---

---

---

•	the evolution of the threat landscape facing our customers and prospects;

•	our ability to educate the market regarding the advantages of our virtual machine-based security solution;

•	our ability to maintain an adequate rate of revenue growth;

•	our future financial and operating results;

•	our business plan and our ability to effectively manage our growth and associated investments;

•	beliefs and objectives for future operations;

•	our ability to expand our leadership position in advanced network security;

•	our ability to attract and retain customers;

•	our ability to further penetrate our existing customer base;

•	our expectations concerning renewal rates for subscriptions and services by existing customers;

•	our ability to maintain our competitive technological advantages against new entrants in our industry;

•	our ability to timely and effectively scale and adapt our existing technology;

•	our ability to innovate new products and bring them to market in a timely manner;

•	our ability to maintain, protect, and enhance our brand and intellectual property;

•	our ability to expand internationally;

•	the reorganization of our corporate structure and intercompany relationships and our ability to improve our overall effective tax rate;

•	the effects of increased competition in our market and our ability to compete effectively;

•	cost of revenue, including changes in costs associated with production, manufacturing and customer support;

•	operating expenses, including changes in research and development, sales and marketing, and general and administrative expenses;

•	anticipated income tax rates;

•	sufficiency of cash to meet cash needs for at least the next 12 months;

•	our ability to maintain our good standing with the United States and international governments and capture new contracts;

•	costs associated with defending intellectual property infringement and other claims, such as those claims discussed in “Business—Legal Proceedings”;

•	our expectations concerning relationships with third parties, including channel partners and logistics providers;

•	the release of new products, including FireEye Mobile Threat Prevention, our recently released SaaS-based mobile platform;

•	economic and industry trends or trend analysis;

•	the attraction and retention of qualified employees and key personnel;

•	future acquisitions of or investments in complementary companies, products, subscriptions or technologies; and

•	the effects of seasonal trends on our results of operations.

---

---

•	First, Mandiant provides endpoint-based advanced threat detection and response. Mandiant’s endpoint products enable security teams to enhance their visibility and make faster, more accurate decisions about potential security incidents occurring across an organization’s network and endpoints.

•

Second, Mandiant brings significant depth in intelligence on next-generation attacks, which is continually gathered from ongoing monitoring of more than two million endpoints and by incident response and remediation teams that serve on the front lines combating the most advanced attacks. When this depth of threat intelligence is paired with the breadth of the FireEye real-time threat intelligence gathered from more than two million virtual machines, organizations will have robust detection and contextual information about attempted attacks, including the level of risk, the identity of the attackers, and the intended target of the attacks.

•

Third, Mandiant’s team of highly skilled incident response experts has performed hundreds of incident response investigations across numerous industries at some of the largest organizations in the world. In addition, Mandiant brings its Managed Defense monitoring service to FireEye. The addition of these skills and expertise significantly expands our ability to offer value-added services to our customers.

---

•

Threat Prevention System. Our Threat Prevention System consists of vector-specific security appliances that provide comprehensive next-generation threat protection, from network to endpoint, for both inbound and outbound network traffic that may contain sensitive information. Our portfolio of Threat Prevention appliances include the following appliances covering the Web, email and file threat vectors:

---

•

Web Threat Prevention. Our Web Threat Prevention appliances are deployed in-line at enterprise Internet access points to analyze all Web traffic. Utilizing our MVX engine, these appliances identify and block next-generation threats deeply embedded inside Web traffic, create real-time protection descriptors from the identified threats, and capture potential multi-protocol outbound communication data from threats that may already be inside the network. Our MVX engine detects advanced attacks exploiting unknown vulnerabilities as well as malicious code embedded in common Web and multimedia content. Our MVX engine executes suspicious software against a range of browsers, plug-ins, applications, and operating environments that are instrumental in tracking malicious actions. As potential threats can sometimes enter the network via user devices and may have been resident in the network previously, our MVX engine also analyzes outbound traffic for threats that may attempt to extract sensitive information or enable control of devices within the network by communicating with servers. In September 2013, we introduced the NX 10000, a multi-gigabit throughput appliance that can be deployed in-line at Internet egress points to block Web exploits and outbound multi-protocol callbacks. Using our MVX engine, the NX 10000 confirms zero-day attacks, generates real-time security intelligence and captures dynamic callback destinations to defend against attacks. In December 2013, we introduced our NX 900 to enable threat protection at various remote and branch offices as well as at the homes of an organization’s executive officers and key personnel.

•

Email Threat Prevention. Our Email Threat Protection appliances detect and stop advanced attacks that exploit unknown OS, browser, and application vulnerabilities as well as malicious code embedded in email content. Using our MVX engine, these appliances analyze all email attachments, including all common file and archive formats. In particular, these appliances secure networks against spear phishing emails, which bypass traditional anti-spam and reputation-based technologies. Spear phishing is a common next-generation threat that is effectively a method used by cybercriminals for financial gain or to extract sensitive information by sending professionally disguised email to users hoping the users respond to what they believe are benign email communications. Our MVX engine actively executes, and is able to quickly identify, this malicious content.

•

File Threat Prevention. Our File Threat Prevention appliances analyze network file servers to detect and quarantine malicious software brought into the network by users within the organization through technologies, such as online file sharing and associated collaboration tools, which bypass traditional network solutions. These appliances analyze files using our MVX engine and detect malicious code embedded in common file types, including PDF, Microsoft Office documents, archived files, and multimedia content such as QuickTime and other video, audio and image files. Our File Threat Prevention appliances perform recursive, scheduled, and on-demand scanning of accessible network file servers to continuously identify and quarantine resident threats.

•

Central Management System. Our Central Management System, or CMS, unifies reporting, configuration, and threat data sharing and manages the overall deployment of our Threat Prevention System. CMS appliances are used to distribute the dynamic descriptor content locally to the appliances in our Threat Prevention System to provide real-time protection throughout our entire deployment. The CMS also provides cross-enterprise threat data correlation to identify and block blended attacks wherever they may occur in a large global enterprise. It also consolidates the management, reporting, and data sharing of threat data in an easy-to-deploy, network-based appliance. The CMS consolidates activities and improves organization-wide situational awareness with a unified security dashboard, which provides a real-time view of the number of infected systems and enables users to drill down directly to infection details.

•

Forensic Analysis System. Our Forensic Analysis System provides powerful auto-configured test environments to allow forensics teams to manually execute and inspect advanced malware, zero-day, and other advanced cyber attacks embedded in files, email attachments, and Web objects. The Forensic Analysis System inspects single files or batches of files for malware and tracks outbound connection attempts across multiple protocols. In virtual execution mode, the Forensic Analysis System analyzes the execution path of a particular malware sample to generate a dynamic and anonymized profile that can be distributed to other FireEye appliances on the network. Malware attack profiles include identifiers of malware code, exploit URLs, and other sources of infections and attacks. To fully analyze the behavior of every unknown file, the Forensic Analysis System provides full malware life cycle analysis. While the Forensic Analysis System is not required for deployments, our larger customers typically purchase the product to enable advanced and deeper analysis of potential malicious software outside of the real-time traffic scanning done by our Threat Prevention appliances.

•

Endpoint Threat Prevention System. Our Endpoint Threat Prevention System is an appliance and endpoint agent-based system that equips security organizations to confidently detect, analyze and resolve security incidents in a fraction of the time it takes using conventional approaches. The Endpoint Threat Prevention System enables security operations teams to connect the dots between security incidents in their networks and endpoints to provide the holistic picture required to find and scope security breaches as they are unfolding. In addition to applying proprietary intelligence to sweep for indicators of compromise, or IOCs, our Endpoint Prevention System automatically investigates alerts generated by FireEye products, SIEM, log management and other network security solutions, to identify the specific devices that have been impacted and assess the potential risk. Security

---

•	Product Subscriptions. The following product subscriptions are attached to our product sales:

•

Dynamic Threat Intelligence Cloud (DTI). Our Dynamic Threat Intelligence, or DTI, cloud interconnects the FireEye appliances deployed within customer networks, technology partner networks, and service providers around the world. Our global FireEye Labs team identifies emerging threats, collects threat samples, and replicates, reviews and characterizes attacks. Threat intelligence is also dynamically generated by each MVX engine to provide real-time forensics used to protect the local network and can be shared globally through our DTI cloud. We leverage the threat intelligence we conduct as well as the real-time analysis from our appliances to update our malware descriptors, attack definitions, scanning engines, and other security solution components. We can easily distribute these updates to customers through our DTI cloud. Our DTI cloud provides a closed-loop system that leverages the network effects of a globally distributed, automated threat analysis network enabled by our Threat Prevention appliances. Customers are required to purchase either a one or three year DTI cloud subscription as part of their initial appliance purchase.

•	Email Threat Prevention Attachment/URL Engine. Our Email Threat Prevention Attachment/URL engine analyzes email attachments and URLs embedded in emails for next-generation threats. Customers who purchase the Email Threat Prevention appliance are also required to purchase a one or three year subscription to our Email Threat Prevention Attachment/URL engine.

•	Security-as-a-Service Offerings.

•

Managed Defense. Managed Defense is a hosted service whereby we monitor a customer’s network and provide a full-service offering that brings together all of the experts, experience and technology required to find attackers at any stage of the attack and respond aggressively before they complete their mission. Managed Defense delivers timely, actionable reports of compromise with negligible false positive rates. We do this through real-time network monitoring and traffic analysis, layered with advanced sweeps of enterprise endpoints and active hunting for adversaries, maintaining vigilance 24x7. Analysis is delivered to provide organizations with the context they need to fully understand the threat, assess risk and prioritize action. We can also provide precise, actionable intelligence to customers regarding how to contain the threat and remediate the environment. In cases where a breach has occurred, the Managed Defense team can bring our incident response consultants onsite as an additional value-added service.

•

Cloud-Based Email Threat Prevention. Our cloud-based Email Threat Prevention service protects against today’s advanced email attacks. With no hardware or software to install, the cloud-based Email Threat Prevention service is a particularly good fit for organizations already moving their email infrastructure into the cloud. To start protecting against malicious emails, organizations simply route messages to the Email Threat Prevention service. The cloud then uses the signature-less MVX engine to detect threats and stop APT attacks in real time.

•

Mobile Threat Prevention. Our Mobile Threat Prevention service identifies malicious applications downloaded onto the Android platform and works with the organization’s infrastructure to prevent these applications from causing damage to the organization. These mobile applications can be downloaded from widely available commercial application stores as well as custom enterprise applications. Rather than relying on malware signatures, which are powerless against today’s fast-moving, constantly changing threats, our Mobile Threat Prevention service executes applications within our MVX engine and provides an automated mobile threat assessment that enables organizations to enforce security policies in the mobile environment.

•	Customer Support and Consulting Services. We provide the following customer support and consulting services that are marketed under the Mandiant brand.

•

Incident response and related consulting services. We have a team of cyber security experts that can quickly respond to customers that have experienced a breach and help them understand the scope of the incident and quickly remediate the attack. Our cyber security experts will inform customers who is behind the attack (i.e., organized crime, nation state or malicious insider) and how much damage was done, and will work with them to recover from the incident while minimizing the impact of the event on the organization. We have performed hundreds of successful computer security investigations

---

•

Training and professional services. We offer training services to our customers and channel partners through our training department and authorized training partners. For both our customers and our channel partners, these services are designed to provide education regarding implementation, use and functionality, and maintenance and support of our products. Specifically for our channel partners, we also provide training regarding how to manage all stages of our sales cycle. We also offer professional services to customers for large implementations where expert technical resources are required. Our professional services consultants help in the design of deployments of our products and work closely with customer engineers, managers and other project team members to implement our products according to design, utilizing network analysis tools, attack simulation software and scripts. We provide professional services directly to our customers, but also deliver these resources by enabling our authorized partners, who provide similar services to our customers.

•

Customer Support and Maintenance Services. We offer technical support on our products and subscriptions. We provide multiple levels of support and have regional support centers located across the globe. Our service representatives work with customers to qualify and solve technical challenges that they may encounter. In addition to post sales support activities, our support organization places emphasis on service readiness by coordinating with our product management team to ensure the attainment of defined pre-requisite quality levels for our products and services prior to release. Like our subscription services, our support and maintenance contracts have terms of either one or three years.

---

---

•

Fast Path Blocking. To maintain high network throughput and leverage known threat data, our MPS appliances utilize our proprietary database of threat intelligence as well as third-party threat data feeds to perform identification of known threats. If the traffic is identified as malicious, it is blocked immediately. If the traffic is not identified as malicious, it is passed to our custom anomaly detector. Threat intelligence includes behavioral information about the threat, versus a specific byte-by-byte fingerprint found with signatures. This helps us to guard against threats that can evolve over time.

•

Line Rate Anomaly Detection. Traffic that is not blocked in our fast path blocking phase is passed to our proprietary anomaly detector. The anomaly detector is designed to identify any remotely suspicious network flows. We have custom built our anomaly detector to deliver high levels of accuracy while preventing any threats from being missed. If any suspicious attributes are detected, the flow is passed on to the virtual execution environment.

•

MVX Execution. Through a pre-configured, instrumented virtual analysis environment, our MVX engine fully executes suspicious objects and flows to allow deep inspection of common file formats, email attachments, and Web objects. Newly discovered malware is installed and executed to completion within our MVX engine so that it is forensically analyzed, tracked and blocked. Analysis of malware is automated to create dynamic blocking of inbound attacks and its outbound transmissions.

•	Notification. If a threat is identified in the virtual environment, the associated DTI gained in the process is shared with other FireEye appliances on the network through our CMS appliance and globally via our DTI cloud.

---

•

Fast Path Blocking. To maintain high network throughput and leverage known threat data, our Threat Prevention appliances utilize our proprietary database of threat intelligence as well as third-party threat data feeds to perform identification of known threats. If the traffic is identified as malicious, it is blocked immediately. If the traffic is not identified as malicious, it is passed to our custom anomaly detector. Threat intelligence includes behavioral information about the threat, versus a specific byte-by-byte fingerprint found with signatures. This helps us to guard against threats that can evolve over time.

•

Line Rate Anomaly Detection. Traffic that is not blocked in our fast path blocking phase is passed to our proprietary anomaly detector. The anomaly detector is designed to identify any remotely suspicious network flows. We have custom built our anomaly detector to deliver high levels of accuracy while preventing any threats from being missed. If any suspicious attributes are detected, the flow is passed on to the virtual execution environment.

•

MVX Execution. Through a pre-configured, instrumented virtual analysis environment, our MVX engine fully executes suspicious objects and flows to allow deep inspection of common file formats, email attachments, and Web objects. Newly discovered malware is installed and executed to completion within our MVX engine so that it is forensically analyzed, tracked and blocked. Analysis of malware is automated to create dynamic blocking of inbound attacks and its outbound transmissions.

•	Notification. If a threat is identified in the virtual environment, the associated DTI gained in the process is shared with other FireEye appliances on the network through our CMS appliance and globally via our DTI cloud.

---

•	Network Monitoring vendors, including Gigamon, Solera Networks (acquired by Blue Coat Systems, Inc. in May 2013) and VSS Monitoring (acquired by Danaher Corporation in June 2012);

•	Security Information & Event Management vendors, including RSA, a subsidiary of EMC, ArcSight, a subsidiary of HP, and Q1 Labs, a subsidiary of IBM, and Splunk;

•	Network Equipment vendors, including Blue Coat and Juniper Networks;

•	Forensic software vendors, including Guidance Software; and

•	Web Application Firewall vendors, including Imperva.

---

•	large networking vendors such as Cisco and Juniper that may emulate or integrate features similar to ours into their own products;

•	large companies such as Intel, IBM and HP that have acquired large IT security specialist vendors in recent years and have the technical and financial resources to bring competitive solutions to the market;

•	independent security vendors such as Sourcefire (which recently announced its pending acquisition by Cisco), Palo Alto Networks and Trend Micro that offer products that claim to perform similar functions to our platform;

•	small and large companies that offer point solutions that compete with some of the features present in our platform;

•	providers of traditional IT security solutions, such as Symantec, that we may compete with in the future; and

•	other providers of incident response services.

•	ability to detect next-generation threats by overcoming the limitations of signature-based approaches;

•	efficacy of the virtual machine technology in terms of detecting the maximum number of threats;

•	scalability, throughput and overall performance of the virtual machine technology;

•	visibility into all stages of an attack, especially the exploit phase;

•	ability to achieve low false-positive rates;

•	breadth and richness of the shared threat data the appliances have access to;

•	ability to process all data entering a network on premise;

•	brand awareness and reputation;

•	strength of sales and marketing efforts;

•	product extensibility and ability to integrate with other technology infrastructures;

•	price and total cost of ownership; and

•	our ability to provide a comprehensive solution of products and services for detecting, preventing and resolving advanced cybersecurity threats.

---

---

•	diversion of management time and focus from operating our business to addressing acquisition integration challenges;

•	coordination of research and development and sales and marketing functions;

•	integration of product and service offerings;

•	retention of key employees from the acquired company;

•	changes in relationships with strategic partners as a result of product acquisitions or strategic positioning resulting from the acquisition;

•	cultural challenges associated with integrating employees from the acquired company into our organization;

---

•	integration of the acquired company’s accounting, management information, human resources and other administrative systems;

•	the need to implement or improve controls, procedures, and policies at a business that prior to the acquisition may have lacked sufficiently effective controls, procedures and policies;

•	financial reporting, revenue recognition or other financial or control deficiencies of the acquired company that we don’t adequately address and that cause our reported results to be incorrect;

•	liability for activities of the acquired company before the acquisition, including intellectual property infringement claims, violations of laws, commercial disputes, tax liabilities and other known and unknown liabilities;

•	unanticipated write-offs or charges; and

•	litigation or other claims in connection with the acquired company, including claims from terminated employees, customers, former stockholders or other third parties.

•	maintain and expand our customer base and the ways in which customers use our products and services;

•	expand revenue from existing customers through increased or broader use of our products and services within their organizations;

•	convince customers to allocate a fixed portion of their annual IT budgets to our products and services;

•	improve the performance and capabilities of our platform through research and development;

•	effectively expand our business domestically and internationally, which will require that we rapidly expand our sales force and service professionals and fill key management positions, particularly internationally; and

•	successfully compete with other companies that currently provide, or may in the future provide, solutions like ours that protect against next-generation advanced cyber attacks.

---

•	effectively attracting, training and integrating a large number of new employees, particularly members of our sales and management teams;

•	further improving our key business applications, processes and IT infrastructure, including our data centers, to support our business needs;

•	enhancing our information and communication systems to ensure that our employees and offices around the world are well coordinated and can effectively communicate with each other and our growing base of channel partners and customers;

•	improving our internal control over financial reporting and disclosure controls and procedures to ensure timely and accurate reporting of our operational and financial results; and

•	appropriately documenting our IT systems and business processes.

---

•	our ability to attract and retain new customers;

•	the budgeting cycles, seasonal buying patterns and purchasing practices of customers;

•	the timing of shipments of our products and length of our sales cycles;

•	changes in customer or reseller requirements or market needs;

•	changes in the growth rate of the IT security market, particularly the market for threat protection solutions like ours that target next-generation advanced cyber attacks;

•	the timing and success of new product and service introductions by us or our competitors or any other change in the competitive landscape of the IT security market, including consolidation among our customers or competitors;

•	the level of awareness of IT security threats, particularly advanced cyber attacks, and the market adoption of our platform;

•	deferral of orders from customers in anticipation of new products or product enhancements announced by us or our competitors;

•	our ability to successfully expand our business domestically and internationally;

•	reductions in customer renewal rates for our subscriptions;

•	decisions by organizations to purchase IT security solutions from larger, more established security vendors or from their primary IT equipment vendors;

•	changes in our pricing policies or those of our competitors;

•	any disruption in, or termination of, our relationship with channel partners;

•	decreases in our customers’ subscription renewal rates;

•	our inability to fulfill our customers’ orders due to supply chain delays or events that impact our manufacturers or their suppliers;

•	insolvency or credit difficulties confronting our customers, affecting their ability to purchase or pay for our products, subscriptions and services, or confronting our key suppliers, particularly our sole source suppliers, which could disrupt our supply chain;

•	the cost and potential outcomes of existing and future litigation;

•	seasonality in our business;

•	general economic conditions, both domestic and in our foreign markets;

•	future accounting pronouncements or changes in our accounting policies or practices;

---

•	the amount and timing of operating costs and capital expenditures related to the expansion of our business;

•	a change in our mix of products, subscriptions and services; and

•	increases or decreases in our expenses caused by fluctuations in foreign currency exchange rates.

•	research and development related to our platform, including investments in our research and development team;

•	sales and marketing, including a significant expansion of our sales organization, particularly in international markets;

•	international expansion of our business;

•	expansion of our professional services organization; and

•	general administration expenses, including legal and accounting expenses related to being a public company.

---

•	greater name recognition, longer operating histories and larger customer bases;

•	larger sales and marketing budgets and resources;

•	broader distribution and established relationships with channel and distribution partners and customers;

•	greater customer support resources;

•	greater resources to make acquisitions;

•	lower labor and research and development costs;

•	larger and more mature intellectual property portfolios; and

•	substantially greater financial, technical and other resources.

---

---

•	increased purchasing power and leverage held by large customers in negotiating contractual arrangements with us;

•	more stringent or costly requirements imposed upon us in our support service contracts with such customers, including stricter support response times and penalties for any failure to meet support requirements;

•	more complicated implementation processes;

•	longer sales cycles and the associated risk that substantial time and resources may be spent on a potential customer that ultimately elects not to purchase our platform or purchases less than we hoped;

•	closer relationships with, and dependence upon, large technology companies who offer competitive products; and

•	more pressure for discounts and write-offs.

---

•	a loss of existing or potential customers or channel partners;

•	delayed or lost revenue;

•	a delay in attaining, or the failure to attain, market acceptance;

•	the expenditure of significant financial and product development resources in efforts to analyze, correct, eliminate, or work around errors or defects, to address and eliminate vulnerabilities, or to identify and ramp up production with alternative third-party manufacturers;

•	an increase in warranty claims, or an increase in the cost of servicing warranty claims, either of which would adversely affect our gross margins;

•	harm to our reputation or brand; and

•	litigation, regulatory inquiries, or investigations that may be costly and further harm our reputation.

---

---

---

---

•	selling to governmental agencies can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that such efforts will generate a sale;

•	government certification requirements applicable to our products may change and in doing so restrict our ability to sell into the U.S. federal government sector until we have attained the revised certification;

•	government demand and payment for our products and services may be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our products and services;

•	we sell our platform to governmental agencies through our indirect channel partners, and these agencies may have statutory, contractual or other legal rights to terminate contracts with our distributors and resellers for convenience or due to a default, and any such termination may adversely impact our future results of operations;

•	governments routinely investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our platform, which would adversely impact our revenue and results of operations, or institute fines or civil or criminal liability if the audit uncovers improper or illegal activities; and

•	governments may require certain products to be manufactured in the United States and other relatively high-cost manufacturing locations, and we may not manufacture all products in locations that meet these requirements, affecting our ability to sell these products to governmental agencies.

---

---

---

•	develop or enhance our products and subscriptions;

•	continue to expand our sales and marketing and research and development organizations;

•	acquire complementary technologies, products or businesses;

•	expand operations, in the United States or internationally;

•	hire, train and retain employees; or

•	respond to competitive pressures or unanticipated working capital requirements.

---

•	greater difficulty in enforcing contracts and managing collections, as well as longer collection periods;

•	higher costs of doing business internationally, including costs incurred in establishing and maintaining office space and equipment for our international operations;

•	fluctuations in exchange rates between the U.S. dollar and foreign currencies in markets where we do business;

•	management communication and integration problems resulting from cultural and geographic dispersion;

•	risks associated with trade restrictions and foreign legal requirements, including any importation, certification, and localization of our platform that may be required in foreign countries;

•	greater risk of unexpected changes in regulatory practices, tariffs, and tax laws and treaties;

•	compliance with anti-bribery laws, including, without limitation, compliance with the U.S. Foreign Corrupt Practices Act of 1977, as amended, the U.S. Travel Act and the UK Bribery Act 2010, violations of which could lead to significant fines, penalties and collateral consequences for our company;

•	heightened risk of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of, or irregularities in, financial statements;

•	the uncertainty of protection for intellectual property rights in some countries;

•	general economic and political conditions in these foreign markets;

•	foreign exchange controls that might prevent us from repatriating cash earned outside the United States;

•	political and economic instability in some countries; and

•	double taxation of our international earnings and potentially adverse tax consequences due to changes in the tax laws of the United States or the foreign jurisdictions in which we operate.

---

---

•	announcements of new products, services or technologies, commercial relationships, acquisitions or other events by us or our competitors;

---

•	changes in how customers perceive the effectiveness of our platform in protecting against advanced cyber attacks or other reputational harm;

•	publicity concerning cyber attacks in general or high profile cyber attacks against specific organizations;

•	price and volume fluctuations in the overall stock market from time to time;

•	significant volatility in the market price and trading volume of technology companies in general and of companies in the IT security industry in particular;

•	fluctuations in the trading volume of our shares or the size of our public float;

•	actual or anticipated changes or fluctuations in our results of operations;

•	whether our results of operations and, in particular, our revenue growth rates meet the expectations of securities analysts or investors;

•	actual or anticipated changes in the expectations of investors or securities analysts, whether as a result of our forward-looking statements, our failure to meet such expectations or otherwise;

•	litigation involving us, our industry, or both;

•	regulatory developments in the United States, foreign countries or both;

•	general economic conditions and trends;

•	major catastrophic events;

•	sales of large blocks of our common stock; or

•	departures of key personnel.

•	14,664,639 shares will be eligible for sale in the public market on March 19, 2014 upon the expiration of lock-up agreements entered into in connection with our initial public offering;

•	95,610,568 shares will be eligible for sale in the public market upon the expiration of the lock-up agreements entered into in connection with our planned secondary offering, assuming the prior effectiveness of the resale registration statement for former stockholders of Mandiant; and

•	1,927 shares will be eligible for sale in the public market on June 30, 2014.

---

---

---

•	a classified board of directors with three-year staggered terms, which could delay the ability of stockholders to change the membership of a majority of our board of directors;

•	the ability of our board of directors to issue shares of preferred stock and to determine the price and other terms of those shares, including preferences and voting rights, without stockholder approval, which could be used to significantly dilute the ownership of a hostile acquiror;

•	the exclusive right of our board of directors to elect a director to fill a vacancy created by the expansion of our board of directors or the resignation, death or removal of a director, which prevents stockholders from being able to fill vacancies on our board of directors;

•	a prohibition on stockholder action by written consent, which forces stockholder action to be taken at an annual or special meeting of our stockholders;

•	the requirement that a special meeting of stockholders may be called only by our board of directors, the chairperson of our board of directors, our chief executive officer or our president (in the absence of a chief executive officer), which could delay the ability of our stockholders to force consideration of a proposal or to take action, including the removal of directors;

•

the requirement for the affirmative vote of holders of at least 66  2/3% of the voting power of all of the then outstanding shares of the voting stock, voting together as a single class, to amend the provisions of our amended and restated certificate of incorporation relating to the management of our business (including our classified board structure) or certain provisions of our amended and restated bylaws, which may inhibit the ability of an acquiror to effect such amendments to facilitate an unsolicited takeover attempt;

•	the ability of our board of directors to amend the bylaws, which may allow our board of directors to take additional actions to prevent an unsolicited takeover and inhibit the ability of an acquiror to amend the bylaws to facilitate an unsolicited takeover attempt; and

•	advance notice procedures with which stockholders must comply to nominate candidates to our board of directors or to propose matters to be acted upon at a stockholders’ meeting, which may discourage or deter a potential acquiror from conducting a solicitation of proxies to elect the acquiror’s own slate of directors or otherwise attempting to obtain control of us.

---

---

---

---

---

---

---

---

---

---

---

•

Product revenue. Our product revenue is generated from sales of our appliances. For our Web MPS, File MPS, MAS and CMS appliances, we recognize product revenue at the time of shipment, provided that all other revenue recognition criteria have been met. For our Email MPS appliances, we recognize product revenue ratably over the longer of the contractual term of the subscription service or the estimated period the customer is expected to benefit from the product.

•

Subscription and services revenue. Subscription and services revenue is generated primarily from our DTI cloud, our Email MPS Attachment/URL engine, and support and maintenance services. Our DTI cloud subscription is determined as a percentage of the price of the related appliance. The Email MPS Attachment/URL engine is priced on a per-user basis. We recognize revenue from subscriptions and support and maintenance services over the one or three year contract term, as applicable.

•

Cost of product revenue. Cost of product revenue primarily consists of costs paid to our third-party contract manufacturers for our appliances and personnel and other costs in our manufacturing operations department. Our cost of product revenue also includes product testing costs, allocated costs and shipping costs. We expect our cost of product revenue to increase as our product revenue increases.

---

•	Cost of subscription and services revenue. Cost of subscription and services revenue consists of personnel costs for our global customer support organization and allocated costs. We expect our cost of subscription and services revenue to increase as our customer base grows and as we hire additional professional services personnel.

•

Research and development. Research and development expense consists primarily of personnel costs and allocated overhead. Research and development expense also includes prototype related expenses. We expect research and development expense to continue to increase in absolute dollars as we continue to invest in our research and product development efforts to enhance our product capabilities, address new threat vectors and access new customer markets, although such expense may fluctuate as a percentage of total revenue.

•

Sales and marketing. Sales and marketing expense consists primarily of personnel costs, incentive commission costs and allocated overhead. We expense commission costs as incurred. Sales and marketing expense also includes costs for market development programs, promotional and other marketing activities, travel, office equipment, depreciation of proof-of-concept evaluation units and outside consulting costs. We expect sales and marketing expense to continue to increase in absolute dollars as we increase the size of our sales and marketing organizations and expand our international operations, although such expense may fluctuate as a percentage of total revenue.

•

General and administrative. General and administrative expense consists of personnel costs, professional services and allocated overhead. General and administrative personnel include our executive, finance, human resources, facilities and legal organizations. Professional services consist primarily of legal, auditing, accounting and other consulting costs. We expect general and administrative expense to continue to increase in absolute dollars as we have recently incurred, and expect to continue to incur, additional general and administrative expenses as we grow our operations and comply with public company regulations, including higher legal, corporate insurance, and accounting expenses.

---

---

---

---

---

---

---

---

---

---

---

---

---

•	Fair Value of Common Stock. Because our common stock was not publicly traded until September 20, 2013, we were required to estimate the fair value of common stock for grants made prior to that date, as discussed in “Common Stock Valuations” below.

•	Risk-Free Interest Rate. We base the risk-free interest rate used in the Black-Scholes option-pricing model on the implied yield available on U.S. Treasury zero-coupon issues with a remaining term equivalent to that of the options for each option group.

•	Expected Term. The expected term represents the period that our stock-based awards are expected to be outstanding. We base the expected term assumption on our historical exercise behavior combined with estimates of the post-vesting holding period.

•

Volatility. We determine the price volatility factor based on the historical volatilities of our publicly traded peer group as we do not have a trading history for our common stock. Industry peers consist of several public companies in the technology industry that are similar to us in size, stage of life cycle, and financial leverage. We used the same set of peer group companies in all the relevant valuation estimates. We did not rely on implied volatilities of traded options in our industry peers’ common stock because the volume of activity was relatively low. We intend to continue to consistently apply this process using the same or similar public companies until a sufficient amount of historical information regarding the volatility of our own common stock share price becomes available, or unless circumstances change such that the identified companies are no longer similar to us, in which case, more suitable companies whose share prices are publicly available would be utilized in the calculation.

•	Dividend Yield. The expected dividend assumption is based on our current expectations about our anticipated dividend policy. Consequently, we used an expected dividend yield of zero.

---

---

---

---

---

---

---

---

---

---

---

---

---

•	Persuasive Evidence of an Arrangement Exists. We rely upon non-cancelable sales agreements and purchase orders to determine the existence of an arrangement.

•	Delivery has Occurred. We use shipping documents or transmissions of service contract registration codes to verify delivery.

•	The Fee is Fixed or Determinable. We assess whether the fee is fixed or determinable based on the payment terms associated with the transaction.

•	Collectability is Reasonably Assured. We assess collectability based on credit analysis and payment history.

---

---

---

•	Level 1—Inputs are unadjusted quoted prices in active markets for identical assets or liabilities.

•	Level 2—Inputs are quoted prices for similar assets and liabilities in active markets or inputs other than quoted prices that are observable for the assets or liabilities, either directly or indirectly through market corroboration, for substantially the full term of the financial instruments.

•	Level 3—Inputs are unobservable inputs based on our own assumptions used to measure assets and liabilities at fair value. The inputs require significant management judgment or estimation.

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---