note
          347  
                 
      990       1,312  
Less current portion
    (514 )     (675 )
                 
    $ 476     $ 637  
                 
 
Aggregate maturities as of December 31, 2006 of the Company’s long-term debt for the years ending December 31 are as follows (dollars in thousands):
 
         
2007
  $ 675  
2008
    392  
2009
    245  
         
    $ 1,312  
         
 
Borrowings under the Loan and Security Agreement are secured by all of the assets of the Company, excluding certain intellectual property. However, the Company has agreed not to sell, transfer, or otherwise encumber such intellectual property without the prior written consent of the bank. Additionally, the Company is required to comply with certain financial and non-financial covenants.
 
In November 2002, in connection with the Loan and Security Agreement, the Company issued warrants to purchase 14,754 shares of Series A convertible preferred stock at an exercise price of $3.05 per share that were immediately exercisable and expire on November 28, 2009. The estimated value of the warrants of approximately


F-18


Table of Contents

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)

$15,000 has been recorded as a mezzanine security and deferred financing costs, which is included in other assets in the accompanying balance sheets. The Company amortized these deferred financing costs using the straight-line method over a three-year period, and such amortization has been included in interest expense. These warrants remain outstanding as of December 31, 2006.
 
In November 2003, in connection with the First Amendment to the Loan and Security Agreement, the Company issued warrants to purchase 5,246 shares of Series A convertible preferred stock at an exercise price of $3.05 per share that were immediately exercisable and expire on November 2, 2010. The estimated value of the warrants of approximately $10,000 has been recorded as a mezzanine security and deferred financing costs, which is included in other assets in the accompanying balance sheets. The Company amortized these deferred financing costs using the straight-line method over a three-year period, and such amortization has been included in interest expense. These warrants remain outstanding as of December 31, 2006.
 
6.   Convertible Preferred Stock
 
In February and June of 2002, the Company issued a total of 2,475,410 shares of Series A convertible preferred stock (“Series A”) for $3.05 per share (“Series A original issue price”). In February 2003, the Company issued a total of 7,132,205 shares of Series B convertible preferred stock (“Series B”) for $1.5423 per share (“Series B original issue price”). In January 2004, the Company issued a total of 5,404,043 shares of Series C convertible preferred stock (“Series C”) for $2.7757 per share (“Series C original issue price”). In May and June of 2006, the Company issued a total of 3,264,449 shares of Series D convertible preferred stock (“Series D”) for $7.0456 per share (“Series D original issue price”).
 
Holders of the Series A, B, C, and D are entitled to receive, when and as declared by the Board of Directors, cumulative dividends per share equal to the sum of (i) 8% per annum of the Series A, B, C and D original issue price, and (ii) to the extent that a dividend is paid to the holders of common stock, the amount such holders would have received had the Series A, B, C and D been converted into common stock immediately prior to the distribution. The dividends on the Series A, B, C and D are cumulative and continue to accrue whether or not declared. Dividends in arrears on the Series A were $2,164,000 and $2,768,000 at December 31, 2005 and 2006, respectively. Dividends in arrears on the Series B were $2,567,000 and $3,447,000 at December 31, 2005 and 2006, respectively. Dividends in arrears on the Series C were $2,350,000 and $3,550,000 at December 31, 2005 and 2006, respectively. Dividends in arrears on the Series D were $1,097,000 at December 31, 2006.
 
In the event of liquidation, dissolution or winding up of the Company, holders of the Series A are entitled to receive a liquidation preference equal to $4.575 per share, holders of the Series B are entitled to receive a liquidation preference equal to $2.313 per share, holders of the Series C are entitled to receive a liquidation preference equal to $4.164 per share, and holders of the Series D are entitled to receive a liquidation preference equal to $8.807 per share, plus any declared and/or accrued but unpaid dividends. After payment of the Series A, B, C, and D liquidation preference and payments to any other classes of stock entitled to participate in liquidation distributions, any remaining funds will be distributed pro rata to all shareholders assuming that all classes of stock were converted into common stock.
 
Each share of the Series A, B, C, and D has substantially the same voting rights as the number of shares of common stock into which it can be converted. In addition, certain corporate actions require the consent of a majority of the outstanding shares of the Series A, B, C, and D. The holders of the Series A and the Series B are each entitled to appoint one member of the Board of Directors.
 
The Series A, B, C, and D are convertible into common stock at the option of the holder at any time. In addition, the Series A, B, C, and D will convert automatically into shares of common stock upon the closing of an underwritten public offering with a price per share of at least 2.436 times the Series D original issue price and resulting in at least $40 million of gross proceeds to the Company. Each share of Series A is initially convertible into approximately 1.85 shares of common stock. Each share of Series B, C, and D are initially convertible into


F-19


Table of Contents

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)

approximately 0.62 shares of common stock. This conversion ratio is subject to adjustment upon the occurrence of certain specified dilutive events.
 
The Series A, B, C, and D are redeemable, at the option of the holders, at any time after the fifth anniversary of the date of issuance, at a price equal to the greater of (a) the Series A original issue price in the case of the Series A, the Series B original issue price in the case of the Series B, the Series C original issue price in the case of the Series C, and the Series D original issue price in the case of the Series D, plus any declared and/or accrued but unpaid dividends or (b) the fair market value of such shares, which shall be determined in good faith by the Board of Directors. As a result of the redemption feature outside the control of the Company, the Series A, B, C, and D have been excluded from stockholders’ deficit in the accompanying balance sheets.
 
The carrying amount of the Series A securities is being accreted to the minimum redemption value of $7,550,000 plus unpaid cumulative dividends using the effective interest method through charges to additional paid-in capital or stockholders’ deficit. This minimum redemption value is expected to total $10,570,000. The accretion period is from the date of issuance of the Series A to February 2007 for 672,131 shares and to June 2007 for 1,803,279 shares, the earliest dates at which these securities become redeemable at the option of the holder.
 
The carrying amount of the Series B securities is being accreted to the minimum redemption value of $11,000,000 plus unpaid cumulative dividends using the effective interest method through charges to additional paid-in capital or stockholders’ deficit. This minimum redemption value is expected to total $15,400,000. The accretion period is from the date of issuance of the Series B to February 2008, the earliest date at which these securities become redeemable at the option of the holder.
 
The carrying amount of the Series C securities is being accreted to the minimum redemption value of $15,000,000 plus unpaid cumulative dividends using the effective interest method through charges to additional paid-in capital or stockholders’ deficit. This minimum redemption value is expected to total $21,000,000. The accretion period is from the date of issuance of the Series C to January 2009, the earliest date at which these securities become redeemable at the option of the holder.
 
The carrying amount of the Series D securities is being accreted to the minimum redemption value of $23,000,000 plus unpaid cumulative dividends using the effective interest method through charges to additional paid-in capital or stockholders’ deficit. This minimum redemption value is expected to total $32,200,000. The accretion period is from the date of issuance of the Series D to May 2011 for 2,973,485 shares and to June 2011 for 290,964 shares, the earliest dates at which these securities become redeemable at the option of the holder.
 
The minimum redemption value is being used for the Series A, B, C, and D since the fair market value of the instruments is not readily determinable; however, if fair market values at the redemption dates exceed the minimum redemption values, the redemption values will exceed the carrying values at the redemption dates.
 
7.   Restricted Common Stock
 
In February 2002, the Company and its founders entered into a Restricted Stock Agreement that grants the Company the option to repurchase the 1,662,561 shares of common stock held by the founders upon termination of their employment, and restricts the founders’ ability to transfer their shares of common stock. The repurchase price per share is $0.24, which represented the estimated fair value of the common stock at the date of issuance. The shares vest and are no longer subject to the restriction agreement as follows: (a) 50% at the date of the agreement; and (b) 16.68% on each of the three successive anniversaries of the date of the agreement. As of December 31, 2005, these shares were no longer subject to repurchase.
 
The Company also issued 559,729 and 312,192 shares of common stock subject to repurchase during June 2002 and November 2002, respectively, to certain employees. The Company has the right to repurchase the shares of common stock in the event of the termination of the employee for cause or the resignation of the employee without good reason. The repurchase price per share is $0.24, which represented the estimated fair value of the


F-20


Table of Contents

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)

common stock on the date of issuance. The shares vest, and are no longer subject to the restriction, in 12 equal quarterly installments. The vesting is subject to acceleration upon a change of control and under certain other circumstances. The Company measured compensation expense for these awards using the intrinsic value method and recorded unearned compensation of $212,000, which has been amortized over the vesting period. As of December 31, 2005, these shares were no longer subject to repurchase.
 
In December 2003, the Company issued 193,965 shares of common stock subject to repurchase to certain employees. The Company has the right to repurchase the shares of common stock in the event of the termination of the employee for cause or the resignation of the employee without good reason. The repurchase price per share is $0.325, which represented the estimated fair value of the common stock on the date of issuance. The shares vest, and are no longer subject to the restriction on the third anniversary of the vesting start date. The vesting is subject to acceleration upon a change of control and under certain other circumstances. The Company measured compensation expense for these awards using the intrinsic value method and recorded unearned compensation of $20,000 which has been amortized over the vesting period. As of December 31, 2006, these shares are no longer subject to repurchase.
 
In July and August 2006, the Company issued 15,394 and 12,315 shares of common stock, respectively, subject to repurchase to certain directors. The Company has the right to repurchase the shares of common stock in the event of the termination of the director for cause. The repurchase price per share is $7.63, which represented the estimated fair value of the common stock on the date of issuance. The shares vest, and are no longer subject to the restriction on the earlier of (a) consummation of a firm commitment underwritten public offering of our common stock, along with the expiration of any applicable lock-up agreements; (b) a change of control; or (c) on the second anniversary of the vesting start date. The Company has measured aggregate compensation expense for these awards of $212,000 based on the estimated fair value of the common stock on the date of grant and is recognizing it ratably over the estimated vesting period.
 
8.   Stock Incentive Plan
 
During 2002, the Company adopted the Sourcefire, Inc. 2002 Stock Incentive Plan. The plan provides for the granting of equity-based awards, including stock options, restricted or unrestricted stock awards, and stock appreciation rights to employees, officers, directors, and other individuals as determined by the Board of Directors. The Company has reserved 5,100,841 shares of common stock under the plan.
 
The plan administrator determines the vesting period for awards under the plan, which generally ranges from three to four years, and options granted have a maximum term of 10 years. The exercise price of the awards is equal to or greater than the fair value of the common stock as estimated by the Board of Directors on the date of grant. In estimating the fair value of the Company’s common stock at the grant date, the Board of Directors considers contemporaneous valuations, significant transactions with independent investors in the Company, relative rights and preferences retained by preferred shareholders of the Company compared to those of the common stockholders, market data received from investment banks regarding private company merger and acquisition transactions and public company comparables, the Company’s financial results and execution against its financial operating plan, new customer penetration, product development milestones and other relevant factors.


F-21


Table of Contents

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)

 
The following table summarizes the activity of the plan (dollars in thousands, expect per share data):
 
                                 
                Weighted
       
                Average
    Aggregate
 
    Number of
    Range of
    Exercise
    Intrinsic
 
    Shares     Exercise Prices     Price     Value  
 
Outstanding at January 1, 2004
    1,669,529     $ 0.24 to $0.32     $ 0.29          
Granted
    829,078     $ 1.14 to $1.62     $ 1.22          
Exercised
    (250,765 )   $ 0.24 to $1.14     $ 0.31          
Forfeited
    (319,620 )   $ 0.24 to $1.14     $ 0.55          
                                 
Outstanding at December 31, 2004
    1,928,222     $ 0.24 to $1.62     $ 0.63          
Granted
    858,016     $ 1.62 to $8.36     $ 2.13          
Exercised
    (114,800 )   $ 0.24 to $1.62     $ 0.50          
Forfeited
    (259,215 )   $ 0.24 to $3.69     $ 1.49          
                                 
Outstanding at December 31, 2005
    2,412,223     $ 0.24 to $8.36     $ 1.09          
Granted
    1,119,709     $ 5.26 to $11.34     $ 7.71          
Exercised
    (84,082 )   $ 0.32 to $2.03     $ 1.71          
Forfeited
    (247,947 )   $ 0.24 to $8.36     $ 6.72          
                                 
Outstanding at December 31, 2006
    3,199,903     $ 0.24 to $11.34     $ 2.96     $ 26,839  
                                 
Exercisable at December 31, 2006
    1,706,998     $ 0.24 to $5.26     $ 0.97     $ 17,665  
                                 
Vested and expected to vest at December 31, 2006
    2,975,967             $ 1.58     $ 25,462  
                                 
 
The total intrinsic value of options exercised during the year ended December 31, 2006 was $362,000.
 
The following table summarizes information about stock options outstanding at December 31, 2006:
 
                                         
    Options Outstanding     Options Exercisable  
          Weighted
    Weighted Average
          Weighted
 
          Average
    Remaining
          Average
 
    Number of
    Exercise
    Contractual Life
    Number of
    Exercise
 
Range of Exercise Prices
  Shares     Prices     (Years)     Shares     Prices  
 
$0.24 - $0.32
    1,045,518     $ 0.29       6.3       974,070     $ 0.28  
$1.14 - $2.03
    1,208,936     $ 1.63       7.9       651,045     $ 1.52  
$3.69 - $11.34
    945,449     $ 7.58       9.6       81,883     $ 5.17  
                                         
      3,199,903     $ 2.95       7.9       1,706,998     $ 0.99  
                                         
 
In 2005, the Company modified certain employee options after the grant date to accelerate vesting upon termination of employment. The Company measured compensation expense for these modifications using the difference between the estimated fair market value of the underlying common stock at the date of modification and the option strike price and recorded non-cash compensation expense of $406,000 which has been included in general and administrative expense in the accompanying consolidated statement of operations. In April 2006, the Company exchanged certain employee options granted in 2005 and 2006 with an exercise price of $8.36 per share for new options with a reduced exercise price of $5.26 per share. The Company measured compensation expense for


F-22


Table of Contents

 
SOURCEFIRE, INC.
 
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS — (Continued)

these modifications as the excess of the fair value of the modified share options issued over the fair value of the original share options at the date of the exchange. The measured compensation expense aggregated approximately $44,000 and is being recognized over the vesting period of the options.
 
9.   Shares Reserved for Future Issuance
 
As of December 31, 2006, the Company has reserved shares of common stock for issuance as follows:
 
         
Conversion of Series A
    4,572,647  
Exercise of Series A warrants and conversion of Series A shares to common stock
    36,944  
Conversion of Series B
    4,391,748  
Conversion of Series C
    3,327,610  
Conversion of Series D
    2,010,123  
Exercise of outstanding stock options
    3,199,903  
Vesting of restricted common stock
    27,709  
Stock options available for granting as reserved by the Board of Directors
    181,934  
         
      17,748,618  
         
 
10.   Operating Leases
 
The Company leases office space and certain network, lab and office equipment under noncancelable operating lease agreements. Future minimum payments under noncancelable operating leases with initial terms of one year or more consisted of the following at December 31, 2006 (dollars in thousands):
 
         
2007
  $ 1,576  
2008
    1,374  
2009
    1,230  
2010
    800  
2011
    490  
2012 and thereafter
    41  
         
    $ 5,511  
         
 
Rent expense totaled $399,000, $662,000 and $1,453,000 for the years ended December 31, 2004, 2005 and 2006, respectively.
 
11.   Business and Geographic Segment Information
 
The Company manages its operations on a consolidated basis for purposes of assessing performance and making operating decisions. Accordingly, the Company does not have reportable segments of its business.
 
Revenues by geographic area for the years ended December 31 are as follows (dollars in thousands):
 
                         
    2004     2005     2006  
 
United States
  $ 13,632     $ 27,027     $ 36,598  
All foreign countries
    3,061       5,852       8,328  
                         
Consolidated total
  $ 16,693     $ 32,879     $ 44,926  
                         


F-23


Table of Contents

12.   Defined Contribution Retirement Plan
 
The Company sponsors a defined contribution retirement plan under section 401(k) of the Internal Revenue Code. The provisions of this plan allow for voluntary employee contributions of up to 75% of an employee’s salary but not exceeding the Federal limit of $15,000, subject to certain annual limitations. The Company does not currently make matching contributions.
 
13.   Commitments and Contingencies
 
The Company is subject to legal actions arising in the ordinary course of its business. In management’s opinion, the Company has adequate legal defenses with respect to the eventuality of such actions and does not believe any settlement would materially affect the Company’s financial position.
 
On April 20, 2006, a lawsuit was filed against the Company by PredatorWatch Inc. (now named NetClarity) in the Superior Court for Suffolk County, Massachusetts. The complaint alleges that the Company: (i) misappropriated and incorporated the plaintiff’s trade secrets into the Company’s RNA technology; (ii) breached an oral agreement of confidentiality; (iii) breached a covenant of good faith and fair dealing owed to the plaintiff; (iv) was unjustly enriched; (v) misrepresented certain material facts to the plaintiff, upon which the plaintiff relied to its detriment; and (vi) engaged in unfair and deceptive acts in violation of Massachusetts state law. The plaintiff has sought to recover amounts yet to be ascertained and established, as well as damages and attorney’s fees. The Company intends to defend this matter vigorously. Because the Company is still in the early stages of discovery and because the plaintiff has yet to specify the amount of any purported damages, the Company has not accrued for any damages or settlement of this matter.
 
The Company has entered into a purchase commitment with a hardware manufacturing vendor with whom it has a current arrangement. Under the terms of this commitment, the Company has agreed to purchase a set quantity of new appliance inventory over an 18-month period. The approximate value of the purchase commitment is $800,000.
 
The Company has entered into a purchase commitment with vendor to license database software that is used in the Company’s products. Under the terms of the commitment, the Company is permitted to distribute the vendor’s software in the Company’s products through December 31, 2010 in exchange for an up front payment, plus annual maintenance fees. The approximate aggregate value of the purchase commitment is $855,000, which was paid in January 2007.
 
14. Subsequent Event
 
In February 2007, the Company effected a 1-for-1.624 reverse split of common stock. Accordingly, all share and per share amounts have been retroactively adjusted to give effect to this event.


F-24


Table of Contents

 
(SOURCE FIRE LOGO)
 


Table of Contents

PART II
 
INFORMATION NOT REQUIRED IN THE PROSPECTUS
 
 
Item 13.   Other Expenses of Issuance and Distribution
 
Set forth below is a table of the registration fee for the Securities and Exchange Commission, the filing fee for the National Association of Securities Dealers, Inc., the listing fee for the Nasdaq Global Market and estimates of all other expenses to be incurred in connection with the issuance and distribution of the securities described in the registration statement, other than underwriting discounts and commissions:
 
         
SEC registration fee
  $ 8,025  
NASD filing fee
    9,790  
Nasdaq Global Market listing fee
    5,000  
Printing and engraving expenses
    350,000  
Legal fees and expenses
    1,200,000  
Accounting fees and expenses
    650,000  
Transfer agent and registrar fees
    2,500  
Miscellaneous
    224,685  
         
Total
  $ 2,450,000  
         
 
Item 14.   Indemnification of Directors and Officers
 
Sourcefire is incorporated under the laws of the State of Delaware. Reference is made to Section 102(b)(7) of the Delaware General Corporation Law, or DGCL, which enables a corporation in its original certificate of incorporation or an amendment thereto to eliminate or limit the personal liability of a director for violations of the director’s fiduciary duty, except (1) for any breach of the director’s duty of loyalty to the corporation or its stockholders, (2) for acts or omissions not in good faith or which involve intentional misconduct or a knowing violation of law, (3) pursuant to Section 174 of the DGCL, which provides for liability of directors for unlawful payments of dividends of unlawful stock purchase or redemptions, or (4) for any transaction from which a director derived an improper personal benefit.
 
Reference is also made to Section 145 of the DGCL, which provides that a corporation may indemnify any person, including an officer or director, who is, or is threatened to be made, party to any threatened, pending or completed legal action, suit or proceeding, whether civil, criminal, administrative or investigative, other than an action by or in the right of such corporation, by reason of the fact that such person was an officer, director, employee or agent of such corporation or is or was serving at the request of such corporation as a director, officer, employee or agent of another corporation or enterprise. The indemnity may include expenses (including attorneys’ fees), judgments, fines and amounts paid in settlement actually and reasonably incurred by such person in connection with such action, suit or proceeding, provided such officer, director, employee or agent acted in good faith and in a manner he reasonably believed to be in, or not opposed to, the corporation’s best interest and, for criminal proceedings, had no reasonable cause to believe that his conduct was unlawful. A Delaware corporation may indemnify any officer or director in an action by or in the right of the corporation under the same conditions, except that no indemnification is permitted without judicial approval if the officer or director is adjudged to be liable to the corporation. Where an officer or director is successful on the merits or otherwise in the defense of any action referred to above, the corporation must indemnify him against the expenses that such officer or director actually and reasonably incurred.
 
Item 15.   Recent Sales of Unregistered Securities
 
1. In September 2006, pursuant to the Sourcefire, Inc. 2002 Stock Incentive Plan, as amended, we issued 12,315 shares of restricted common stock to Steven R. Polk at a price per share of $0.001624.


II-1


Table of Contents

 
2. In August 2006, pursuant to the Sourcefire, Inc. 2002 Stock Incentive Plan, as amended, we issued 15,394 shares of restricted common stock to Joseph R. Chinnici at a price per share of $0.001624.
 
3. In May and June 2006, we issued 3,264,449 shares of Series D convertible preferred stock to accredited investors at a price per share of $7.0456.
 
4. In January 2004, we issued 5,404,043 shares of Series C convertible preferred stock to accredited investors at a price per share of $2.7757.
 
5. In December 2004, we issued 98,522 shares of common stock to Asheem Chandna at a price per share of $0.32 pursuant to a stock option exercise under the Sourcefire, Inc. 2002 Stock Incentive Plan, as amended.
 
6. Since January 2004, we have issued an aggregate of 449,647 shares of common stock to employees and former employees pursuant to stock option exercises under the Sourcefire, Inc. 2002 Stock Incentive Plan, as amended. The purchase price per share for such option exercises ranged from $0.24 per share to $2.03 per share.
 
7. Since January 2004, we have granted options to purchase an aggregate of 2,806,803 shares of common stock under the Sourcefire, Inc. 2002 Stock Incentive Plan, as amended, to employees, consultants and directors with exercise prices ranging from $1.14 per share to $11.34 per share.
 
None of the foregoing transactions involved any underwriters, underwriting discounts or commissions, or any public offering. We believe the offers, sales and issuances of the securities described above were exempt from registration under the Securities Act of 1933 by virtue of Rule 506 of Regulation D promulgated thereunder because the issuance of securities to the recipients did not involve a public offering or in reliance on Rule 701 because the transactions were pursuant to compensatory benefit plans or contracts relating to compensation as provided under such rule. The recipients of securities under compensatory benefit plans and contracts relating to compensation were our employees, directors or bona fide consultants and received the securities as compensation for services. Appropriate legends have been affixed to the securities issued in these transactions. Each of the recipients of securities in these transactions had adequate access, through employment, business or other relationships, to information about us. When we have relied on Rule 506 of Regulation D promulgated under the Securities Act of 1933, the investors in unregistered securities have been accredited investors.
 
Item 16.   Exhibits and Financial Statement Schedule
 
(a) Exhibits
 
         
Exhibit No.
 
Description of Exhibit
 
  1 .1   Form of Underwriting Agreement
  3 .1**   Fifth Amended and Restated Certificate of Incorporation of Sourcefire, Inc.
  3 .2*   Form of Sixth Amended and Restated Certificate of Incorporation of Sourcefire, Inc.
  3 .3**   Third Amended and Restated Bylaws of Sourcefire, Inc.
  3 .4*   Form of Fourth Amended and Restated Bylaws of Sourcefire, Inc.
  3 .5   Certificate of Amendment to the Fifth Amended and Restated Certificate of Incorporation
  4 .1*   Form of stock certificate of common stock
  4 .2**   2002 Stock Incentive Plan
  4 .3*   2007 Stock Incentive Plan
  4 .4**   Form of Nonstatutory Stock Option Grant Agreement
  5 .1   Opinion of Morrison & Foerster LLP
  10 .1**   Fourth Amended and Restated Investor Rights Agreement
  10 .2**   Fourth Amended and Restated Right of First Refusal and Co-Sale Agreement
  10 .3**   Fourth Amended and Restated Stockholders’ Voting Agreement
  10 .4**   Employment Agreement of E. Wayne Jackson, III
  10 .5**   Employment Agreement of Thomas M. McDonough
  10 .6**   Employment Agreement of Martin F. Roesch


II-2


Table of Contents

         
Exhibit No.
 
Description of Exhibit
 
  10 .7**   Employment Agreement of Todd P. Headley
  10 .8**   Employment Agreement of Michele M. Perry-Boucher
  10 .9**   Loan and Security Agreement by and between Sourcefire, Inc. and Silicon Valley Bank
  10 .10**   Lease Agreement by and between Liberty Property LP and Sourcefire, Inc.
  10 .11†   OEM and Distributor Agreement by and between Sourcefire, Inc. and Nokia Inc., dated July 14, 2006, as amended on July 14, 2006
  10 .12†   Manufacturing Services and Supply Agreement by and between Patriot Technologies, Inc. and Sourcefire, Inc., dated December 12, 2005, as amended on August 4, 2006
  10 .13†   Outsourcing Agreement by and between Sourcefire, Inc. and Intelligent Decisions, Inc., dated January 31, 2006
  10 .14†   OEM Purchase Agreement by and between Bivio Networks, Inc. and Sourcefire, Inc., dated February 10, 2005
  10 .15†   License Agreement for Commercial Use of MySQL Software by and between MySQL Inc. and Sourcefire, Inc., dated June 13, 2005, as amended on December 29, 2006
  10 .16   Employment Agreement of Joseph M. Boyle
  10 .17   Written Consent in Lieu of a Special Meeting of the Preferred Stockholders of Sourcefire, Inc., dated October 25, 2006
  23 .1   Consent of Ernst & Young LLP
  23 .2   Consent of Morrison & Foerster LLP (included in Exhibit 5.1)
  24 .1**   Power of Attorney (included in signature pages to Registration Statement on Form S-1, filed October 25, 2006)
  24 .2**   Power of Attorney (included in signature pages to Amendment No. 4 to Registration Statement on Form S-1, filed February 14, 2007)
 
* To be filed by Amendment.
** Previously filed.
Portions of this exhibit have been omitted and were filed separately with the Securities and Exchange Commission pursuant to the Registrant’s application requesting confidential treatment under Rule 406 of the Securities Act.
 
(b) Financial Statement Schedules:
 
Schedules have been omitted because the information required to be shown in the schedules is not applicable or is included elsewhere in our financial statements or accompanying notes.
 
Item 17.   Undertakings
 
Insofar as indemnification for liabilities arising under the Securities Act of 1933 (the “Securities Act”) may be permitted to directors, officers and controlling persons of the Registrant pursuant to the foregoing provisions, or otherwise, the Registrant has been advised that in the opinion of the Securities and Exchange Commission such indemnification is against public policy as expressed in the Securities Act and is, therefore, unenforceable. In the event that a claim for indemnification against such liabilities (other than the payment by the Registrant of expenses incurred or paid by a director, officer or controlling person of the Registrant in the successful defense of any action, suit or proceeding) is asserted by such director, officer or controlling person in connection with the securities being registered, the Registrant will, unless in the opinion of its counsel the matter has been settled by controlling precedent, submit to a court of appropriate jurisdiction the question whether such indemnification by it is against public policy as expressed in the Securities Act and will be governed by the final adjudication of such issues.

II-3


Table of Contents

The undersigned Registrant hereby undertakes that:
 
(1) For purposes of determining any liability under the Securities Act, the information omitted from the form of prospectus filed as part of this registration statement in reliance upon Rule 430A and contained in a form of prospectus filed by the Registrant pursuant to Rule 424(b)(1) or (4) or 497(h) under the Securities Act shall be deemed to be part of this registration statement as of the time it was declared effective.
 
(2) For the purpose of determining any liability under the Securities Act, each post-effective amendment that contains a form of prospectus shall be deemed to be a new registration statement relating to the securities offered therein, and the offering of such securities at that time shall be deemed to be the initial bona fide offering thereof.
 
The undersigned Registrant hereby undertakes to provide to the underwriters at the closing specified in the Underwriting Agreement, certificates in such denomination and registered in such names as required by the underwriters to permit prompt delivery to each purchaser.


II-4


Table of Contents

Signatures
 
Pursuant to the requirements of the Securities Act of 1933, as amended, the Registrant has duly caused this amendment to registration statement to be signed on its behalf by the undersigned, thereunto duly authorized, in the City of Columbia, State of Maryland on February 23, 2007.
 
SOURCEFIRE, INC.
 
  By: 
/s/  E. Wayne Jackson, III
Name: E. Wayne Jackson, III
Title:  Chief Executive Officer
 
Pursuant to the requirements of the Securities Act of 1933, this amendment to registration statement has been signed by the following persons in the capacities and on the dates indicated.
 
             
Signature
 
Title
 
Date
 
/s/  E. Wayne Jackson, III

E. Wayne Jackson, III
  Chief Executive Officer and Director (principal executive officer)   February 23, 2007
         
/s/  Todd P. Headley

Todd P. Headley
  Chief Financial Officer and Treasurer (principal financial and accounting officer)   February 23, 2007
         
*

Martin F. Roesch
  Chief Technology Officer and Director   February 23, 2007
         
*

Asheem Chandna
  Director   February 23, 2007
         
*

Tim A. Guleri
  Director   February 23, 2007
         
*

Harry R. Weller
  Director   February 23, 2007
         
*

Joseph R. Chinnici
  Director   February 23, 2007
         
*

Steven R. Polk
  Director   February 23, 2007
         
*

Arnold L. Punaro
  Director   February 23, 2007
             
*By:  
/s/  Todd P. Headley

Todd P. Headley
as Attorney-in-fact
       


II-5


Table of Contents

         
Exhibit No.
 
Description of Exhibit
 
  1 .1   Form of Underwriting Agreement
  3 .1**   Fifth Amended and Restated Certificate of Incorporation of Sourcefire, Inc.
  3 .2*   Form of Sixth Amended and Restated Certificate of Incorporation of Sourcefire, Inc.
  3 .3**   Third Amended and Restated Bylaws of Sourcefire, Inc.
  3 .4*   Form of Fourth Amended and Restated Bylaws of Sourcefire, Inc.
  3 .5   Certificate of Amendment to the Fifth Amended and Restated Certificate of Incorporation
  4 .1*   Form of stock certificate of common stock
  4 .2**   2002 Stock Incentive Plan
  4 .3*   2007 Stock Incentive Plan
  4 .4**   Form of Nonstatutory Stock Option Grant Agreement
  5 .1   Opinion of Morrison & Foerster LLP
  10 .1**   Fourth Amended and Restated Investor Rights Agreement
  10 .2**   Fourth Amended and Restated Right of First Refusal and Co-Sale Agreement
  10 .3**   Fourth Amended and Restated Stockholders’ Voting Agreement
  10 .4**   Employment Agreement of E. Wayne Jackson, III
  10 .5**   Employment Agreement of Thomas M. McDonough
  10 .6**   Employment Agreement of Martin F. Roesch
  10 .7**   Employment Agreement of Todd P. Headley
  10 .8**   Employment Agreement of Michele M. Perry-Boucher
  10 .9**   Loan and Security Agreement by and between Sourcefire, Inc. and Silicon Valley Bank
  10 .10**   Lease Agreement by and between Liberty Property LP and Sourcefire, Inc.
  10 .11†   OEM and Distributor Agreement by and between Sourcefire, Inc. and Nokia Inc., dated July 14, 2006, as amended on July 14, 2006
  10 .12†   Manufacturing Services and Supply Agreement by and between Patriot Technologies, Inc. and Sourcefire, Inc., dated December 12, 2005, as amended on August 4, 2006
  10 .13†   Outsourcing Agreement by and between Sourcefire, Inc. and Intelligent Decisions, Inc., dated January 31, 2006
  10 .14†   OEM Purchase Agreement by and between Bivio Networks, Inc. and Sourcefire, Inc., dated February 10, 2005
  10 .15†   License Agreement for Commercial Use of MySQL Software by and between MySQL Inc. and Sourcefire, Inc., dated June 13, 2005, as amended on December 29, 2006
  10 .16   Employment Agreement of Joseph M. Boyle
  10 .17   Written Consent in Lieu of a Special Meeting of the Preferred Stockholders of Sourcefire, Inc., dated October 25, 2006
  23 .1   Consent of Ernst & Young LLP
  23 .2   Consent of Morrison & Foerster LLP (included in Exhibit 5.1)
  24 .1**   Power of Attorney (included in signature pages to Registration Statement on Form S-1, Filed October 25, 2006)
  24 .2**   Power of Attorney (included in signature pages to Amendment No. 4 to Registration Statement on Form S-1, filed February 14, 2007)
 
* To be filed by Amendment.
** Previously filed.
Portions of this exhibit have been omitted and were filed separately with the Securities and Exchange Commission pursuant to the Registrant’s application requesting confidential treatment under Rule 406 of the Securities Act.